From the X-Force "Stumbler" advisory: > X-Force has been tracking reports of suspicious and widespread Internet > traffic with a TCP Window size of 55808. A substantial amount of traffic > captured from sites around the world point to a new distributed port > scanning system. ... snip ... > Each agent attempts to map IP addresses and open ports corresponding to > each IP address by sending a TCP SYN packet with a random destination port. This doesn't appear to be the same pattern of activity seen since May. Many people have reported activity from a single spoofed IP to a single destination IP from a random but non-varying source port to a random but non-varying destination port - for weeks at a time. I've seen this on several networks we montor. I see no way this could even pretend to be an effective distributed scan. Intrusec seems to feel that the trojan they found is a copycat; someone created a trojan to try and match the described behavior/traffic with winsize 55808. Probably someone's idea of a joke on the infosec community. The files ISS describe match the files Intrusec described, so why does ISS/X-Force feel that Stumbler is the true source of the traffic? -Joe -- Joe Stewart, GCIH Senior Intrusion Analyst LURHQ Corporation http://www.lurhq.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Fri Jun 20 2003 - 08:32:41 PDT