OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Full-Disclosure] Mystery DNS Changes

From: Mike Tancsa (mikesentex.net)
Date: Wed Oct 01 2003 - 16:37:45 CDT

Sounds like

http://vil.nai.com/vil/content/v_100719.htm

         ---Mike

At 03:19 PM 01/10/2003, Hansen, Kevin wrote:

>We have seen multiple instances where DHCP enabled workstations have had
>their DNS reconfigured to point to two of the three addresses listed
>below. Can anyone else confirm this? Incidents.org is reporting an
>increase in port 53 traffic over the last two days. Are we looking at the
>precursor to the next worm?
>
>216.127.92.38
>69.57.146.14
>69.57.147.175
>
>-KJH
>
>++++++++++++++++++++++++++
>Kevin J. Hansen
>Architect
>Global Network
>Thomson Legal & Regulatory
>kevin.hansenthomson.com
>651-687-8466
>++++++++++++++++++++++++++

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html