OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Port 65535
From: Keith Pachulski (keithpCORP.PTD.NET)
Date: Mon Mar 06 2000 - 13:49:28 CST

There was an old trojan that use to run on 65535. I believe
it was called Linuxemu. That was some time ago though, not
sure if a newer trojan is also using that port.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey all...

        Been watching a rather strange scan of our Class C
for the past week; I
don't know if I'd even call it a scan. Perhaps a
misconfigured machine, or
something? Here's a log snippet:
Feb 29 07:12:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=15817 F=0x00B8 T=47
(#7)
Feb 29 07:14:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=16104 F=0x00B8 T=47
(#7)
Feb 29 07:16:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=16310 F=0x00B8 T=47
(#7)
Feb 29 07:18:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=16430 F=0x00B8 T=47
(#7)
Feb 29 07:20:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=16564 F=0x00B8 T=47
(#7)
Feb 29 07:22:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=16767 F=0x00B8 T=47
(#7)
Feb 29 07:24:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=17015 F=0x00B8 T=47
(#7)
Feb 29 07:26:25 firepower kernel: Packet log: private1 DENY
eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00
I=17227 F=0x00B8 T=47
(#7)

        I'm denying all of them at the firewall. I'm
rather curious as to what
it is, though. The source is a machine in Israel, and, as
of yesterday, the
scans were continuing on an intermittent basis. When it's
happening, it sends
out a packet to our machine exactly every two minutes.

        Anybody have any idea on this one?

                                                Mike

- ----------------------------------
Message sent on 02-Mar-00 at 15:54:35

Mike Murray
Apt 1402
666 Spadina Ave
Toronto, ON
M5S 2H8

Phone: (416) 323-3160

        I can't think of anything pithy to say at
        all, today. So, I ramble.
- ----------------------------------

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2

iQA/AwUBOL7VD4DBZTHOsqLmEQJNJACfagI24fOLNIjiyH8sRQ9VhUdGqU0A
oPwa
mTR4DMdfuEIC9q30UubUW6L6
=wG8B
-----END PGP SIGNATURE-----