|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Subject: Re: ingreslock message
From: Eric Maiwald (emaiwald
FRED.NET)Date: Tue Mar 07 2000 - 14:13:30 CST
- Next message: John Nemeth: "Re: auto-reporting to ISPs"
- Previous message: H D Moore: "Re: ingreslock message"
- In reply to: Dino Amato: "ingreslock message"
- Next in thread: Jens Hektor: "Re: ingreslock message"
- Reply: Eric Maiwald: "Re: ingreslock message"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Sun, 5 Mar 2000, Dino Amato wrote:
> I logged this:
> Mar 5 15:58:23 monitor tcplogd: ingreslock connection attempt from unknownsleipnir1.cs.ucl.ac.uk
> what does the ingreslock mean and what was this person trying to do?
> Thanks
The ingresslock port is 1524 (I think). It has been used recently
as a backdoor by some intruders. They add a line to inetd.conf to
accept connections on 1524.
This person may have been looking for systems that have been broken.
Eric
---------------------------------------------------------------------
Eric Maiwald emaiwaldfred.net
So Many Hobbies, So little time
---------------------------------------------------------------------
- Next message: John Nemeth: "Re: auto-reporting to ISPs"
- Previous message: H D Moore: "Re: ingreslock message"
- In reply to: Dino Amato: "ingreslock message"
- Next in thread: Jens Hektor: "Re: ingreslock message"
- Reply: Eric Maiwald: "Re: ingreslock message"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]