NEOHAPSIS - Peace of Mind Through Integrity and Insight

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

Neohapsis > Archives > Incidents> 2003-04

157 messages sorted by: [ author ] [ date ] [ thread ]

Starting: Tue Apr 01 2003 - 15:57:32 CST
Ending: Wed Apr 30 2003 - 17:28:19 CDT

[0.5OT answer]possible rootkit, maybe partial?
- nobody (Thu Apr 03 2003 - 06:55:14 CST)
[CERT] possible rootkit, maybe partial?
- ePAc (Wed Apr 02 2003 - 22:27:17 CST)
Administrivia: SPAM control, vacation messages, and the like.
- Dan Hanson (Wed Apr 30 2003 - 11:09:24 CDT)
Anyone seen this UDP source port 7001 traffic?
- Jose Nazario (Mon Apr 28 2003 - 12:12:44 CDT)
- Tina Bird (Mon Apr 28 2003 - 14:30:52 CDT)
- Taz (Mon Apr 28 2003 - 12:14:53 CDT)
- Michael Lau (Sat Apr 26 2003 - 19:34:29 CDT)
- Faron.GoldenGunter.AF.mil (Thu Apr 17 2003 - 16:53:07 CDT)
ATD OpenSSL Mass Exploiter Analysis (another "/sumthin" scan tool)
- Joe Stewart (Mon Apr 07 2003 - 16:54:54 CDT)
Company being War Dialed
- nospamnone.net (Tue Apr 22 2003 - 11:33:23 CDT)
- James.Jacksonbroadwing.com (Mon Apr 21 2003 - 14:07:02 CDT)
- public list (Mon Apr 21 2003 - 01:06:03 CDT)
- James.Phillipsmutualofomaha.com (Mon Apr 21 2003 - 12:15:40 CDT)
- Curt Purdy (Sun Apr 20 2003 - 09:41:57 CDT)
- Kurt Seifried (Sun Apr 20 2003 - 02:02:44 CDT)
- Brett Glass (Sat Apr 19 2003 - 23:45:26 CDT)
- Fred Kreitzberg (Thu Apr 17 2003 - 18:13:03 CDT)
Does anyone recognize the scanner that causes this pattern ?
- deanpackethunter.com (Mon Apr 07 2003 - 15:00:36 CDT)
- Gene (Sun Apr 06 2003 - 18:00:55 CDT)
- Jerry Shenk (Mon Apr 07 2003 - 10:34:02 CDT)
- Justin Coffi (Mon Apr 07 2003 - 03:50:58 CDT)
- Laurent Luyckx (Mon Apr 07 2003 - 01:58:58 CDT)
- deanpackethunter.com (Sun Apr 06 2003 - 14:24:23 CDT)
Educational Incident Data Comparison Pilot (X-Post)
- Alfred Huger (Tue Apr 01 2003 - 17:50:44 CST)
Field Report: New Worm
- falconcybersecret.com (Thu Apr 03 2003 - 07:01:22 CST)
Increase in Source to Port 445
- aladin168 (Thu Apr 03 2003 - 13:45:07 CST)
- James C Slora Jr (Thu Apr 03 2003 - 09:07:01 CST)
- Rob Keown (Tue Apr 01 2003 - 20:54:58 CST)
Increase of attempts on port 635 in last couple days
- Jeff Lane (Wed Apr 02 2003 - 09:45:14 CST)
Intresting problem concerning libresolv.so.2
- Paul Gear (Sun Apr 20 2003 - 01:00:29 CDT)
- Paul Gear (Fri Apr 18 2003 - 22:53:21 CDT)
- Kevin Reardon (Thu Apr 17 2003 - 19:05:22 CDT)
- Sam Evans (Tue Apr 15 2003 - 14:00:19 CDT)
IP Spoofs in the log - not sure what to do next
- aladin168 (Thu Apr 24 2003 - 09:12:04 CDT)
- David Hawley (Tue Apr 22 2003 - 03:13:52 CDT)
- crawford charles (Mon Apr 21 2003 - 12:30:52 CDT)
- David Klotz (Mon Apr 21 2003 - 08:27:40 CDT)
- Curt Purdy (Sun Apr 20 2003 - 10:06:45 CDT)
- Chris Corbett (Thu Apr 17 2003 - 17:17:53 CDT)
Logging of connects to port 6346
- Nicolas Couture (Tue Apr 15 2003 - 12:16:38 CDT)
- LordInfidel (Tue Apr 15 2003 - 16:30:38 CDT)
- kbergenbellsouth.net (Mon Apr 14 2003 - 17:58:03 CDT)
Logon.dll? Possible root-kit?
- Jason Pagano (Fri Apr 04 2003 - 07:40:32 CST)
- Rob Shein (Fri Apr 04 2003 - 11:02:03 CST)
- Harlan Carvey (Thu Apr 03 2003 - 19:14:08 CST)
- Nick Jacobsen (Thu Apr 03 2003 - 19:23:24 CST)
- Nick Jacobsen (Thu Apr 03 2003 - 14:43:05 CST)
- Harlan Carvey (Thu Apr 03 2003 - 07:20:10 CST)
- Rob Shein (Thu Apr 03 2003 - 09:34:45 CST)
- Amarante, Rodrigo P. (Thu Apr 03 2003 - 09:13:59 CST)
- Nick Jacobsen (Wed Apr 02 2003 - 22:29:21 CST)
- Nick Jacobsen (Wed Apr 02 2003 - 20:09:47 CST)
Logon/Logoff Failure Events
- Russell Morrison (Thu Apr 03 2003 - 10:17:50 CST)
- John Ives (Thu Apr 03 2003 - 12:04:15 CST)
- Robert Wagner (Tue Apr 01 2003 - 09:16:28 CST)
Logs showing GET /.hash=...
- Chris Mann (Wed Apr 30 2003 - 12:30:31 CDT)
- Keith Bergen (Wed Apr 30 2003 - 08:54:30 CDT)
lots of port 0 scannings
- Neil Dickey (Mon Apr 28 2003 - 14:28:36 CDT)
- Brad Doctor (Mon Apr 28 2003 - 12:19:09 CDT)
- SB CH (Sun Apr 27 2003 - 19:51:58 CDT)
Mo'Logs
- sfnoameppel.com (Sat Apr 19 2003 - 21:50:04 CDT)
msamba
- Tobias Klein (Fri Apr 25 2003 - 05:06:02 CDT)
- noconflic (Tue Apr 22 2003 - 10:14:48 CDT)
- noconflic (Tue Apr 22 2003 - 09:48:34 CDT)
- Steve Bromwich (Tue Apr 22 2003 - 09:08:18 CDT)
- Nikola Pepelishev (Tue Apr 22 2003 - 03:12:00 CDT)
- William Salusky (Tue Apr 22 2003 - 00:20:00 CDT)
- Paulo Abrantes (Mon Apr 21 2003 - 13:00:54 CDT)
- Steve Bromwich (Mon Apr 21 2003 - 10:41:27 CDT)
New Article: U.S. Information Security Law, Part 2
- Dan Hanson (Tue Apr 01 2003 - 12:25:24 CST)
New attack or old Vulnerability Scanner?
- Jason Falciola (Wed Apr 30 2003 - 12:41:05 CDT)
- Jason Falciola (Tue Apr 29 2003 - 19:37:19 CDT)
- Mark Embrich (Tue Apr 29 2003 - 13:34:03 CDT)
- jac (Tue Apr 29 2003 - 15:21:49 CDT)
- rhandwerkeriss.net (Mon Apr 28 2003 - 11:45:20 CDT)
- Keith (Fri Apr 25 2003 - 16:40:40 CDT)
- Jason Falciola (Sat Apr 26 2003 - 06:56:17 CDT)
- James C. Slora, Jr. (Fri Apr 25 2003 - 14:00:56 CDT)
- Mark Embrich (Thu Apr 24 2003 - 18:43:43 CDT)
new attack tool combining SMB and WebDAV?
- Toby Miller (Mon Mar 31 2003 - 20:20:22 CST)
New CodeRed strain?
- Frank Knobbe (Fri Apr 25 2003 - 14:23:57 CDT)
- Frank Knobbe (Fri Apr 25 2003 - 13:55:13 CDT)
New CodeRed strain? -- UPDATE
- larosa, vjay (Tue Apr 29 2003 - 21:38:03 CDT)
- Justin Pryzby (Tue Apr 29 2003 - 17:13:53 CDT)
- Frank Knobbe (Mon Apr 28 2003 - 12:13:11 CDT)
New SecurityFocus article: Specter: A Commercial Honeypot Solution for Windows
- Dan Hanson (Wed Apr 09 2003 - 11:37:17 CDT)
New SecurityFocus article: Steganography Revealed
- Dan Hanson (Wed Apr 09 2003 - 11:38:50 CDT)
New trojan? Old trojan with new characteristics? Anyone seen this?
- Mike Parkin (Wed Apr 09 2003 - 17:51:11 CDT)
New trojan? Old trojan with new characteristics? Anyone seenthis?
- Mike Parkin (Tue Apr 15 2003 - 10:37:48 CDT)
- vex86rogers.com (Mon Apr 14 2003 - 18:57:00 CDT)
- Alex Lambert (Thu Apr 10 2003 - 19:55:08 CDT)
Odd IIS log entries
- James C. Slora, Jr. (Wed Apr 30 2003 - 08:28:08 CDT)
- Hahn, Jacob (Mon Apr 28 2003 - 12:27:11 CDT)
POP3 logon attempts
- Steve Cody (Tue Apr 22 2003 - 16:44:06 CDT)
- Mike (Tue Apr 01 2003 - 21:40:07 CST)
- dreamwvrdreamwvr.com (Tue Apr 01 2003 - 09:33:56 CST)
- Tom Fischer (Tue Apr 01 2003 - 02:49:34 CST)
port 139 syn-fin scans
- Toby Miller (Sun Apr 20 2003 - 20:08:45 CDT)
- Muchacki Robert (Sun Apr 20 2003 - 15:02:52 CDT)
- Kevin Hodle (Mon Apr 21 2003 - 00:51:33 CDT)
- Scott A. McIntyre (Sun Apr 20 2003 - 04:11:21 CDT)
- Skip Carter (Fri Apr 18 2003 - 13:51:32 CDT)
Port 17300 probes?
- Joe Stewart (Tue Apr 15 2003 - 16:18:38 CDT)
- Joris De Donder (Tue Apr 15 2003 - 13:38:55 CDT)
- MARLON BORBA (Mon Apr 14 2003 - 11:38:56 CDT)
- Kevin Patz (Mon Apr 14 2003 - 14:12:02 CDT)
- Gerd Feiner (Mon Apr 14 2003 - 11:37:54 CDT)
- incidentsmwwm.net (Mon Apr 14 2003 - 01:50:45 CDT)
Port 3366 activity
- defaillancehushmail.com (Tue Apr 15 2003 - 10:35:28 CDT)
port 5168
- Harlan Carvey (Fri Apr 18 2003 - 05:54:04 CDT)
- Molony, Duncan (Thu Apr 17 2003 - 13:03:42 CDT)
Port 6666 Scans
- Thomas Vincent (Wed Apr 16 2003 - 08:51:26 CDT)
possible rootkit, maybe partial?
- D.C. van Moolenbroek (Thu Apr 03 2003 - 06:59:03 CST)
- Richard Rager (Wed Apr 02 2003 - 22:29:03 CST)
- Benjamin Tomhave (Wed Apr 02 2003 - 21:47:05 CST)
protocol watcher
- Jose Nazario (Wed Apr 23 2003 - 09:22:29 CDT)
- Justin Pryzby (Tue Apr 22 2003 - 10:03:06 CDT)
RECAP: possible rootkit, maybe partial?
- Benjamin Tomhave (Thu Apr 03 2003 - 15:45:17 CST)
Scans on TCP port 9631 + other unknown ports
- Kevin Patz (Fri Apr 25 2003 - 07:10:30 CDT)
SMTP probes
- Christine Kronberg (Mon Apr 07 2003 - 04:28:04 CDT)
- Bojan Zdrnja (Sat Apr 05 2003 - 04:23:22 CST)
- Neil Dickey (Fri Apr 04 2003 - 23:09:04 CST)
- Rich Puhek (Fri Apr 04 2003 - 13:22:23 CST)
SMTP Scans
- Chris Boyd (Mon Apr 28 2003 - 12:25:15 CDT)
- pauldoevil.com (Sat Apr 26 2003 - 02:09:35 CDT)
- Hoof Hearted (Fri Apr 25 2003 - 19:21:57 CDT)
- Kurt Seifried (Thu Apr 24 2003 - 14:43:20 CDT)
- Jimi Thompson (Wed Apr 23 2003 - 22:15:57 CDT)
- Luc Somers (Tue Apr 22 2003 - 10:42:36 CDT)
- Mally Mclane (Tue Apr 22 2003 - 09:40:28 CDT)
- Rob Shein (Mon Apr 21 2003 - 17:50:33 CDT)
- Hoof Hearted (Sun Apr 20 2003 - 06:07:04 CDT)
SQL Slammer Variant?
- Rob Shein (Wed Apr 02 2003 - 09:24:13 CST)
- Wilson, Aaron J. (Tue Apr 01 2003 - 15:17:06 CST)
- crucible (Tue Apr 01 2003 - 06:53:20 CST)
Strange, scary, subtle trojan
- Dowling, Gabrielle (Sun Apr 20 2003 - 13:35:35 CDT)
- Jeff Kell (Fri Apr 18 2003 - 00:01:15 CDT)
Tracking proxies on port 1180/1182
- Michael Scheidell (Mon Apr 21 2003 - 14:56:46 CDT)
- George Bakos (Mon Apr 21 2003 - 14:55:45 CDT)
- Joe Stewart (Mon Apr 21 2003 - 13:54:48 CDT)
Trojan found...
- Patrick Nolan (Thu Apr 24 2003 - 15:58:18 CDT)
- aladin168 (Thu Apr 24 2003 - 09:22:50 CDT)
- Harlan Carvey (Thu Apr 17 2003 - 18:08:36 CDT)
- Les Ault (Thu Apr 17 2003 - 20:47:49 CDT)
- Les Ault (Tue Apr 15 2003 - 19:24:49 CDT)
UDP packets towards port 38293 (NAV)
- Nexus (Wed Apr 30 2003 - 16:37:36 CDT)
- Russell Fulton (Wed Apr 30 2003 - 14:54:29 CDT)
- Alan B. Clegg (Tue Apr 29 2003 - 19:51:54 CDT)
UDP scans from AOL NS boxes?
- Mike Mills (Thu Apr 03 2003 - 11:27:07 CST)
UDP traffic to net and broadcast addresses
- Joshua Wright (Thu Apr 03 2003 - 13:53:11 CST)
- Zen (Wed Apr 02 2003 - 04:12:14 CST)
undetected DDOS
- Chris Cahill (Mon Apr 28 2003 - 14:30:55 CDT)
unknown rootkit found in the wild
- Jerome (Mon Apr 07 2003 - 13:40:07 CDT)
WebDAV Exploit Lab
- Jeremy Junginger (Tue Apr 01 2003 - 09:28:01 CST)
Why alerts on ports 1025-1029, 1036
- Leo, Joel (Tue Apr 01 2003 - 18:54:23 CST)
- Stuart Wallace (Tue Apr 01 2003 - 02:14:12 CST)
- Matt Marcos (Mon Mar 31 2003 - 19:11:59 CST)

Last message date: Wed Apr 30 2003 - 17:28:19 CDT
Archived on: Wed Apr 30 2003 - 17:28:19 CDT

157 messages sorted by: [ author ] [ date ] [ thread ]