From: Jake Babbin (jbabbincomcast.net)
Date: Wed Jul 09 2003 - 23:49:27 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

James,
Yes this is common to the kazaa application. If you see this port coming
from a host then that means that the host is sharing files this is
apparently different that the main application port of 1214. We found this
port open on some servers at a client site the other night and upon futher
investigation found kazaa being used on the network.
One other trick to determine if the host in question is actually using
kazaa. Telnet to the host on port 3531/tcp if this host answers with an HTTP
error (you might have to hit enter a couple of time to get it to crap out)
then this is most likely a kazaa client.
Or you can try looking through the ports on the host and if you see 1214/tcp
open then you can try to this trick.
telnet victim host port 1214
once connected
type: GET / HTTP/1.0 <enter><enter>
This will pop back an HTTP error giving you the victims kazaa username and
what network they are on and if they are a supernode sharing files.

Hope this helps,
Jake Babbin, GCIH
Sr. Security Engineer

----- Original Message -----
From: "James Lay" <jlayameriben.com>
To: <incidentssecurityfocus.com>
Sent: Tuesday, July 08, 2003 6:06 PM
Subject: P2P Networking and port 3531

> Hey all!
>
> Real quick...saw this today on my network:
>
> P2PNetworking.exe had udp and tcp port 3531 open. Packet caps of tcp
(only
> in ascii though :() show:
> KK
> CDN0/0
>
> Googling didn't bring up much, so I thought I'd see if anyone has seen
this
> kind of activity before. Thanks!
>
> James
>
> --------------------------------------------------------------------------
--
> Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the
> world's premier technical IT security event! 10 tracks, 15 training
sessions,
> 1,800 delegates from 30 nations including all of the top experts, from
CSO's to
> "underground" security specialists. See for yourself what the buzz is
about!
> Early-bird registration ends July 3. This event will sell out.
www.blackhat.com
> --------------------------------------------------------------------------
--
>

----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the
world's premier technical IT security event! 10 tracks, 15 training sessions,
1,800 delegates from 30 nations including all of the top experts, from CSO's to
"underground" security specialists. See for yourself what the buzz is about!
Early-bird registration ends July 3. This event will sell out. www.blackhat.com
----------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]