yea, ive had the same things as of late, its some new hx0r scanner from china if i remember correctly, ive got some logs if you want to take a look and compare, at the time i thought they were a possible new worm, there was some discussion of this in another email group, im in a few to many and cannot recall which one though

logs:
http://www.variate.net/deviate/tech/foo/scans/

-----Original Message-----
From: Steve Moran [mailto:steve.morancsssoftware.com]
Sent: Monday, December 02, 2002 12:10 PM
To: snort-userslists.sourceforge.net
Subject: [Snort-users] massive scans

Lately I've seen some odd port 80 scans, these scans have been setting off somewhere in the neighborhood of 160-250 different snort signatures. There have been 3 of these scans. One to my mail server, which is on one class c network ( a 198 network), the other two where to an entirely different class c (a 65 network). These scans are very efficient, ie only 1-3 packets per type of exploit. They are not targeted, ie they are looking for any exploit, lotus, windows, apache, anything. One admin said he found an executable called network32 on his dns server and many registry entries to have it automatically start. It was in the win32\label directory. The second attack was from italy, from what appears to be some small italian town's website ( I don't speak or read italian so I'm not entirely sure), but I have not gotten any response from requests for help regarding the scan. I'm still collecting info on the third and latest scan. I don't think I'm being deliberately targeted, as these scans are way too noisy, personally, if it was me, I'd at least take the time to do some recon and tailor my attack to the type of web server.
As nothing has been comprosmised and no damage done, law enforcement doesn't really care. As there are close to 1000 packets and, like I said 160-250 different types of attacks, reporting them is very hard, and no one really seems to care (no damage).
Is anyone else seeing this sort of traffic lately? I have 3 snort sensors, and they've been running for close to 2 years, and these attacks have registered on two different sensors, running different versions of snort, so I doubt its a snort freak out that's caused this. Is any one aware of some sort of new bug doing this?

-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T
handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]