Re: Bad protocol version identification '^V^C^A'

From: jm <security(at)wirerats.org>
Date: Fri Nov 29 2002 - 19:24:51 EST

('binary' encoding is not supported, stored as-is)
In-Reply-To: <1395.136.159.104.19.1038501745.squirrel@webmail.enel.ucalgary.ca>

I wouldn't worry too much about this. These type of log events are usually symbolic of some type of network scanner or brute force scanner. You can duplicate a similar log event by using nc or telnet and connecting to a 'ssh' server ( nc -vv hostAddress 22 ). However, I would be concerned with whatever service you have listening that are identified in you logs before the ip address of the remote connection ( ie /bin/id and /usr/bin/id ...). I would check to see what these services are and if you don't need them I would disable them as it may be possible that someone is trying to exploit that service.

jm

>Received: (qmail 1361 invoked from network); 29 Nov 2002 23:47:17 -0000
>Received: from outgoing3.securityfocus.com (205.206.231.27)
> by mail.securityfocus.com with SMTP; 29 Nov 2002 23:47:17 -0000
>Received: from lists.securityfocus.com (lists.securityfocus.com
[205.206.231.19])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id 6F4ECA30F8; Fri, 29 Nov 2002 16:38:26 -0700 (MST)
>Mailing-List: contact incidents-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <incidents.list-id.securityfocus.com>
>List-Post: <mailto:incidents@securityfocus.com>
>List-Help: <mailto:incidents-help@securityfocus.com>
>List-Unsubscribe: <mailto:incidents-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:incidents-subscribe@securityfocus.com>
>Delivered-To: mailing list incidents@securityfocus.com
>Delivered-To: moderator for incidents@securityfocus.com
>Received: (qmail 9369 invoked from network); 28 Nov 2002 16:22:05 -0000
>From: Randy Millis <rmillisl@enel.ucalgary.ca>
>Message-ID:

<1395.136.159.104.19.1038501745.squirrel@webmail.enel.ucalgary.ca>
>Date: Thu, 28 Nov 2002 09:42:25 -0700 (MST)

--

>This list is provided by the SecurityFocus ARIS analyzer service.



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com

Received on Sat Nov 30 19:27:25 2002