RE: Abnormally high Sub-Seven attack rate increase

From: James C Slora Jr <Jim.Slora(at)phra.com>
Date: Thu Jan 02 2003 - 13:38:32 EST

Eric Kimminau wrote Tuesday, December 31, 2002 12:10 AM

> Is it just me or has the number of Sub-Seven probes grown
> astronomically in the last 7 days? I am seeing on average 25-30
> clients per day, each scanning 3 or 4 times each up from only 1 or 2
> per day at most for the last several months.

DShield does not show an overall increase, but a fair number of people have experienced a huge growth in probes over the past few days. I've gotten several off-list correlations of individual sub7 scan increases from my post on the incidents.org intrusions list.

It seems to be a network-specific phenomenon.

See the "27374 SubSeven Explosion" thread http://cert.uni-stuttgart.de/archive/intrusions/2002/12/msg00256.html

• Jim

  ---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Jan 2 14:26:13 2003