Mailing List Archive For incidents@securityfocus.com Dec 2002 By Author

• Adam Bultman
  • Re: fswserv.html ???? (Tue Dec 17 2002 - 13:25:05 EST)
• alfaentomega
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Fri Dec 27 2002 - 03:36:29 EST)
  • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Fri Dec 27 2002 - 03:27:47 EST)
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Fri Dec 27 2002 - 03:44:19 EST)
  • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Fri Dec 27 2002 - 03:52:26 EST)
  • Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Tue Dec 24 2002 - 00:33:59 EST)
• Andrews, Jonathan (US - Hermitage)
  • RE: Odd entries in my Security Router logs (Tue Dec 10 2002 - 12:17:54 EST)
• Anton A. Chuvakin
  • what else you can do with worm networks...fun, profit, etc (Mon Dec 09 2002 - 13:27:24 EST)
• Bojan Zdrnja
  • RE: hpd, afb, sc, and sn (Sat Dec 21 2002 - 10:16:27 EST)
  • RE: A small quandary (Mon Dec 09 2002 - 06:02:48 EST)
  • RE: Bad protocol version identification '^V^C^A' (Sun Dec 01 2002 - 04:15:49 EST)
• Brad Arlt
  • Re: hpd, afb, sc, and sn (Fri Dec 20 2002 - 17:28:48 EST)
• Byrne Ghavalas
  • Re: Logs: Many hits with source port of 80 (Mon Dec 16 2002 - 09:21:14 EST)
  • Logs: Many hits with source port of 80 (Fri Dec 13 2002 - 05:05:56 EST)
• Carlo Costanzo
  • RE: EBay Fraud Attempt (Tue Dec 10 2002 - 01:13:33 EST)
• Carlos Eduardo Pedroza Santiviago
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 15:31:03 EST)
• Charles.Fasching(at)milestonesystems.com
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Thu Dec 26 2002 - 17:47:37 EST)
• Chip Mefford
  • Re: Incident tracking database (Wed Dec 04 2002 - 07:41:34 EST)
• Chris
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Fri Dec 20 2002 - 15:53:16 EST)
• Chris A. Mattingly
  • Re: EBay Fraud Attempt (Tue Dec 10 2002 - 01:01:52 EST)
• Chris Adams
  • Re: Incident tracking database (Fri Dec 06 2002 - 01:24:25 EST)
• Chris Gordon
  • RE: EBay Fraud Attempt (Wed Dec 11 2002 - 12:46:03 EST)
• Christopher X. Candreva
  • Re: Spam via proxy (Sun Dec 08 2002 - 22:50:04 EST)
• Curt Wilson
  • TsInternetUser priv. escalation; blank passwords; service passwords (Mon Dec 23 2002 - 03:05:32 EST)
  • Black Ice small segment size FTP attack caused by FX-scanner (Thu Dec 05 2002 - 18:02:15 EST)
• D.C. van Moolenbroek
  • Re: Bad protocol version identification '^V^C^A' (Sun Dec 01 2002 - 15:03:25 EST)
• Damian Gerow
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 16:36:46 EST)
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 13:47:28 EST)
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 12:38:33 EST)
  • Rooted, .haos on system (Thu Dec 12 2002 - 18:50:22 EST)
• Danny
  • Incident tracking database (Tue Dec 03 2002 - 11:05:51 EST)
• Dave Laird
  • Re: EBay Fraud Attempt (Tue Dec 10 2002 - 02:58:05 EST)
  • Fwd: EBay Fraud Attempt (Mon Dec 09 2002 - 03:30:17 EST)
• David Gillett
  • Virus? Trojan? (Mon Dec 30 2002 - 17:03:18 EST)
  • New CIFS (port 445) worm? (Tue Dec 17 2002 - 11:30:13 EST)
  • RE: Odd entries in my Security Router logs (Wed Dec 11 2002 - 15:59:12 EST)
• deadcalm(at)treshna.com
  • Re: hpd, afb, sc, and sn (Sun Dec 22 2002 - 22:49:33 EST)
• dev
  • Re: fswserv.html ???? (Mon Dec 16 2002 - 18:40:32 EST)
• Don Phillipe
  • MS IIS 5 server is hacked leaving undeletable folders and files (Tue Dec 31 2002 - 12:05:27 EST)
• Eric Chien
  • Re: IRC -> smtp worm? (Wed Dec 18 2002 - 13:53:31 EST)
• Eric Kimminau
  • Abnormally high Sub-Seven attack rate increase (Tue Dec 31 2002 - 00:09:40 EST)
• Faron.Golden(at)Gunter.AF.mil
  • RE: DNS help (Thu Dec 12 2002 - 16:58:41 EST)
• Fyodor
  • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Tue Dec 24 2002 - 14:18:16 EST)
• Gary Flynn
  • What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation (Tue Dec 31 2002 - 08:20:58 EST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Sat Dec 28 2002 - 09:46:55 EST)
• george.wasgatt(at)insurity.com
  • RE: Win2k Audit Logs - What happened here? (Mon Dec 16 2002 - 14:19:17 EST)
  • RE: EBay Fraud Attempt (Tue Dec 10 2002 - 08:40:15 EST)
• gminick
  • Re: hpd, afb, sc, and sn (Sat Dec 21 2002 - 05:53:33 EST)
  • Re: A small quandary (Sat Dec 07 2002 - 13:27:40 EST)
• Gordon Chamberlin
  • hpd, afb, sc, and sn (Fri Dec 20 2002 - 16:11:31 EST)
• Greg Barnes
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Mon Dec 30 2002 - 15:05:54 EST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Mon Dec 30 2002 - 14:25:07 EST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Mon Dec 30 2002 - 14:06:35 EST)
  • Re: hpd, afb, sc, and sn (Fri Dec 20 2002 - 17:19:04 EST)
• H C
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Fri Dec 27 2002 - 14:35:16 EST)
  • Re: IRC -> smtp worm? (Wed Dec 18 2002 - 11:00:37 EST)
  • Re: Win2k Audit Logs - What happened here? (Mon Dec 16 2002 - 16:41:32 EST)
  • Re: netbios vuln (Mon Dec 09 2002 - 09:12:47 EST)
  • Re: A small quandary (Fri Dec 06 2002 - 08:49:11 EST)
• HggdH
  • Re: Odd entries in my Security Router logs (Wed Dec 11 2002 - 17:11:55 EST)
• Holger Kipp
  • Re: Incident tracking database (Wed Dec 04 2002 - 03:13:37 EST)
• horape(at)tinuviel.compendium.net.ar
  • abuse of open transparent proxies (Tue Dec 17 2002 - 21:58:29 EST)
• Hornat, Charles
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Fri Dec 27 2002 - 11:57:50 EST)
• Jacek Lipkowski
  • port 3717/udp? (Fri Dec 20 2002 - 13:23:08 EST)
• Jack Arenberg
  • Does W2k issue an NBNS query automatically following each unsuccessful reverse DNS query? (Sat Dec 07 2002 - 11:51:10 EST)
• james
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 15:54:45 EST)
  • Re: fswserv.html ???? (Tue Dec 17 2002 - 14:17:31 EST)
  • Re: fswserv.html ???? (Tue Dec 17 2002 - 12:36:38 EST)
  • Re: Incident tracking database (Wed Dec 04 2002 - 02:55:15 EST)
• James C Slora Jr
  • RE: Logs: Many hits with source port of 80 (Mon Dec 16 2002 - 15:29:52 EST)
  • RE: Logs: Many hits with source port of 80 (Mon Dec 16 2002 - 08:37:20 EST)
• James C. Slora Jr.
  • Re: NIMDA - ceased ? - (Fri Dec 27 2002 - 13:36:51 EST)
  • Re: Odd entries in my Security Router logs (Wed Dec 11 2002 - 13:44:47 EST)
• James-lists
  • fswserv.html ???? (Mon Dec 16 2002 - 17:49:03 EST)
• Jefferson Ogata
  • Re: Spam via proxy (Mon Dec 09 2002 - 11:04:34 EST)
• Jerry Shenk
  • RE: A small quandary (Fri Dec 06 2002 - 08:35:36 EST)
• Jim Terry
  • RE: Odd entries in my Security Router logs (Tue Dec 10 2002 - 05:22:37 EST)
• jlewis(at)lewis.org
  • Re: EBay Fraud Attempt (Sun Dec 08 2002 - 23:45:22 EST)
  • Re: Spam via proxy (Sun Dec 08 2002 - 23:22:25 EST)
• Joao Gouveia
  • IRC -> smtp worm? (Tue Dec 17 2002 - 21:37:08 EST)
• Joe Blatz
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 14:50:10 EST)
• Joe Stewart
  • Re: Logs: Many hits with source port of 80 (Mon Dec 16 2002 - 10:27:32 EST)
  • Re: Spam via proxy (Mon Dec 09 2002 - 08:31:59 EST)
  • Re: TCP:80, TCP:1433 squelda 1.0 probe (Mon Dec 02 2002 - 08:53:24 EST)
• Johannes Ullrich
  • Re: NIMDA - ceased ? - (Fri Dec 27 2002 - 12:12:12 EST)
• John Paul
  • PDL anti-spam blacklist (Tue Dec 31 2002 - 14:08:02 EST)
• John Sage
  • Re: TCP:80, TCP:1433 squelda 1.0 probe (Mon Dec 02 2002 - 19:29:30 EST)
• Johnny Walker
  • Win2k Audit Logs - What happened here? (Sun Dec 15 2002 - 21:50:57 EST)
• Jonathan Rickman
  • Re: Virus? Trojan? (Mon Dec 30 2002 - 20:15:42 EST)
• Julian Young
  • Re: Rooted, .haos on system (Tue Dec 17 2002 - 03:14:00 EST)
  • RE: Odd entries in my Security Router logs (Tue Dec 10 2002 - 06:28:45 EST)
  • RE: Odd entries in my Security Router logs (Wed Dec 11 2002 - 03:53:54 EST)
  • Odd entries in my Security Router logs (Mon Dec 09 2002 - 04:37:47 EST)
• Kee Hinckley
  • Re: EBay Fraud Attempt (Tue Dec 10 2002 - 01:17:28 EST)
• Kevin Bowman
  • Re: Logs: Many hits with source port of 80 (Mon Dec 16 2002 - 13:54:03 EST)
• Kevin Reardon
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Fri Dec 27 2002 - 13:55:29 EST)
• KoRe MeLtDoWn
  • Re: netbios vuln (Sun Dec 08 2002 - 23:25:03 EST)
• Kurt Seifried
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Tue Dec 24 2002 - 12:58:05 EST)
• Kyle Lai
  • Re: Worm on 445/tcp? (Thu Dec 19 2002 - 16:06:28 EST)
• larosa, vjay
  • RE: DNS help (Thu Dec 12 2002 - 14:54:29 EST)
  • DNS help (Wed Dec 11 2002 - 16:09:49 EST)
• listuser
  • Spam via proxy (Sat Dec 07 2002 - 12:52:37 EST)
• Logan F.D. Greenlee
  • EBay Fraud Attempt (Sat Dec 07 2002 - 10:25:29 EST)
• Mahoney, Paul
  • A small quandary (Wed Dec 04 2002 - 23:30:08 EST)
• Marcelo Bartsch
  • high activity on port 3061 udp/tcp (Fri Dec 06 2002 - 16:25:49 EST)
• Mark
  • Re: EBay Fraud Attempt (Wed Dec 11 2002 - 13:19:47 EST)
• Mathias Wegner
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Tue Dec 24 2002 - 12:21:31 EST)
• Matt Harris
  • Re: Bad protocol version identification '^V^C^A' (Mon Dec 02 2002 - 09:51:34 EST)
• Matt Zimmerman
  • Re: DNS help (Sun Dec 15 2002 - 17:47:52 EST)
• Mattias Hedenskog
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 15:51:17 EST)
• Maxime Ducharme
  • Re: Many hits with source port of 80 (Mon Dec 16 2002 - 12:01:57 EST)
• Michael Sierchio
  • Re: Odd entries in my Security Router logs (Wed Dec 11 2002 - 13:08:49 EST)
• Mike Katz
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 14:31:23 EST)
  • Re: A small quandary (Fri Dec 06 2002 - 13:41:35 EST)
• Neil Dickey
  • Re: NIMDA - ceased ? - (Fri Dec 27 2002 - 12:25:35 EST)
• Nick FitzGerald
  • Re: Virus? Trojan? (Mon Dec 30 2002 - 21:00:15 EST)
  • Re: netbios vuln (Mon Dec 09 2002 - 04:36:51 EST)
• OBrien, Brennan
  • RE: Worm on 445/tcp? (Tue Dec 17 2002 - 12:31:42 EST)
  • RE: EBay Fraud Attempt (Tue Dec 10 2002 - 10:43:13 EST)
• ohnonono(at)hushmail.com
  • netbios vuln (Fri Dec 06 2002 - 09:50:02 EST)
• Oliver.C.Rochford CFH
  • Re[2]: Rooted, .haos on system (Tue Dec 17 2002 - 03:36:28 EST)
• Paul Gillingwater
  • Re: Incident tracking database (Wed Dec 04 2002 - 03:33:42 EST)
• Pavel Kankovsky
  • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second (Thu Dec 26 2002 - 10:50:51 EST)
• Peter Kruse
  • Re: Virus? Trojan? (Mon Dec 30 2002 - 18:42:42 EST)
• Pricher Jeffrey Contr AFCA/GCF
  • FW: Lioten Worm 135-139 and 445 (Tue Dec 17 2002 - 12:43:33 EST)
• Rafael Coninck Teigao
  • [Fwd: XSS on ICQ leading to password compromise] (Mon Dec 02 2002 - 11:29:37 EST)
• Rob Shein
  • RE: What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation (Tue Dec 31 2002 - 10:45:18 EST)
  • RE: RPAT - Realtime Proxy Abuse Triangulation (Mon Dec 30 2002 - 12:45:20 EST)
  • RE: RPAT - Realtime Proxy Abuse Triangulation (Fri Dec 27 2002 - 20:00:16 EST)
  • RE: strange traffic (Tue Dec 24 2002 - 15:07:16 EST)
  • RE: A small quandary (Fri Dec 06 2002 - 10:57:06 EST)
  • RE: New scanner? (Mon Dec 02 2002 - 00:09:42 EST)
• Roger Thompson
  • Re: NIMDA - ceased ? - (Fri Dec 27 2002 - 18:47:47 EST)
• Romulo M. Cholewa
  • Terminal Services / TsInternetUser [RMC-RUFLVP4] (Sat Dec 14 2002 - 17:37:03 EST)
• Ron Gedye
  • Compromised System RH7.3-ICMP-STP-DoS (Fri Dec 20 2002 - 16:38:20 EST)
• Russell Fulton
  • Re: Logs: Many hits with source port of 80 (Sun Dec 15 2002 - 21:13:53 EST)
  • strange attractors or weaknesses in Nimda's prng (Wed Dec 11 2002 - 04:46:34 EST)
  • Re: Incident tracking database (Wed Dec 04 2002 - 21:15:41 EST)
• Ryan Yagatich
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 20:41:58 EST)
• Scott A.McIntyre
  • Worm on 445/tcp? (Tue Dec 17 2002 - 02:56:02 EST)
• Scott Fendley
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 12:24:42 EST)
• securitynotice(at)cronus.cnicinc.com
  • strange traffic (Sun Dec 22 2002 - 23:30:31 EST)
• Skip Carter
  • Re: NIMDA - ceased ? - (Fri Dec 27 2002 - 12:58:02 EST)
• Stephen Friedl
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Tue Dec 24 2002 - 13:33:19 EST)
  • RPAT - Realtime Proxy Abuse Triangulation (Fri Dec 20 2002 - 11:17:15 EST)
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 20:46:55 EST)
  • Iraq Oil worm (Mon Dec 16 2002 - 19:04:57 EST)
  • Re: EBay Fraud Attempt (Sun Dec 08 2002 - 23:15:40 EST)
• Stephen J. Friedl
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 15:34:35 EST)
  • Re: EBay Fraud Attempt (Tue Dec 10 2002 - 12:18:43 EST)
• Steven Hong
  • Re: Incident tracking database (Wed Dec 04 2002 - 09:03:28 EST)
• Study List
  • recent rds vuln (Wed Dec 04 2002 - 10:42:59 EST)
• Syzop
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Mon Dec 30 2002 - 16:12:59 EST)
• tcleary2(at)csc.com.au
  • Re: RPAT - Realtime Proxy Abuse Triangulation (Mon Dec 30 2002 - 20:59:17 EST)
• Tom Arseneault
  • RE: DNS help (Thu Dec 12 2002 - 16:24:40 EST)
• Tom.Gast(at)walgreens.com
  • Re: Worm on 445/tcp? (Tue Dec 17 2002 - 14:52:55 EST)
• Tomo
  • NIMDA - ceased ? - (Wed Dec 25 2002 - 12:00:00 EST)
• Valdis.Kletnieks(at)vt.edu
  • Re: Logs: Many hits with source port of 80 (Mon Dec 16 2002 - 11:01:45 EST)
  • Re: DNS help (Thu Dec 12 2002 - 12:17:35 EST)
  • Re: DNS help (Thu Dec 12 2002 - 15:05:03 EST)
  • Re: Odd entries in my Security Router logs (Thu Dec 12 2002 - 13:01:33 EST)
  • Re: Odd entries in my Security Router logs (Thu Dec 12 2002 - 12:09:38 EST)
  • Re: netbios vuln (Mon Dec 09 2002 - 01:58:48 EST)
• Volker Tanger
  • Re: Spam via proxy (Mon Dec 09 2002 - 05:10:46 EST)
• Waitman C. Gobble, II
  • Re: EBay Fraud Attempt (Mon Dec 09 2002 - 01:34:21 EST)
• Zen
  • Re: New CIFS (port 445) worm? (Tue Dec 17 2002 - 13:03:38 EST)
• zeno
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 16:27:10 EST)
  • Re: Rooted, .haos on system (Mon Dec 16 2002 - 15:54:02 EST)
• Þórhallur Hálfdánarson
  • Re: IRC -> smtp worm? (Wed Dec 18 2002 - 11:45:51 EST)

  This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:18 EDT