Mailing List Archive For incidents@securityfocus.com Dec 2002 By Thread

• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Chris (Fri Dec 20 2002 - 15:53:16 EST)
• What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation Gary Flynn (Tue Dec 31 2002 - 08:20:58 EST)
• MS IIS 5 server is hacked leaving undeletable folders and files Don Phillipe (Tue Dec 31 2002 - 12:05:27 EST)
• Re: Virus? Trojan? Nick FitzGerald (Mon Dec 30 2002 - 21:00:15 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation tcleary2(at)csc.com.au (Mon Dec 30 2002 - 20:59:17 EST)
• RE: What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation Rob Shein (Tue Dec 31 2002 - 10:45:18 EST)
• PDL anti-spam blacklist John Paul (Tue Dec 31 2002 - 14:08:02 EST)
• Abnormally high Sub-Seven attack rate increase Eric Kimminau (Tue Dec 31 2002 - 00:09:40 EST)
• Re: Virus? Trojan? Jonathan Rickman (Mon Dec 30 2002 - 20:15:42 EST)
• Re: Virus? Trojan? Peter Kruse (Mon Dec 30 2002 - 18:42:42 EST)
• Virus? Trojan? David Gillett (Mon Dec 30 2002 - 17:03:18 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Syzop (Mon Dec 30 2002 - 16:12:59 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Greg Barnes (Mon Dec 30 2002 - 15:05:54 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Greg Barnes (Mon Dec 30 2002 - 14:25:07 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Greg Barnes (Mon Dec 30 2002 - 14:06:35 EST)
• RE: RPAT - Realtime Proxy Abuse Triangulation Rob Shein (Mon Dec 30 2002 - 12:45:20 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Gary Flynn (Sat Dec 28 2002 - 09:46:55 EST)
• RE: RPAT - Realtime Proxy Abuse Triangulation Rob Shein (Fri Dec 27 2002 - 20:00:16 EST)
• Re: NIMDA - ceased ? - Roger Thompson (Fri Dec 27 2002 - 18:47:47 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Kevin Reardon (Fri Dec 27 2002 - 13:55:29 EST)
• RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second H C (Fri Dec 27 2002 - 14:35:16 EST)
• Re: NIMDA - ceased ? - James C. Slora Jr. (Fri Dec 27 2002 - 13:36:51 EST)
• Re: NIMDA - ceased ? - Skip Carter (Fri Dec 27 2002 - 12:58:02 EST)
• Re: NIMDA - ceased ? - Johannes Ullrich (Fri Dec 27 2002 - 12:12:12 EST)
• Re: NIMDA - ceased ? - Neil Dickey (Fri Dec 27 2002 - 12:25:35 EST)
• RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Hornat, Charles (Fri Dec 27 2002 - 11:57:50 EST)
• RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Charles.Fasching(at)milestonesystems.com (Thu Dec 26 2002 - 17:47:37 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Stephen Friedl (Tue Dec 24 2002 - 13:33:19 EST)
• RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 03:36:29 EST)
• Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 03:27:47 EST)
• RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 03:44:19 EST)
• NIMDA - ceased ? - Tomo (Wed Dec 25 2002 - 12:00:00 EST)
• RE: strange traffic Rob Shein (Tue Dec 24 2002 - 15:07:16 EST)
• Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 03:52:26 EST)
• Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Fyodor (Tue Dec 24 2002 - 14:18:16 EST)
• Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Pavel Kankovsky (Thu Dec 26 2002 - 10:50:51 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Mathias Wegner (Tue Dec 24 2002 - 12:21:31 EST)
• Re: RPAT - Realtime Proxy Abuse Triangulation Kurt Seifried (Tue Dec 24 2002 - 12:58:05 EST)
• Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Tue Dec 24 2002 - 00:33:59 EST)
• strange traffic securitynotice(at)cronus.cnicinc.com (Sun Dec 22 2002 - 23:30:31 EST)
• Re: hpd, afb, sc, and sn deadcalm(at)treshna.com (Sun Dec 22 2002 - 22:49:33 EST)
• RE: hpd, afb, sc, and sn Bojan Zdrnja (Sat Dec 21 2002 - 10:16:27 EST)
• TsInternetUser priv. escalation; blank passwords; service passwords Curt Wilson (Mon Dec 23 2002 - 03:05:32 EST)
• Re: hpd, afb, sc, and sn Brad Arlt (Fri Dec 20 2002 - 17:28:48 EST)
• Re: hpd, afb, sc, and sn Greg Barnes (Fri Dec 20 2002 - 17:19:04 EST)
• Re: hpd, afb, sc, and sn gminick (Sat Dec 21 2002 - 05:53:33 EST)
• Compromised System RH7.3-ICMP-STP-DoS Ron Gedye (Fri Dec 20 2002 - 16:38:20 EST)
• port 3717/udp? Jacek Lipkowski (Fri Dec 20 2002 - 13:23:08 EST)
• hpd, afb, sc, and sn Gordon Chamberlin (Fri Dec 20 2002 - 16:11:31 EST)
• RPAT - Realtime Proxy Abuse Triangulation Stephen Friedl (Fri Dec 20 2002 - 11:17:15 EST)
• Re: Worm on 445/tcp? Kyle Lai (Thu Dec 19 2002 - 16:06:28 EST)
• Re: IRC -> smtp worm? Eric Chien (Wed Dec 18 2002 - 13:53:31 EST)
• Re: IRC -> smtp worm? H C (Wed Dec 18 2002 - 11:00:37 EST)
• Re: IRC -> smtp worm? Þórhallur Hálfdánarson (Wed Dec 18 2002 - 11:45:51 EST)
• abuse of open transparent proxies horape(at)tinuviel.compendium.net.ar (Tue Dec 17 2002 - 21:58:29 EST)
• Re: Worm on 445/tcp? Stephen Friedl (Tue Dec 17 2002 - 20:46:55 EST)
• Re: Worm on 445/tcp? Ryan Yagatich (Tue Dec 17 2002 - 20:41:58 EST)
• IRC -> smtp worm? Joao Gouveia (Tue Dec 17 2002 - 21:37:08 EST)
• Re: Worm on 445/tcp? james (Tue Dec 17 2002 - 15:54:45 EST)
• Re: Worm on 445/tcp? Stephen J. Friedl (Tue Dec 17 2002 - 15:34:35 EST)
• Re: Worm on 445/tcp? Joe Blatz (Tue Dec 17 2002 - 14:50:10 EST)
• Re: Worm on 445/tcp? Tom.Gast(at)walgreens.com (Tue Dec 17 2002 - 14:52:55 EST)
• Re: fswserv.html ???? james (Tue Dec 17 2002 - 14:17:31 EST)
• Re: fswserv.html ???? Adam Bultman (Tue Dec 17 2002 - 13:25:05 EST)
• Re: Worm on 445/tcp? Scott Fendley (Tue Dec 17 2002 - 12:24:42 EST)
• Re: fswserv.html ???? james (Tue Dec 17 2002 - 12:36:38 EST)
• Re: New CIFS (port 445) worm? Zen (Tue Dec 17 2002 - 13:03:38 EST)
• RE: Worm on 445/tcp? OBrien, Brennan (Tue Dec 17 2002 - 12:31:42 EST)
• Re: fswserv.html ???? dev (Mon Dec 16 2002 - 18:40:32 EST)
• FW: Lioten Worm 135-139 and 445 Pricher Jeffrey Contr AFCA/GCF (Tue Dec 17 2002 - 12:43:33 EST)
• Re[2]: Rooted, .haos on system Oliver.C.Rochford CFH (Tue Dec 17 2002 - 03:36:28 EST)
• New CIFS (port 445) worm? David Gillett (Tue Dec 17 2002 - 11:30:13 EST)
• Re: Rooted, .haos on system Julian Young (Tue Dec 17 2002 - 03:14:00 EST)
• Worm on 445/tcp? Scott A.McIntyre (Tue Dec 17 2002 - 02:56:02 EST)
• Iraq Oil worm Stephen Friedl (Mon Dec 16 2002 - 19:04:57 EST)
• fswserv.html ???? James-lists (Mon Dec 16 2002 - 17:49:03 EST)
• Re: Win2k Audit Logs - What happened here? H C (Mon Dec 16 2002 - 16:41:32 EST)
• Re: Rooted, .haos on system Damian Gerow (Mon Dec 16 2002 - 16:36:46 EST)
• Re: Rooted, .haos on system zeno (Mon Dec 16 2002 - 16:27:10 EST)
• Re: Rooted, .haos on system Carlos Eduardo Pedroza Santiviago (Mon Dec 16 2002 - 15:31:03 EST)
• Re: Rooted, .haos on system zeno (Mon Dec 16 2002 - 15:54:02 EST)
• Re: Rooted, .haos on system Mike Katz (Mon Dec 16 2002 - 14:31:23 EST)
• Re: Rooted, .haos on system Mattias Hedenskog (Mon Dec 16 2002 - 15:51:17 EST)
• RE: Logs: Many hits with source port of 80 James C Slora Jr (Mon Dec 16 2002 - 15:29:52 EST)
• RE: Win2k Audit Logs - What happened here? george.wasgatt(at)insurity.com (Mon Dec 16 2002 - 14:19:17 EST)
• Re: Rooted, .haos on system Damian Gerow (Mon Dec 16 2002 - 13:47:28 EST)
• Re: Logs: Many hits with source port of 80 Kevin Bowman (Mon Dec 16 2002 - 13:54:03 EST)
• Re: Rooted, .haos on system Damian Gerow (Mon Dec 16 2002 - 12:38:33 EST)
• Re: DNS help Matt Zimmerman (Sun Dec 15 2002 - 17:47:52 EST)
• Re: Logs: Many hits with source port of 80 Joe Stewart (Mon Dec 16 2002 - 10:27:32 EST)
• Re: Logs: Many hits with source port of 80 Byrne Ghavalas (Mon Dec 16 2002 - 09:21:14 EST)
• Re: Logs: Many hits with source port of 80 Russell Fulton (Sun Dec 15 2002 - 21:13:53 EST)
• RE: Logs: Many hits with source port of 80 James C Slora Jr (Mon Dec 16 2002 - 08:37:20 EST)
• Re: Many hits with source port of 80 Maxime Ducharme (Mon Dec 16 2002 - 12:01:57 EST)
• Win2k Audit Logs - What happened here? Johnny Walker (Sun Dec 15 2002 - 21:50:57 EST)
• Re: Logs: Many hits with source port of 80 Valdis.Kletnieks(at)vt.edu (Mon Dec 16 2002 - 11:01:45 EST)
• Logs: Many hits with source port of 80 Byrne Ghavalas (Fri Dec 13 2002 - 05:05:56 EST)
• Terminal Services / TsInternetUser [RMC-RUFLVP4] Romulo M. Cholewa (Sat Dec 14 2002 - 17:37:03 EST)
• Rooted, .haos on system Damian Gerow (Thu Dec 12 2002 - 18:50:22 EST)
• Re: DNS help Valdis.Kletnieks(at)vt.edu (Thu Dec 12 2002 - 12:17:35 EST)
• RE: DNS help Faron.Golden(at)Gunter.AF.mil (Thu Dec 12 2002 - 16:58:41 EST)
• RE: DNS help Tom Arseneault (Thu Dec 12 2002 - 16:24:40 EST)
• Re: DNS help Valdis.Kletnieks(at)vt.edu (Thu Dec 12 2002 - 15:05:03 EST)
• RE: DNS help larosa, vjay (Thu Dec 12 2002 - 14:54:29 EST)
• Re: Odd entries in my Security Router logs Valdis.Kletnieks(at)vt.edu (Thu Dec 12 2002 - 13:01:33 EST)
• Re: Odd entries in my Security Router logs HggdH (Wed Dec 11 2002 - 17:11:55 EST)
• Re: Odd entries in my Security Router logs Valdis.Kletnieks(at)vt.edu (Thu Dec 12 2002 - 12:09:38 EST)
• DNS help larosa, vjay (Wed Dec 11 2002 - 16:09:49 EST)
• RE: Odd entries in my Security Router logs David Gillett (Wed Dec 11 2002 - 15:59:12 EST)
• Re: Odd entries in my Security Router logs James C. Slora Jr. (Wed Dec 11 2002 - 13:44:47 EST)
• Re: EBay Fraud Attempt Mark (Wed Dec 11 2002 - 13:19:47 EST)
• strange attractors or weaknesses in Nimda's prng Russell Fulton (Wed Dec 11 2002 - 04:46:34 EST)
• Re: Odd entries in my Security Router logs Michael Sierchio (Wed Dec 11 2002 - 13:08:49 EST)
• RE: EBay Fraud Attempt Chris Gordon (Wed Dec 11 2002 - 12:46:03 EST)
• RE: Odd entries in my Security Router logs Julian Young (Tue Dec 10 2002 - 06:28:45 EST)
• Re: EBay Fraud Attempt Stephen J. Friedl (Tue Dec 10 2002 - 12:18:43 EST)
• RE: Odd entries in my Security Router logs Julian Young (Wed Dec 11 2002 - 03:53:54 EST)
• Re: EBay Fraud Attempt Dave Laird (Tue Dec 10 2002 - 02:58:05 EST)
• RE: EBay Fraud Attempt OBrien, Brennan (Tue Dec 10 2002 - 10:43:13 EST)
• RE: Odd entries in my Security Router logs Andrews, Jonathan (US - Hermitage) (Tue Dec 10 2002 - 12:17:54 EST)
• RE: Odd entries in my Security Router logs Jim Terry (Tue Dec 10 2002 - 05:22:37 EST)
• RE: EBay Fraud Attempt george.wasgatt(at)insurity.com (Tue Dec 10 2002 - 08:40:15 EST)
• Re: EBay Fraud Attempt Kee Hinckley (Tue Dec 10 2002 - 01:17:28 EST)
• RE: EBay Fraud Attempt Carlo Costanzo (Tue Dec 10 2002 - 01:13:33 EST)
• Re: EBay Fraud Attempt Chris A. Mattingly (Tue Dec 10 2002 - 01:01:52 EST)
• Re: Spam via proxy Joe Stewart (Mon Dec 09 2002 - 08:31:59 EST)
• Re: EBay Fraud Attempt Waitman C. Gobble, II (Mon Dec 09 2002 - 01:34:21 EST)
• Re: netbios vuln Nick FitzGerald (Mon Dec 09 2002 - 04:36:51 EST)
• Re: EBay Fraud Attempt jlewis(at)lewis.org (Sun Dec 08 2002 - 23:45:22 EST)
• RE: A small quandary Bojan Zdrnja (Mon Dec 09 2002 - 06:02:48 EST)
• Re: Spam via proxy jlewis(at)lewis.org (Sun Dec 08 2002 - 23:22:25 EST)
• Re: Spam via proxy Volker Tanger (Mon Dec 09 2002 - 05:10:46 EST)
• what else you can do with worm networks...fun, profit, etc Anton A. Chuvakin (Mon Dec 09 2002 - 13:27:24 EST)
• Re: netbios vuln Valdis.Kletnieks(at)vt.edu (Mon Dec 09 2002 - 01:58:48 EST)
• Fwd: EBay Fraud Attempt Dave Laird (Mon Dec 09 2002 - 03:30:17 EST)
• Re: netbios vuln H C (Mon Dec 09 2002 - 09:12:47 EST)
• Re: netbios vuln KoRe MeLtDoWn (Sun Dec 08 2002 - 23:25:03 EST)
• Re: Spam via proxy Jefferson Ogata (Mon Dec 09 2002 - 11:04:34 EST)
• Odd entries in my Security Router logs Julian Young (Mon Dec 09 2002 - 04:37:47 EST)
• Re: EBay Fraud Attempt Stephen Friedl (Sun Dec 08 2002 - 23:15:40 EST)
• Re: Spam via proxy Christopher X. Candreva (Sun Dec 08 2002 - 22:50:04 EST)
• EBay Fraud Attempt Logan F.D. Greenlee (Sat Dec 07 2002 - 10:25:29 EST)
• Re: A small quandary gminick (Sat Dec 07 2002 - 13:27:40 EST)
• high activity on port 3061 udp/tcp Marcelo Bartsch (Fri Dec 06 2002 - 16:25:49 EST)
• Spam via proxy listuser (Sat Dec 07 2002 - 12:52:37 EST)
• Re: A small quandary Mike Katz (Fri Dec 06 2002 - 13:41:35 EST)
• Does W2k issue an NBNS query automatically following each unsuccessful reverse DNS query? Jack Arenberg (Sat Dec 07 2002 - 11:51:10 EST)
• Re: A small quandary H C (Fri Dec 06 2002 - 08:49:11 EST)
• RE: A small quandary Rob Shein (Fri Dec 06 2002 - 10:57:06 EST)
• RE: A small quandary Jerry Shenk (Fri Dec 06 2002 - 08:35:36 EST)
• netbios vuln ohnonono(at)hushmail.com (Fri Dec 06 2002 - 09:50:02 EST)
• Re: Incident tracking database Chris Adams (Fri Dec 06 2002 - 01:24:25 EST)
• Black Ice small segment size FTP attack caused by FX-scanner Curt Wilson (Thu Dec 05 2002 - 18:02:15 EST)
• A small quandary Mahoney, Paul (Wed Dec 04 2002 - 23:30:08 EST)
• Re: Incident tracking database Russell Fulton (Wed Dec 04 2002 - 21:15:41 EST)
• Re: Incident tracking database Holger Kipp (Wed Dec 04 2002 - 03:13:37 EST)
• Re: Incident tracking database james (Wed Dec 04 2002 - 02:55:15 EST)
• Re: Incident tracking database Steven Hong (Wed Dec 04 2002 - 09:03:28 EST)
• recent rds vuln Study List (Wed Dec 04 2002 - 10:42:59 EST)
• Re: Incident tracking database Paul Gillingwater (Wed Dec 04 2002 - 03:33:42 EST)
• Re: Incident tracking database Chip Mefford (Wed Dec 04 2002 - 07:41:34 EST)
• Incident tracking database Danny (Tue Dec 03 2002 - 11:05:51 EST)
• Re: TCP:80, TCP:1433 squelda 1.0 probe John Sage (Mon Dec 02 2002 - 19:29:30 EST)
• [Fwd: XSS on ICQ leading to password compromise] Rafael Coninck Teigao (Mon Dec 02 2002 - 11:29:37 EST)
• Re: TCP:80, TCP:1433 squelda 1.0 probe Joe Stewart (Mon Dec 02 2002 - 08:53:24 EST)
• RE: New scanner? Rob Shein (Mon Dec 02 2002 - 00:09:42 EST)
• Re: Bad protocol version identification '^V^C^A' Matt Harris (Mon Dec 02 2002 - 09:51:34 EST)
• Re: Bad protocol version identification '^V^C^A' D.C. van Moolenbroek (Sun Dec 01 2002 - 15:03:25 EST)
• RE: Bad protocol version identification '^V^C^A' Bojan Zdrnja (Sun Dec 01 2002 - 04:15:49 EST)