BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000
| SunOS telnet worm on the loose
Posted to ATU as well. Sorry to folks who read both forums.
quote:
We have received several reports of what appears to be a telnet negotiation
exploit with autorooter or worm like qualities.
Further reports shows many of the hosts being reported for telnet scans
are also being reported for a rlogin bruteforce on port 513
It was reported that the probes for port 23 began on 03/20/2005
Looking at isc.sans.org shows 23 has been fairly active but the
number of targets had a large increase on 03/23/2005.
»isc.sans.org/diary.php?date=2005-03-26
I've already seen machines hit by this.
Heads-up, if you aren't already cracked =(
--
echo 16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D4D465452snlb xq |dc |
|
Steve
I'm a PC, so shut up
Consultant
join:2001-03-10
Yorba Linda, CA | There are still people who use telnet exposed to the internet?
Really? |
|
BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000
| Sure,
SSH isn't cheap CPU-wise. There are folks who use GSSAPI and SSL telnet. Not to mention, worms aren't just a problem on internet facing hosts. A VPN connection isn't always a good thing.
--
echo 16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D4D465452snlb xq |dc |
|
Link Logger
Premium,MVM
join:2001-03-29
Calgary, AB
 ·Shaw
| reply to BeesTea
Since Jan 1, 2005 I have seen 1 port 513 scan and 1 port 23 scan here so this puppy hasn't gotten around to whacking our neck of the internet yet.
Jan 25, 2005 20:05:34.267 - (TCP) 202.97.132.26 : 2665 >>> 68.144.238.148 : 23
Mar 17, 2005 06:30:06.112 - (TCP) 194.154.200.214 : 61427 >>> 68.144.128.128 : 513
Blake
--
Vendor: Firewall Logging Software »www.SonicLogger.com - SonicWall and 3Com »www.LinkLogger.com - Linksys, Netgear and Zyxel |
|
