Educause Security Discussion mailing list archives

Re: StnyFtpd

From: Justin Azoff <JAzoff () UAMAIL ALBANY EDU>
Date: Thu, 17 Feb 2005 11:49:55 -0500

On Tue, 2005-02-15 at 08:33 -0600, Cam Beasley, ISO wrote:

FYI -- not sure if anyone else has noticed, but the
StnyFtpd daemon (usually linked to various IRCbots)
has a new and improved banner that you might want
to be looking for:

TCP=1024:
 '220 11111111 1111 j0'

Your IRCbot sigs should normally trigger before a rule
for this banner triggers, but..

~cam.


It's not really new... I picked up a host with this on 2005-01-14

--
-- Justin Azoff
-- Network Performance Analyst

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.

Current thread:

StnyFtpd Cam Beasley, ISO (Feb 15)
- <Possible follow-ups>
- Re: StnyFtpd Justin Azoff (Feb 17)