RE: Increased TCP 139 Activity

[Ron DuFresne <dufresne () winternet com>]

it's highly likely, if this is being observed carefully, all probes to 139
or  445 are proeceeded by a ping sweep of all addresses onthe network.  If
this is indeed the case, the ping sweep will all be packets of 92  byte,
these are windows packets, and the recent rcpdcom sploits are the culprit.

old news, yer lucky in only now seeing it's affects.

Now, if there is a variation on this theme, then perhaps there';s
something new afoot, but, others will prolly catch that prior.

Thanks,

Ron DuFresne

On Wed, 8 Oct 2003, Brown, Rodrick wrote:

> You must not be on a cable network I must get around a 100 probes a day
> when I'm home on port 139
>
> -----Original Message-----
> From: full-disclosure-admin () lists netsys com
> [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Phathat
> Sent: Wednesday, October 08, 2003 10:40 AM
> To: Full-Disclosure () lists netsys com
> Subject: [Full-disclosure] Increased TCP 139 Activity
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Check your logs. For the past three hours we've seen a significant
> increase
> in scanning for TCP port 139 beginning from S. Korea.
> -----BEGIN PGP SIGNATURE-----
> Note: This signature can be verified at https://www.hushtools.com/verify
> Version: Hush 2.3
>
> wkYEARECAAYFAj+EIbYACgkQnBN72pVYTdhSKQCfSSmkDcNJYSsu8rZs1oM8YdK2o44A
> oK8GnMJjMxZ4zl3/WcvXgb2M78ci
> =ik7h
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html