Security Incidents mailing list archives
Re: Socks port 1080
From: r.fulton () AUCKLAND AC NZ (Russell Fulton)
Date: Fri, 21 Jan 2000 12:29:21 +1300
On Thu, 20 Jan 2000 09:41:36 -0800 Heman Leopando <hleopando () QUICKNET NET> wrote:
Any reason why someone would connect to port 1080? Are they using it as a bounce server for IRC?
Hackers use badly configured socks servers to launder connections. The Wingate program for windows is notorious for this. Older version were wide open by default, they also had a builtin telnet proxy which was wide open. OH yes, and no logging. The problem of socks abuse has got so bad in the IRC community that Undernet now probe all machines that attach and warn people if they are running open socks servers. So if you are seeing probes on 1080 then, if they come from machines in the undernet.org domain then they are benign (There is a web page that describes what they are doing on their site), otherwise it will probably be some looking for a way to hide the identity behind a proxy. Cheers, Russell.
Current thread:
- Re: Large quantity of traffic from amazon.com - source_port 3000 Chris (Jan 15)
- Re: Large quantity of traffic from amazon.com - source_port 3000 Joseph Geyer (Jan 17)
- <Possible follow-ups>
- Re: Large quantity of traffic from amazon.com - source_port 3000 Dominique Brezinski (Jan 15)
- Re: Large quantity of traffic from amazon.com - source_port 3000 Andrew Steingruebl (Jan 18)
- Re: Large quantity of traffic from amazon.com - source_port 3000 Dominique Brezinski (Jan 18)
- Re: Large quantity of traffic from amazon.com - source_port 3000 Robert Graham (Jan 19)
- Socks port 1080 Heman Leopando (Jan 20)
- Re: Socks port 1080 Russell Fulton (Jan 20)
- I was scaned C. (Jan 20)
- Re: I was scaned Robert Graham (Jan 22)
- Re: I was scaned Jose Nazario (Jan 23)
- Re: I was scaned Gene Harris (Jan 23)
- Re: I was scaned Keith Owens (Jan 24)
- Got scaned again C. (Jan 24)
- ? C. (Jan 24)
- Re: ? Mike Tancsa (Jan 24)
- Re: ? Brock Sides (Jan 24)
- Re: unapproved AXFR Russell Fulton (Jan 24)
- Re: Large quantity of traffic from amazon.com - source_port 3000 Andrew Steingruebl (Jan 18)