Security Incidents: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

281 messages starting Dec 31 00 and ending Jan 31 01
Date index | Thread index | Author index

• Re: scans on ports 3072 and 1024, why? Simple Nomad (Dec 31)
• FW: Win2k hack attempt Blake R. Swopes (Dec 31)
  • <Possible follow-ups>
  • Re: Win2k hack attempt Robert G. Ferrell (Jan 02)
• Strange logs Devdas Bhagat (Jan 01)
  • Re: Strange logs Fabio Pietrosanti (naif) (Jan 02)
  • Re: Strange logs Camillo Särs (Jan 02)
• yes, its t0rn again johnathan curst (Jan 01)
  • Re: yes, its t0rn again Michael Damm (Jan 01)
    • Re: yes, its t0rn again Joe Stewart (Jan 02)
  • Message not available
    • Re: yes, its t0rn again MadHat (Jan 02)
      • Re: yes, its t0rn again Jonas Luster (Jan 02)
  • Re: yes, its t0rn again Andrew Edelstein (Jan 03)
    • Re: yes, its t0rn again Andreas Hasenack (Jan 03)
      • Re: yes, its t0rn again Helmut Springer (Jan 04)
      • Re: yes, its t0rn again Aaron (Jan 06)
      • Re: yes, its t0rn again Helmut Springer (Jan 06)
      • LKM insecurity Greg A. Woods (Jan 06)
  • <Possible follow-ups>
  • Re: yes, its t0rn again Robert Horn (Jan 04)
    • Re: yes, its t0rn again Jeff Bachtel (Jan 04)
      • Attack Signature Reprodution Alexandre Soares (Jan 06)
      • Re: yes, its t0rn again Jeremy 'Circ' Charles (Jan 06)
    • bootable readonly media in your pocket Re: yes, its t0rn again marc (Jan 05)
      • Re: bootable readonly media in your pocket Re: yes, its t0rn again Michael H. Warfield (Jan 05)
      • Re: bootable readonly media in your pocket Re: yes, its t0rn again Jeff (Jan 05)
      • Re: bootable readonly media in your pocket Re: yes, its t0rn again marc (Jan 09)
      • Re: bootable readonly media in your pocket Kevin Martin (Jan 09)
      • Re: bootable readonly media in your pocket Re: yes, its t0rn again Ed Padin (Jan 05)
      • Re: bootable readonly media in your pocket Re: yes, its t0rn again Ryan Russell (Jan 05)
  • Re: yes, its t0rn again Roberto (Jan 08)
    • Re: yes, its t0rn again - chkrootkit Talisker (Jan 08)
• Curious packets to port 48 aedron (Jan 01)
• Administrivia Alfred Huger (Jan 02)
• RH6 boxes cracked D. Scott Barninger (Jan 03)
  • Re: RH6 boxes cracked Osvaldo J. Filho (Jan 03)
  • <Possible follow-ups>
  • Re: RH6 boxes cracked Tansey, Don (Jan 03)
• Out of Office Purge - Ignore Alfred Huger (Jan 03)
• Honeynet Project looking for new ISP Lance Spitzner (Jan 03)
• Re: New trojan running in port 12345? Martin H Hoz-Salvador (Jan 05)
• spoofed ICMP 3/1's - what is the tool or goal here? Glenn Forbes Fleming Larratt (Jan 06)
  • <Possible follow-ups>
  • Re: spoofed ICMP 3/1's - what is the tool or goal here? slim bones (Jan 15)
• Some kind of DoS killing a fastethernet interface Bjorn Djupvik (Jan 08)
  • Re: Some kind of DoS killing a fastethernet interface Valdis Kletnieks (Jan 08)
• Finding out who owns particular IP addresses Russell Fulton (Jan 08)
  • Re: Finding out who owns particular IP addresses maillist (Jan 08)
  • Re: Finding out who owns particular IP addresses Marco d'Itri (Jan 09)
  • Re: Finding out who owns particular IP addresses Devon Null (Jan 19)
  • <Possible follow-ups>
  • Re: Finding out who owns particular IP addresses Hartmann, Seamus (Jan 08)
    • Re: Finding out who owns particular IP addresses Nexus (Jan 08)
    • Re: Finding out who owns particular IP addresses Bob Hillery (Jan 08)
  • Re: Finding out who owns particular IP addresses Robert G. Ferrell (Jan 09)
    • Re: Finding out who owns particular IP addresses Martin H Hoz-Salvador (Jan 09)
  • Re: Finding out who owns particular IP addresses Smith, Lonnie (Jan 11)
    • Re: Finding out who owns particular IP addresses Koaps (Jan 11)
      • Re: Finding out who owns particular IP addresses Bjorn Djupvik (Jan 11)
    • Re: Finding out who owns particular IP addresses Crist Clark (Jan 11)
    • Re: Finding out who owns particular IP addresses Octavian Popescu (Jan 11)
  • Re: Finding out who owns particular IP addresses Grant Parkinson (Jan 11)
  • Re: Finding out who owns particular IP addresses Octavian Popescu (Jan 11)
• UDP 28431 Scans Crist Clark (Jan 08)
  • Re: UDP 28431 Scans Matt Fearnow (Jan 08)
• Strange scan behavior Daniel Martin (Jan 08)
• Re: DNS requests from 209.67.50.203 (fwd) Joe Shaw (Jan 09)
  • <Possible follow-ups>
  • Re: DNS requests from 209.67.50.203 (fwd) wait3r (Jan 10)
  • Re: DNS requests from 209.67.50.203 (fwd) Joe Matusiewicz (Jan 10)
• statd-exploit attack against RH 7.0 Johan.Augustsson (Jan 10)
  • Message not available
    • Re: statd-exploit attack against RH 7.0 Johan.Augustsson (Jan 11)
• Can anyone guess at this "scan"?? Los, Ralph (Jan 10)
  • Re: Can anyone guess at this "scan"?? Anders Thulin (Jan 11)
  • Re: Can anyone guess at this "scan"?? Guido Bolognesi (Jan 11)
  • <Possible follow-ups>
  • Re: Can anyone guess at this "scan"?? Howard, Aaron (Jan 11)
  • Re: Can anyone guess at this "scan"?? Los, Ralph (Jan 11)
  • Re: Can anyone guess at this "scan"?? Duquette, John (Jan 11)
  • Re: Can anyone guess at this "scan"?? Sarah Cleveland (Jan 11)
• Scans of 21536 Fulton L. Preston Jr. (Jan 11)
  • <Possible follow-ups>
  • Re: Scans of 21536 Benninghoff, John (Jan 11)
    • CVX? Re: Scans of 21536 marc (Jan 11)
• Re: anyone else seen an increase in sunrpc scans these days? Ray Simard (Jan 15)
  • <Possible follow-ups>
  • Re: anyone else seen an increase in sunrpc scans these days? Steve Buttgereit (Jan 15)
    • Re: anyone else seen an increase in sunrpc scans these days? Derek Kwan (Jan 15)
    • Re: anyone else seen an increase in sunrpc scans these days? Brian Taylor (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Matthew Hallacy (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Devdas Bhagat (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Cristian Dumitrescu (Jan 15)
    • sunrpc / wu-ftpd worm ? Mihai Moldovanu (Jan 15)
    • Re: anyone else seen an increase in sunrpc scans these days? Digital Overdrive (Jan 16)
      • Re: anyone else seen an increase in sunrpc scans these days? Cristian Dumitrescu (Jan 16)
      • Re: anyone else seen an increase in sunrpc scans these days? Nathan W. Lindstrom (Jan 16)
      • Re: anyone else seen an increase in sunrpc scans these days? Ignacio Machin (Jan 18)
      • Re: anyone else seen an increase in sunrpc scans these days? razor (Jan 18)
      • Re: anyone else seen an increase in sunrpc scans these days? Ignacio Machin (Jan 22)
  • Re: anyone else seen an increase in sunrpc scans these days? Mihai Moldovanu (Jan 15)
    • FTP and RPC based worms [was anyone else ...] Russell Fulton (Jan 15)
      • Re: FTP and RPC based worms [was anyone else ...] Royans K Tharakan (Jan 15)
      • Re: FTP and RPC based worms [was anyone else ...] slim bones (Jan 16)
      • Ramen worm . More details on it. ( found a password and e-mails crypted inside it) Mihai Moldovanu (Jan 16)
      • Re: Ramen worm . More details on it. ( found a password and e-mails crypted inside it) Jeffrey F. Lawhorn (Jan 16)
      • Re: Ramen worm . More details on it. ( found a password and e-mails crypted inside it) Daniel Martin (Jan 16)
      • Re: FTP and RPC based worms [was anyone else ...] Steve Clement (Jan 16)
  • Re: anyone else seen an increase in sunrpc scans these days? thomas lakofski (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Niels Heinen (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Edward Mitchell (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Timothy Lyons (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Alfred Huger (Jan 15)
    • Rise in rpc scans - Honeynet Project Lance Spitzner (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? Ed Woodson (Jan 15)
  • Re: anyone else seen an increase in sunrpc scans these days? James Bryan (Jan 15)
• Re: properties in e-mail from sexyfun Michael Damm (Jan 15)
  • <Possible follow-ups>
  • Re: properties in e-mail from sexyfun Guillaume Filion (Jan 15)
• The Honeynet Project's "Forensic Challenge" challenge (Jan 15)
• Re: new NT worm Ray Simard (Jan 15)
• Rooted Boxes Christian W. Zuckschwerdt (Jan 15)
  • <Possible follow-ups>
  • Re: Rooted Boxes Christian W. Zuckschwerdt (Jan 16)
    • Re: Rooted Boxes gabriel rosenkoetter (Jan 16)
    • Re: Rooted Boxes dor (Jan 17)
• Re: FTP and RPC based worms [was anyone else ...] Roberto (Jan 15)
  • <Possible follow-ups>
  • Re: FTP and RPC based worms [was anyone else ...] Magnus Ullberg (Jan 16)
    • Re: FTP and RPC based worms [was anyone else ...] Sean Brown (Jan 17)
  • Re: FTP and RPC based worms [was anyone else ...] delouw (Jan 24)
    • Re: FTP and RPC based worms [was anyone else ...] dor (Jan 25)
    • Re: FTP and RPC based worms [was anyone else ...] Jeremy L. Gaddis (Jan 25)
• mal-formed IP paquet and CVX Nortel Philippe PATUREL (Jan 16)
• A few more hosts scanning for sunrpc... Ben Ostrowsky (Jan 16)
• Strange ICMP timestamp replies Florian Weimer (Jan 16)
  • Re: Strange ICMP timestamp replies Jose Nazario (Jan 16)
  • Message not available
    • Re: Strange ICMP timestamp replies Florian Weimer (Jan 16)
• Re: sunrpc / wu-ftpd worm ? daniel_gerald (Jan 16)
• Two more UDP DNS DDoS victims seemingly detected Glenn Forbes Fleming Larratt (Jan 16)
• Master RPC program number data base (/etc/rpc) Eilon Gishri (Jan 16)
• Alpha/Beta Testers Needed Alfred Huger (Jan 16)
• WZAP Exploit Rick King (Jan 16)
  • Re: WZAP Exploit Pheh (Jan 16)
• Re: Ramen worm . More details on it. ( found a password and e-mai ls crypted inside it) Tharakan, Royans (Jan 16)
• Re: CVX? Re: Scans of 21536 Mike Blomgren (Jan 17)
• Re: [Fwd: Re: Ramen worm . More details on it. ( found a password ande-mails crypted inside it)] Bernhard Rosenkraenzer (Jan 17)
  • Re: [Fwd: Re: Ramen worm . More details on it. ( found a password ande-mails crypted inside it)] slim bones (Jan 17)
  • Re: [Fwd: Re: Ramen worm . More details on it. ( found a password ande-mails crypted inside it)] Jeffrey F. Lawhorn (Jan 17)
  • Re: [Fwd: Re: Ramen worm . More details on it. ( found a password ande-mails crypted inside it)] Russell Fulton (Jan 17)
• Large increase in unexplainable pings Bill Hutchison (Jan 17)
• more info on ramen.tgz Jeffrey F. Lawhorn (Jan 17)
  • Re: more info on ramen.tgz Joe Stewart (Jan 17)
  • Re: more info on ramen.tgz outcast (Jan 17)
    • Re: more info on ramen.tgz Nathan W. Lindstrom (Jan 17)
  • Re: more info on ramen.tgz Daniel Martin (Jan 17)
  • Re: more info on ramen.tgz dor (Jan 17)
  • Re: more info on ramen.tgz Russell Fulton (Jan 17)
  • <Possible follow-ups>
  • Re: more info on ramen.tgz Russell Fulton (Jan 17)
• ICMP timestamp replies Alan Gallagher, MCSE, CCNA (Jan 17)
• Ramen worm scanner and multicast addresses Bill Owens (Jan 17)
  • Re: Ramen worm scanner and multicast addresses slim bones (Jan 17)
    • Re: Ramen worm scanner and multicast addresses Daniel Martin (Jan 17)
    • Re: Ramen worm scanner and multicast addresses Bill Owens (Jan 17)
• FW: hack indications (fwd) Steve Mancini (Jan 17)
• ramen.tgz Derrick S. Jamison (Jan 18)
  • Re: ramen.tgz Helmut Springer (Jan 18)
• Ramen Worm removal instructions Mihai Moldovanu (Jan 18)
• Unusual scans seen TJ Jablonowski (Jan 18)
• [no subject] Opus (Jan 18)
• Ramen detect script Patrick Oonk (Jan 18)
  • Re: Ramen detect script Michael H. Warfield (Jan 18)
• Correlated Scans to Ports 27374 and 1243 (SubSeven) Stephen P. Berry (Jan 18)
  • Re: Correlated Scans to Ports 27374 and 1243 (SubSeven) Daniel Martin (Jan 18)
    • Re: Correlated Scans to Ports 27374 and 1243 (SubSeven) Ryan Sweat (Jan 19)
• Web Deployed Virus Opus (Jan 18)
• Re: encrypted html based virus Dzzie Z (Jan 18)
• help Peter Masloch (Jan 19)
• any idea of the kiddie-script tool crafting these SYN-FIN packets to user selectable destination ports r4gn4r0k (Jan 19)
  • Re: any idea of the kiddie-script tool crafting these SYN-FIN packets to user selectable destination ports Joe Stewart (Jan 19)
  • Re: any idea of the kiddie-script tool crafting these SYN-FIN packetsto user selectable destination ports Jan Muenther (Jan 19)
• Headerless EMail Attonbitus Deus (Jan 21)
  • Re: Headerless EMail Mark Ackermans (Jan 22)
  • <Possible follow-ups>
  • Re: Headerless EMail Forrester, Mike (Jan 22)
• Re: any idea of the kiddie-script tool crafting these SYN-FIN pac kets to user selectable destination ports Jackson, John (Jan 21)
• Re: any idea of the kiddie-script tool crafting these SYN-FIN packets to user selectable destination ports Daniel Martin (Jan 21)
• thank you all Peter (Jan 22)
• Banner riding Mike Bush (Jan 22)
  • Re: Banner riding Tribunal (Jan 23)
• Ramen Matthew Roley (Jan 22)
  • Re: Ramen Brian Taylor (Jan 22)
    • Re: Ramen Dave Dittrich (Jan 23)
      • Re: Ramen Neil Long (Jan 23)
      • Re: Ramen Russell Fulton (Jan 23)
      • Re: Ramen Lance Spitzner (Jan 23)
      • Re: Ramen Ryan W. Maple (Jan 24)
• Ramenfind Ramen detection and removal tool, v0.2 William Stearns (Jan 23)
• intensive scan docteurt () voila fr (Jan 23)
• Distributed scan (src port 23) of our whole class C network Ralf G. R. Bergs (Jan 23)
  • Re: Distributed scan (src port 23) of our whole class C network Glenn Forbes Fleming Larratt (Jan 23)
    • Re: Distributed scan (src port 23) of our whole class C network Abel Wisman (Jan 24)
  • Re: Distributed scan (src port 23) of our whole class C network Tom Fischer (Jan 24)
    • Re: Distributed scan (src port 23) of our whole class C network Ralf G. R. Bergs (Jan 24)
  • Re: Distributed scan (src port 23) of our whole class C network Liudvikas Bukys (Jan 24)
• [ISN] Ramen Linux worm mutating, multiplying (fwd) Dave Dittrich (Jan 23)
• Seeking copy of Ramen worm. Jay D. Dyson (Jan 23)
  • Re: Seeking copy of Ramen worm. Tribunal (Jan 24)
  • AW: Seeking copy of Ramen worm. Tobias Klein (Jan 24)
• Distributed scan portmap of our whole class C network Andre Yu.Zaitsev (Jan 23)
• ICMP_TIME_EXCEEDED to network address? Ralf G. R. Bergs (Jan 24)
  • Re: ICMP_TIME_EXCEEDED to network address? Ulrich Eckhardt (Jan 24)
    • Re: ICMP_TIME_EXCEEDED to network address? Ralf G. R. Bergs (Jan 24)
      • Re: ICMP_TIME_EXCEEDED to network address? Juergen P. Meier (Jan 25)
  • Re: ICMP_TIME_EXCEEDED to network address? E, M (Jan 24)
  • <Possible follow-ups>
  • Re: ICMP_TIME_EXCEEDED to network address? Curt Freeland (Jan 25)
    • Re: ICMP_TIME_EXCEEDED to network address? Ralf G. R. Bergs (Jan 25)
  • Re: ICMP_TIME_EXCEEDED to network address? Bill Royds (Jan 25)
• Template Admin Notification Alfred Huger (Jan 24)
  • Re: Template Admin Notification) David Kennedy CISSP (Jan 24)
  • Re: Template Admin Notification Martin Hoz Salvador -CITI Soporte (Jan 24)
    • Re: Template Admin Notification Terje Bless (Jan 25)
      • Re: Template Admin Notification Jose Nazario (Jan 25)
    • Re: Template Admin Notification David Kennedy CISSP (Jan 25)
      • Re: Template Admin Notification Valdis Kletnieks (Jan 25)
  • Re: Template Admin Notification Jay D. Dyson (Jan 24)
  • Re: Template Admin Notification Glenn Forbes Fleming Larratt (Jan 24)
  • Re: Template Admin Notification Kent Engström (Jan 24)
  • <Possible follow-ups>
  • Re: Template Admin Notification Oxenreider, Jeff (Jan 24)
  • Re: Template Admin Notification Irwin R. Naumann (Jan 24)
  • Re: Template Admin Notification Robert G. Ferrell (Jan 24)
    • Re: Template Admin Notification Jim Littlefield (Jan 24)
    • Re: Template Admin Notification Rick Ballard (Jan 24)
  • Re: Template Admin Notification Timothy Lyons (Jan 24)
  • Re: Template Admin Notification Tim (Jan 25)
    • Re: Template Admin Notification Glenn Forbes Fleming Larratt (Jan 25)
  • Re: Template Admin Notification Dave Salovesh (Jan 25)
  • Re: Template Admin Notification Irwin R. Naumann (Jan 25)
  • Re: Template Admin Notification Forrester, Mike (Jan 25)
    • Re: Template Admin Notification Russell Fulton (Jan 25)
      • Unknown Broadcast Traffic claymore (Jan 29)
      • Re: Unknown Broadcast Traffic Daniel Martin (Jan 29)
  • Re: Template Admin Notification Forrester, Mike (Jan 29)
• Port 64249 Marshall Garland (Jan 24)
  • Re: Port 64249 E, M (Jan 29)
• Intrusion= Harlan S. Barney, Jr. (Jan 24)
• Upload of "pipes.scr" attempted to NetBus "honeypot" Sverre H. Huseby (Jan 24)
  • Re: Upload of "pipes.scr" attempted to NetBus "honeypot" Edward Vielmetti (Jan 24)
  • Re: Upload of "pipes.scr" attempted to NetBus "honeypot" Dennis McHenry (Jan 25)
    • Re: Upload of "pipes.scr" attempted to NetBus "honeypot" Sverre H. Huseby (Jan 25)
  • <Possible follow-ups>
  • Re: Upload of "pipes.scr" attempted to NetBus "honeypot" Brooke, O'neil (EXP) (Jan 25)
• Thanks! Copies of the Ramen worm acquired. Jay D. Dyson (Jan 24)
• Intrusion= Apology / Template Admin Notification Harlan S. Barney, Jr. (Jan 25)
• Port 9200/UDP Scan Portnoy, Gary (Jan 25)
• SecurityFocus.com Temporary Mailing List Shut-Down listadmin (Jan 25)
• 62.158.159.87 syn-flooding Rainer Weikusat (Jan 29)
  • <Possible follow-ups>
  • Re: 62.158.159.87 syn-flooding Bill Royds (Jan 29)
    • Wingate 1080/8080 Scans Brian Taylor (Jan 30)
      • Re: Wingate 1080/8080 Scans James Kelty (Jan 31)
• BIND-8.2.2p5 exploited? dev-null (Jan 29)
  • Re: BIND-8.2.2p5 exploited? Nicolas GREGOIRE (Jan 29)
  • Re: BIND-8.2.2p5 exploited? Jon Lewis (Jan 29)
• weird packet JW Oh (Jan 29)
  • Re: weird packet Daniel Martin (Jan 29)
• PING Nmap2.36BETA Cristian Dumitrescu (Jan 29)
  • Re: PING Nmap2.36BETA Ryan Russell (Jan 29)
  • Re: PING Nmap2.36BETA Eric Kimminau (Jan 29)
• Deserting Firewall Operator Coen Bongers (Jan 29)
  • Re: Deserting Firewall Operator Jose Nazario (Jan 29)
    • Re: Deserting Firewall Operator Ron Johnson (Jan 29)
  • Re: Deserting Firewall Operator Drew Simonis (Jan 29)
    • Re: Re: Deserting Firewall Operator Michael Kaegler (Jan 29)
  • Re: Deserting Firewall Operator Tim Kowalsky (Jan 29)
• New BIND hole. Alfred Huger (Jan 29)
• Dead Thread Alfred Huger (Jan 29)
• BIND 8.2.X frank boldewin (Jan 29)
• Honeynet Project reminders and updates Lance Spitzner (Jan 29)
• Mail relay attempt from patysales.org - thepowerball.com Wim Van den Meutter (Jan 30)
  • Re: Mail relay attempt from patysales.org - thepowerball.com E, M (Jan 30)
  • Re: Mail relay attempt from patysales.org - thepowerball.com Richard Johnson (Jan 30)
  • Re: Mail relay attempt from patysales.org - thepowerball.com Jay D. Dyson (Jan 30)
• BIND probes on the rise... Sean Brown (Jan 30)
• repeated attempts of unapproved updates Wendell Craig Baker (Jan 30)
  • Re: repeated attempts of unapproved updates Mike Lewinski (Jan 30)
  • Re: repeated attempts of unapproved updates Jim Halfpenny (Jan 31)
• Re: Unknown Broadcast Traffic (sygate manager?) Blair Strang (Jan 30)
• Strange TCP RSTs Crist Clark (Jan 30)
  • Re: Strange TCP RSTs Russell Fulton (Jan 31)
    • Re: Strange TCP RSTs Crist Clark (Jan 31)
• SubSeven Trojan port probe Ms. the_hijackmeister (Jan 31)
• DNS Bind Somaini, Justin (Jan 31)
  • Re: DNS Bind Russell Fulton (Jan 31)
  • <Possible follow-ups>
  • Re: DNS Bind Somaini, Justin (Jan 31)
    • Re: DNS Bind gabriel rosenkoetter (Jan 31)
• slow, persistant probes to port tcp 33496 on appearantly random addreses Russell Fulton (Jan 31)

Previous period

Next period