Security Incidents mailing list archives
RE: Large Attack
From: "Coochey, Giles" <g.coochey () btinternet com>
Date: Fri, 1 Mar 2002 23:52:22 -0000
Thanks for the information. At first looks this seems to me to be a directed attack to find any vulnerablilities in your systems. I should ask some questions: What is the Class of your public subnet? What is the extent of said subnets that is being attacked here, i.e. from what subnets do you have sensors to identify these attacks from? Are these attacks coming from a single source IP of a distributed number, or are they completely random (very important in incident analysis)? Have you investigated packet capture to identify FPs or are these "raw" reports from your IDS? Regards, Giles -----Original Message----- From: Douglas P. Brown [mailto:dugbrown () email unc edu] Sent: 01 March 2002 19:44 To: incidents () securityfocus org; unisog () sans org Cc: ITS Security Subject: Large Attack FYI - Starting last night and continuing this morning we've seen at least 14 hosts from at least 7 different foreing subnets banging pretty heavy on our subnets. Below is a smart from the IDS logs for one of the bad hosts. The result has been that several NT and 2000 domains have had accounts locked out. 148 different signatures are present for x.x.x.x as a source 1 instances of WEB-IIS JET VBA access 1 instances of WEB-IIS getdrvrs access 1 instances of WEB-COLDFUSION administrator access 1 instances of WEB-IIS admin.dll access 1 instances of WEB-MISC .wwwacl access 1 instances of WEB-IIS uploadn.asp access 1 instances of WEB-CGI args.bat access 1 instances of WEB-MISC Domino catalog.ns access 1 instances of WEB-COLDFUSION exampleapp access 1 instances of WEB-IIS bdir.ht access 1 instances of WEB-MISC cpshost.dll access 1 instances of WEB-IIS getdrvs.exe access 1 instances of WEB-IIS anot.htr access 1 instances of WEB-IIS search97.vts 1 instances of WEB-FRONTPAGE shtml.exe 1 instances of WEB-COLDFUSION cfmlsyntaxcheck.cfm access 1 instances of WEB-FRONTPAGE form_results access 1 instances of WEB-FRONTPAGE authors.pwd access 1 instances of WEB-COLDFUSION beaninfo access 1 instances of WEB-MISC convert.bas access 1 instances of WEB-MISC AuthChangeUr accessl 1 instances of WEB-IIS codebrowser SDK access 1 instances of WEB-CGI wwwboard passwd access 1 instances of WEB-MISC ws_ftp.ini access 1 instances of WEB-MISC cart 32 AdminPwd access 1 instances of WEB-COLDFUSION fileexists.cfm access 1 instances of WEB-IIS adctest.asp access 1 instances of WEB-COLDFUSION evaluate.cfm access 1 instances of WEB-IIS CGImail.exe access 1 instances of WEB-COLDFUSION snippets attempt attempt 1 instances of WEB-COLDFUSION addcontent.cfm access 1 instances of WEB-COLDFUSION cfcache.map access 2 instances of WEB-MISC counter.exe access 2 instances of WEB-COLDFUSION exampleapp application.cfm 2 instances of WEB-IIS .asp access 2 instances of WEB-FRONTPAGE users.pwd access 2 instances of WEB-FRONTPAGE registrations.txt access 2 instances of WEB-FRONTPAGE dvwssr.dll access 2 instances of WEB-FRONTPAGE fpadmcgi.exe access 2 instances of WEB-COLDFUSION cfappman access 2 instances of WEB-IIS achg.htr access 2 instances of WEB-FRONTPAGE _vti_rpc access 2 instances of WEB-FRONTPAGE fpcount.exe access 2 instances of WEB-IIS codebrowser Exair access 2 instances of WEB-MISC shopping cart access access 2 instances of WEB-MISC ICQ webserver DOS 2 instances of WEB-IIS query.asp access 2 instances of SMTP expn root 2 instances of WEB-COLDFUSION application.cfm access 2 instances of WEB-IIS _vti_inf access 2 instances of WEB-IIS admin-default access 3 instances of WEB-IIS *.idc attempt 3 instances of WEB-CGI MachineInfo access 3 instances of RPC portmap listing 3 instances of WEB-IIS global-asa access 3 instances of WEB-COLDFUSION expeval access 3 instances of WEB-IIS asp-dot attempt 3 instances of WEB-IIS codebrowser access 3 instances of WEB-MISC Ecommerce checks.txt access 3 instances of WEB-CGI webgais access 3 instances of SCAN Synscan Portscan ID 19104 3 instances of WEB-IIS newdsn.exe access 3 instances of WEB-CGI websendmail access 3 instances of WEB-IIS jet vba access 4 instances of WEB-CGI post-query access 4 instances of WEB-CGI dumpenv.pl access 4 instances of WEB-CGI AT-admin.cgi access 4 instances of WEB-CGI whoisraw access 5 instances of WEB-MISC get32.exe access 5 instances of WEB-MISC .htpasswd access 5 instances of WEB-CGI classifieds.cgi access 5 instances of WEB-CGI sendform.cgi access 5 instances of WEB-CGI w3-msql access 5 instances of WEB-CGI files.pl access 5 instances of WEB-CGI AnyForm2 access 5 instances of WEB-CGI rksh access 5 instances of WEB-IIS admin access 6 instances of WEB-CGI bash access 6 instances of WEB-CGI glimpse access 6 instances of WEB-CGI maillist.pl access 6 instances of WEB-CGI w2tvars.pm access 6 instances of WEB-CGI wguest.exe access 6 instances of WEB-MISC shopping cart directory traversal 6 instances of WEB-CGI wais.p access 6 instances of WEB-MISC /cgi-bin/jj attempt 6 instances of WEB-CGI filemail access 6 instances of WEB-CGI edit.pl access 6 instances of WEB-CGI man.sh access 7 instances of WEB-CGI pfdisplay.cgi access 7 instances of WEB-MISC Ecommerce import.txt access 7 instances of WEB-CGI www-sql access 7 instances of WEB-IIS 5 .printer isapi 7 instances of WEB-CGI archie access 7 instances of WEB-MISC ~root 7 instances of WEB-CGI day5datacopier.cgi access 7 instances of WEB-MISC wwwboard.pl access 7 instances of WEB-CGI environ.cgi access 7 instances of WEB-CGI day5datanotifier.cgi access 8 instances of WEB-CGI survey.cgi access 8 instances of WEB-CGI redirect access 8 instances of WEB-CGI calendar access 8 instances of WEB-CGI perlshop.cgi access 8 instances of WEB-CGI rsh access 8 instances of WEB-MISC handler access 8 instances of WEB-CGI rwwwshell.pl access 8 instances of WEB-MISC guestbook.cgi access 8 instances of WEB-CGI testcounter.pl access 9 instances of WEB-MISC Domino log.nsf access 9 instances of WEB-CGI info2www access 9 instances of WEB-CGI upload.pl access 9 instances of WEB-MISC order.log access 9 instances of WEB-CGI ksh access 9 instances of WEB-IIS iisadmpwd attempt 10 instances of WEB-MISC mall log order access 10 instances of WEB-MISC Domino names.nsf access 10 instances of WEB-CGI bnbform.cgi access 11 instances of WEB-CGI campas access 11 instances of WEB-MISC /etc/passwd 11 instances of WEB-MISC netscape admin passwd 11 instances of WEB-CGI bb-hist.sh access 12 instances of WEB-CGI htmlscript access 12 instances of WEB-CGI faxsurvey access 13 instances of WEB-MISC piranha passwd.php3 access 13 instances of WEB-CGI NPH-publish access 13 instances of WEB-CGI csh access 13 instances of WEB-MISC nph-test-cgi access 13 instances of WEB-CGI wwwadmin.pl access 14 instances of WEB-MISC .htaccess access 14 instances of WEB-MISC webdist.cgi access 14 instances of WEB-MISC architext_query.pl access 14 instances of WEB-CGI flexform access 16 instances of WEB-CGI LWGate access 16 instances of WEB-MISC bigconf.cgi access 17 instances of WEB-MISC Attempt to execute cmd 17 instances of WEB-CGI tsch access 19 instances of WEB-MISC Domino domlog.nsf access 19 instances of WEB-MISC wrap access 19 instances of WEB-MISC Domino domcfg.nsf access 20 instances of WEB-CGI finger access 21 instances of WEB-CGI aglimpse access 27 instances of WEB-CGI formmail access 28 instances of WEB-FRONTPAGE fourdots request 29 instances of WEB-CGI test-cgi access 35 instances of WEB-CGI phf access 54 instances of CUSTOM Port 515 traffic 77 instances of FTP passwd attempt 159 instances of WEB-MISC http directory traversal 2369 instances of SCAN Proxy attempt There are 937 distinct destination IPs - we've taken steps on our end to block this traffic. I wanted to give everyone a heads up in case your next, and to see if anyone else is seeing similar traffic. Cheers, -Doug -- Douglas P. Brown University of North Carolina Manager of Security Resources 105 Abernethy Hall ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Large Attack Douglas P. Brown (Mar 01)
- RE: Large Attack Coochey, Giles (Mar 01)
- Re: Large Attack Passion (Mar 03)
- Re: Large Attack zaire (Mar 04)
- Re: Re: Large Attack Douglas P. Brown (Mar 04)
- Message not available
- Re: [unisog] Re: Re: Large Attack Walter G. Aiello (Mar 04)
- Re: Re: Large Attack Douglas P. Brown (Mar 04)