Security Incidents mailing list archives
Re: new/old port 135 scans?
From: Brian Eckman <eckman () umn edu>
Date: Wed, 14 Jan 2004 11:01:39 -0600
Brian Collins wrote:
Tonight we're seeing a significant increase in scans on tcp/135. Customers are sending roughly 20 packets to several incremental IPs in a class C, waiting 2 seconds, sending roughly 20 more, etc. I was under the impression that Blaster/Nachi was programmed to cease as of 1/1/04 (of course, I could be wrong about that). I'll try to have some packets available in a little while. In the meantime, has anyone else noticed an increase?
That is exactly what Blaster does. It has not ceased, and probably won't for years. There should be an increase in it, as it no longer has Nachi trying to eradicate it.
Brian -- Brian Eckman Security Analyst OIT Security and Assurance University of Minnesota "There are 10 types of people in this world. Those who understand binary and those who don't." --------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- new/old port 135 scans? Brian Collins (Jan 13)
- Re: new/old port 135 scans? Mike Hoskins (Jan 13)
- Re: new/old port 135 scans? Brian Eckman (Jan 14)
- <Possible follow-ups>
- RE: new/old port 135 scans? Flowers, Katie (Jan 13)
- RE: new/old port 135 scans? DeGennaro, Gregory (Jan 14)
- Re: new/old port 135 scans? Brian Eckman (Jan 14)