bugtraq - Elevated scanning: TCP port 135 (RPC) AND 445 (Domain Services)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040127101900.A2472@ring.CS.Berkeley.EDU>
Date: Tue, 27 Jan 2004 10:19:00 -0800
From: Nicholas Weaver <nweaver@...berkeley.edu>
To: bugtraq@...urityfocus.com
Subject: Elevated scanning: TCP port 135 (RPC) AND 445 (Domain Services)



	At several locations we have seen a significant elevation in
scanning on TCP ports 135 AND 445.  The scannig machines are scanning
both ports, and seem to be doing a semirepeated scan (sometimes
attempting multiple tries at the same destination).

	This looks somewhat like a worm scan or widely distributed
scan which is targeting the windows RPC port and is also looking for
domain controllers (to attack?  To find other targets?  To
authenticate with other possible targets?)

	Does anyone have more information on this?

	Especially anybody with a windows honeypot?

-- 
Nicholas C. Weaver                                 nweaver@...berkeley.edu