full-disclosure - Increased TCP 139 Activity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.43.0310081403210.13360-100000@tundra.winternet.com>
From: dufresne at winternet.com (Ron DuFresne)
Subject: Increased TCP 139 Activity

it's highly likely, if this is being observed carefully, all probes to 139
or  445 are proeceeded by a ping sweep of all addresses onthe network.  If
this is indeed the case, the ping sweep will all be packets of 92  byte,
these are windows packets, and the recent rcpdcom sploits are the culprit.

old news, yer lucky in only now seeing it's affects.

Now, if there is a variation on this theme, then perhaps there';s
something new afoot, but, others will prolly catch that prior.

Thanks,

Ron DuFresne

On Wed, 8 Oct 2003, Brown, Rodrick wrote:

> You must not be on a cable network I must get around a 100 probes a day
> when I'm home on port 139
>
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Phathat
> Sent: Wednesday, October 08, 2003 10:40 AM
> To: Full-Disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Increased TCP 139 Activity
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Check your logs. For the past three hours we've seen a significant
> increase
> in scanning for TCP port 139 beginning from S. Korea.
> -----BEGIN PGP SIGNATURE-----
> Note: This signature can be verified at https://www.hushtools.com/verify
> Version: Hush 2.3
>
> wkYEARECAAYFAj+EIbYACgkQnBN72pVYTdhSKQCfSSmkDcNJYSsu8rZs1oM8YdK2o44A
> oK8GnMJjMxZ4zl3/WcvXgb2M78ci
> =ik7h
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.