full-disclosure - Re: Open proxy scanner experience

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 10 Apr 2008 12:42:15 -0400
From: Valdis.Kletnieks@...edu
To: James Lay <jlay@...ve-tothe-box.net>
Cc: Full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Open proxy scanner experience

On Thu, 10 Apr 2008 07:30:36 MDT, James Lay said:

> So yesterday a network that I do work for had it's mail server scanned.  I
> reported the scan (snort reported nmap -F scan) to the offending netblock
> owner, thinking that they had a compromised machine.  I was surprised to
> receive an email this morning stating "Oh that's just our open proxy
> scanner".  Now....I've dealt with some open proxy scanners and seeing the
> activity before, but GOOD GANDHI...they scanned the ENTIRE port range of the
> machine..it took almost 3 hours from start to finish.  Has anyone else seen
> such aggressive "open proxy" scanning like that?

OK, I'll bite - did they initiate the scan when your mailserver first
tried to contact theirs, and greylist you until the scan finished, or were
they idiots and accepted the mail before the scan finished, or are they
complete and total bozos and they're trying to scan the entire Internet
proactively?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/