Re: [Full-disclosure] Broadcast storm in my network/ any ideas
- From: 3APA3A <3APA3A@xxxxxxxxxxxxxxxx>
- Date: Thu, 22 Dec 2005 20:31:22 +0300
Dear wilder_jeff Wilder,
UDP/111 (Sun RPC) is not used in Windows environment. Either you use
some services for Unix, i.e. MS services for Unix, 3rd party NFS/NIS/etc
support or this is result of privileged user/trojan/backdoor activity.
--Thursday, December 22, 2005, 8:16:48 PM, you wrote to full-disclosure@xxxxxxxxxxxxxxxxx:
wW> I have a Windows 2000 terminal server that is consistantly sending
wW> out broadcasts to 255.255.255.255:111... below is a capture from a
wW> RPC portmap proxy attempt UDP 10.74.32.31:3300/udp
wW> 255.255.255.255:111/udp 07:50:35 RPC portmap proxy attempt UDP
wW> 10.74.32.31:3291/udp 255.255.255.255:111/udp 07:50:05
--
~/ZARAZA
http://www.security.nnov.ru/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- References:
- Re: [Full-disclosure] new attack technique? using JavaScript+XML+OWSPost Data
- From: Gaurav Kumar
- [Full-disclosure] Broadcast storm in my network/ any ideas
- From: wilder_jeff Wilder
- Re: [Full-disclosure] new attack technique? using JavaScript+XML+OWSPost Data
- Prev by Date: Re: [Full-disclosure] new attack technique? using JavaScript+XML+OWSPost Data
- Next by Date: Re: [Full-disclosure] Broadcast storm in my network/ any ideas
- Previous by thread: [Full-disclosure] Broadcast storm in my network/ any ideas
- Next by thread: Re: [Full-disclosure] Broadcast storm in my network/ any ideas
- Index(es):
Relevant Pages
|
|
