Trojan attacking our switches

From: Charles Polisher (cpolish@attbi.com)
Date: 03/21/03

  • Next message: dreamwvr@dreamwvr.com: "Re: Trojan attacking our switches" 
    Date: Thu, 20 Mar 2003 17:50:34 -0800
From: Charles Polisher <cpolish@attbi.com>
To: incidents@securityfocus.com

    Search of CVE and securityfocus and googling
    did not turn up adequate information. Anyone
    seen this beast?

    Our campus network has a couple of thousand hosts,
    and 93 switches.

    Telnetting into our HP Procurve 2524 switch
    shows an ongoing attempt to brute-force the
    SNMP community (public, of course). HP apparently
    does not provide a method for disbling SNMP, and
    we're going to have to visit all 93 switches
    in person to set a strong password -- yes, it had
    been left blank!

    PCdoorguard 3 virus scanner identified a
    virus, "f*ck door server", but provides little
    useful information other than pointing to
    \windows\system\setdefed.exe which is 24,576 bytes.

    Thanks,
    Charles Polisher

    ----------------------------------------------------------------------------

    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

  • Next message: dreamwvr@dreamwvr.com: "Re: Trojan attacking our switches"