ISS "Stumbler" advisory questions

From: Joe Stewart (jstewart_at_lurhq.com)
Date: 06/20/03

  • Next message: Jasmine: "Re: Unusual registry entries"
    To: xforce@iss.net
    Date: Fri, 20 Jun 2003 10:08:22 -0400
    
    

    From the X-Force "Stumbler" advisory:
    > X-Force has been tracking reports of suspicious and widespread Internet
    > traffic with a TCP Window size of 55808. A substantial amount of traffic
    > captured from sites around the world point to a new distributed port
    > scanning system.
    ... snip ...
    > Each agent attempts to map IP addresses and open ports corresponding to
    > each IP address by sending a TCP SYN packet with a random destination port.

    This doesn't appear to be the same pattern of activity seen since May. Many
    people have reported activity from a single spoofed IP to a single destination
    IP from a random but non-varying source port to a random but non-varying
    destination port - for weeks at a time. I've seen this on several networks we
    montor. I see no way this could even pretend to be an effective distributed
    scan.

    Intrusec seems to feel that the trojan they found is a copycat; someone
    created a trojan to try and match the described behavior/traffic with winsize
    55808. Probably someone's idea of a joke on the infosec community. The files
    ISS describe match the files Intrusec described, so why does ISS/X-Force feel
    that Stumbler is the true source of the traffic?

    -Joe

    -- 
    Joe Stewart, GCIH 
    Senior Intrusion Analyst
    LURHQ Corporation
    http://www.lurhq.com/
    ----------------------------------------------------------------------------
    Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
    world's premier technical IT security event! 10 tracks, 15 training sessions, 
    1,800 delegates from 30 nations including all of the top experts, from CSO's to 
    "underground" security specialists.  See for yourself what the buzz is about!  
    Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
    ----------------------------------------------------------------------------
    

  • Next message: Jasmine: "Re: Unusual registry entries"

    Relevant Pages

    • [Full-Disclosure] ISS "Stumbler" advisory questions
      ... From the X-Force "Stumbler" advisory: ... > X-Force has been tracking reports of suspicious and widespread Internet ... > traffic with a TCP Window size of 55808. ... > each IP address by sending a TCP SYN packet with a random destination port. ...
      (Full-Disclosure)
    • [Full-Disclosure] ISS "Stumbler" advisory questions
      ... From the X-Force "Stumbler" advisory: ... > X-Force has been tracking reports of suspicious and widespread Internet ... > traffic with a TCP Window size of 55808. ... > each IP address by sending a TCP SYN packet with a random destination port. ...
      (Full-Disclosure)
    • Stumbler: Reserved IP 73.247.223.148 scan source
      ... port 36947 TCP over the last couple of months. ... This looks like the Stumbler trojan/scanner due to ... systems attempting to find the same destination port ...
      (Incidents)