FW: Nmap - 3.50 changes mstask.exe?

From: Dr0idb0y (dr0idb0y_at_comcast.net)
Date: 02/27/04

  • Next message: Ben.Vaughn_at_united.com: "RE: Nmap - 3.50 changes mstask.exe?"
    To: <a55mnky@yahoo.com>, <incidents@securityfocus.com>
    Date: Fri, 27 Feb 2004 14:38:58 -0800
    
    

    Seems you have at least two issues here. First, a manager who is looking to
    blame you for this incident. I'm always amazed at what nmap scanning gets
    blamed for. It's easy enough to solve this though. Set up two machines in
    isolation, and use your version of nmap to scan it. Voila! Either mstask
    changed or it didn't. It might be a good idea to set up a sniffer as well,
    to really prove the point. Make sure your manager is present when this
    happens.

    Second, you need to find out what actually did change mstask (assuming it
    did actually change). Might be a little tougher. How many trojans/rootkits
    /virii and patches do this?

    Good luck!

    -----Original Message-----
    From: a55mnky@yahoo.com [mailto:a55mnky@yahoo.com]
    Sent: Friday, February 27, 2004 8:32 AM
    To: incidents@securityfocus.com
    Subject: Nmap - 3.50 changes mstask.exe?

    Not sure if this is the best list for this, but I am in a bit of a jam.

    I just downloaded the new NMAP v. 3.50 and ran it on my internal network. My
    IT manager is freaking out. He says my scan replaced mstask.exe on the
    machines I scanned.

    Anybody else seen this behavior?

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------


  • Next message: Ben.Vaughn_at_united.com: "RE: Nmap - 3.50 changes mstask.exe?"

    Relevant Pages

    • Re: Nmap - 3.50 changes mstask.exe?
      ... > I just downloaded the new NMAP v. 3.50 and ran it on my internal network. ... > My IT manager is freaking out. ... your machine have admin rights on the machines you scanned? ... Also did you download NMAP from a particular mirror? ...
      (Incidents)
    • RE: Nmap - 3.50 changes mstask.exe?
      ... I have to raise the bullshit flag on this one....check the source code if you ... I just downloaded the new NMAP v. 3.50 and ran it on my internal ... My IT manager is freaking out. ...
      (Incidents)
    • Re: Justifying the spend on a vulnerability scanner
      ... I would ask permission from your manager in writing do to some pen testing. ... run things like Nessus and Nmap against your system and show him/her the ... Justifying the spend on a vulnerability scanner ...
      (Security-Basics)
    • Re: Nmap - 3.50 changes mstask.exe?
      ... Have you considered slapping your IT manager around a bit with a large ... >I just downloaded the new NMAP v. 3.50 and ran it on my internal network. ... My IT manager is freaking out. ...
      (Incidents)
    • RE: Dangerous in using nmap for AS/400 730 machine configured with 3 ASPs?
      ... For those of you bet on the IP stack problem, ... Dangerous in using nmap for AS/400 730 machine configured with 3 ASPs? ... 2 out of 50+ identifiable machines started having problems. ... Top 5 Common Mistakes ...
      (Pen-Test)