RE: Pubstro rash

From: Alexandre Skyrme (alexandre.skyrme_at_ciphersec.com.br)
Date: 03/17/05

  • Next message: k levinson: "RE: Pubstro rash" 
    To: <incidents@securityfocus.com>
Date: Thu, 17 Mar 2005 18:57:18 -0300

    Greetings David,

    Just a thought about your third comment...

    As far as I'm concerned DNS just uses 53/TCP to do zone transfers. In case
    your workstations are on a different network than your DNS servers it should
    probably be safe to block incoming TCP connections to that network on such
    port.

    Tipically zone transfers would only be used by secondary servers to update
    their own zones from its primary server.

    Regards, 

    --
Alexandre Skyrme
Cipher - Segurança da Informação
+55-21-2542-6677
www.ciphersec.com.br
Esta mensagem eletrônica pode conter informações privilegiadas e/ou
confidenciais, portanto fica o seu receptor notificado de que qualquer
disseminação, distribuição ou cópia não autorizada é estritamente proibida.
Se você recebeu esta mensagem indevidamente ou por engano, por favor,
informe este fato ao remetente e a apague de seu computador imediatamente.
 
This e-mail message may contain legally privileged and/or confidential
information, therefore, the recipient is hereby notified that any
unauthorized dissemination, distribution or copying is strictly prohibited.
If you have received this e-mail message inappropriately or accidentally,
please notify the sender and delete it from your computer immediately.
-----Original Message-----
From: David Gillett [mailto:gillettdavid@fhda.edu] 
Sent: quarta-feira, 16 de março de 2005 22:59
To: incidents@securityfocus.com
Subject: Pubstro rash
  A few times in the past, someone has managed to break
into one or another of our servers and set up an FTP server
("pubstro") on an unused high port.  I'm facing something 
similar at the moment, but there are some distinct differences:
1.  The compromised hosts are workstations, not servers.
I'm hoping our field techs will be able to identify a 
common OS/SP level amongst the compromised machines.  No servers appear to
be affected.
2.  There have been 14 of them in less than 5 days.  OUCH.
3.  Instead of a random high port, the installed FTP server 
listens on port 53.  Which I can't block, because DNS may
need to use it, right?
4.  The FTP banners all claim to be the work of "Droppunx".
5.  At this point, I don't know how the machines are getting 
compromised initially.  I'd appreciate if anyone else is seeing this pattern
and has some insight they'd care to share.
David Gillett
  • Next message: k levinson: "RE: Pubstro rash"

    Relevant Pages

    • RE: DNS ACL ?
      ... and there should be no zone transfers coming in ... from the internet to these servers. ... Subject: DNS ACL? ... > Not all DNS clients automatically try to negotiate bigger UDP ...
      (Pen-Test)
    • Re: transferring secondary DNS zone problem
      ... All the servers involved are W2K3. ... IPs in as DNS forwarders and allowed zone transfers. ...
      (microsoft.public.windows.server.dns)
    • Re: Zone Transfer and Trust
      ... > local AD Integrated DNS servers at both locations? ... Herb Martin ... >>> Do we need to do Zone transfers from one DNS to another DNS to ...
      (microsoft.public.windows.server.dns)
    • Re: Zone Transfer and Trust
      ... > Do we need to do Zone transfers from one DNS to another DNS to establish a ... ALL machines must be WINS servers clients, ... can't a one way trust be ... Zone transfers need to take place to all DNS secondary ...
      (microsoft.public.windows.server.dns)
    • Re: Help SMPT Errors
      ... FAIL Reverse DNS entries for MX records ERROR: The IP of one or more of your ... it may mean that your DNS servers did not respond fast enough). ... INFO NS records at parent servers Your NS records at the parent servers ... PASS Parent nameservers have your nameservers listed OK. ...
      (microsoft.public.exchange.admin)