Re: strange SMTP traffic from Korea
From: sponge (yosponge_at_yahoo.com)
Date: 12/07/03
- Previous message: Mike: "Re: PGP and self-extracting files"
- Maybe in reply to: Barry Margolin: "Re: strange SMTP traffic from Korea"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 7 Dec 2003 02:29:56 -0800
jayjwa <jayjwa@hotspam.microsoftsux.suk> wrote in message news:<vsisv2qhv7p725@corp.supernews.com>...
> Damian Menscher wrote:
> > I tried posting this to the incidents list a few weeks ago, but the
> > moderator didn't find it worthy. Our local security people don't
> > speak Korean, so they say there's nothing they can do. So, I'm
> > asking for help here:
> >
> > Since Oct 13 we've been seeing some rather unusual traffic from
> > various IPs in Korea (list below). It was leaving logs like the
> > following:
>
> Funny you mention this... What's up with that country? I banned Korea
> along time ago from my MTA, but they are always trying to connect to
> someplace to try something. I just had one about 20 min. ago. I had him
> mapped out before he disconnect- a Windoze machine with a ton of
> services on it, including a sql server set to its default install. I
> hide behide a proxy and then checked out it's http, and it was of course
> all in Korean, but I made out somekinda login, one on the left, and one
> on the right. They were running Apache 1x, but this wasn't basic auth,
> it was somethign they cooked up themselves. I've never seen a more
> insecure computer before, so that got me to thinking, maybe all this
> crap we see from them is really due to compromised systems? e.g., they
> get owned hard then Oh, Look! now it appears that Korea is playing
> monkey tag with your mail server...
>
> The authorities don't speak the language, so they ain't gonna do
> anything? Great, then I hope they are just as dumb-founded going the
> otherway too, does this mean I get to brute-force that login screen,
> because maybe the authorities don't speak the language? Bhaaa...
A lot of them are hacked, I've found, backed up by replies from the
policy enforcement departments of a few Asian ISPs that spammers had
hacked many of their customers. But hacked or not, those machines are
causing serious problems for the rest of us.
Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 att yahoo dott com
- Previous message: Mike: "Re: PGP and self-extracting files"
- Maybe in reply to: Barry Margolin: "Re: strange SMTP traffic from Korea"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
