[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dshield
Subject:    Re: [Dshield] All port attack?
From:       David Cary Hart <DavidHart () tqmcube ! com>
Date:       2004-12-29 22:39:37
Message-ID: 1104359977.16701.1.camel () dch ! TQMcube ! com
[Download RAW message or body]

On Wed, 2004-12-29 at 13:47 -0600, Bob Savage wrote:
> We seem to be under some sort of probe where one IP address is walking through \
> every port, staring with 2.  Last time I looked it was up to 2942.  We're blocking \
> them all. 
> But here's the kicker.  I've traced the address to the home PC of the owner of our \
> company.  He's using OWA to check his email. 
> I'm assuming he's infected with something.  Before I call him, though, wanted to \
> see if anyone agreed... 

I suggest that you call him post haste. I have done this myself as a CEO
just to see if anyone would notice. My guess is that he learned about
scanner software.
> 
> Bob Savage
> -------------- Sponsor Message ------------------------------------
> SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
> http://www.sans.org/orlando05
> 
> _______________________________________________
> send all posts to list@lists.dshield.org
> To change your subscription options (or unsubscribe), see: \
> http://www.dshield.org/mailman/listinfo/list
________________________________________________________________________
Total Quality Management - A Commitment to Excellence
http://www.TQMcube.com

-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list@lists.dshield.org
To change your subscription options (or unsubscribe), see: \
http://www.dshield.org/mailman/listinfo/list


[prev in list] [next in list] [prev in thread] [next in thread]