subject: (Fwd) RE: large scale distributed scan of port tcp 445
posted: Sun, 1 Sep 2002 07:46:02 +0100


port 445 appears at last.. here's another link:

http://www.vnunet.com/News/1131065

Stuart

------- Forwarded message follows -------
Date sent: Fri, 09 Aug 2002 15:46:23 -0400
To: "Jim Harrison (SPG)" <[email protected]>,
"Thomas Cannon" <[email protected]>, "Rob Keown"
<[email protected]>
From: Brian McWilliams <[email protected]>
Subject: RE: large scale distributed scan of port tcp 445
Copies to: "Russell Fulton" <[email protected]>, <[email protected]>

[ Double-click this line for list subscription options ]

I've kind of been waiting for a spike in 445 scans for the past 12 months
... :)

Windows 2000 Port Invites Intruders
26 Aug 2001, 6:14 PM CST

http://www.pc-radio.com/Windows%202000%20Port%20Invites%20Intruders.htm

Exploiting a hole in Windows 2000, a hacker says he penetrated Microsoft's
corporate network earlier this month and had full access to hundreds of the
company's computers.



Brian


At 02:49 PM 8/9/2002, Jim Harrison (SPG) wrote:
>Any W2K or later OS from Microsoft (except maybe .NET server) installs
>with that port open.
>It's not specific to XP. It was added to W2K as a NetBIOS -135/139
>replacement.
>
>* Jim Harrison
>MCP(NT4/2K), A+, Network+
>Services Platform Division
>
>The burden of proof is not satisfied by a lack of evidence to the
>contrary..
>
>
>
>-----Original Message-----
>From: Thomas Cannon [mailto:[email protected]]
>Sent: Friday, August 09, 2002 9:54 AM
>To: Rob Keown
>Cc: 'Russell Fulton'; [email protected]
>Subject: RE: large scale distributed scan of port tcp 445
>
>
>On Thu, 8 Aug 2002, Rob Keown wrote:
>
> > That is MS-DS as I recall. I don't see anything in my logs but dshield
>
> > has the port with a huge spike of targets, with low sources on 7/28.
> > http://isc.incidents.org/port_details.html?port=445 It was ranked 4th
> > on that day.
> >
> > Cannot recall any exploits on this port or service.
> >
> > Anyone know of any exploits on this?
>
>
>I didn't know any, but this might be something to consider, if nothing
>else:
>
>http://www.sygate.com/alerts/XP_default_TCP445_open.htm

>"No brain, no headache"


---
* Origin: [adminz] tech, security, support (192.168.0.2)

generated by msg2page 0.06 on Jul 21, 2006 at 19:04:36

 search:
this site only