[Intrusions] Port Scanning on 1026 & 1027

[Smith, Donald]

I believe your correct re: xpsp2 but there are TONS of other windows systems out there.
Old exploits continue to be used because they work:)
 
 
donald.smith at qwest.com giac

________________________________

From: intrusions-bounces at lists.sans.org on behalf of Dan Parmelee
Sent: Wed 7/27/2005 5:05 PM
To: 'Intrusions List (GCIA Practicals)'
Subject: Re: [Intrusions] Port Scanning on 1026 & 1027



If I recall correctly, the Messenger service is disabled by default in XP
SP2 so why are they even wasting their time? I still stand by my
"MessengerDisable" utility.


Cheers,

Dan Parmelee

-----Original Message-----
From: intrusions-bounces at lists.sans.org
[mailto:intrusions-bounces at lists.sans.org] On Behalf Of Smith, Donald
Sent: Wednesday, July 27, 2005 2:02 PM
To: Intrusions List (GCIA Practicals)
Subject: Re: [Intrusions] Port Scanning on 1026 & 1027

An increase in scanning on those ports is noticeable here.
http://isc.sans.org/port_details.php?port=1026
http://isc.sans.org/port_details.php?port=1027

Its not a huge increase but has an upward trend.


Donald.Smith at qwest.com giac

> -----Original Message-----
> From: intrusions-bounces at lists.sans.org
> [mailto:intrusions-bounces at lists.sans.org] On Behalf Of Tony Tomasello
> Sent: Tuesday, July 26, 2005 1:15 PM
> To: intrusions at lists.sans.org
> Subject: [Intrusions] Port Scanning on 1026 & 1027
>
>
> Guys,
>
> I have noticed a tremendous amount of scanning on ports 1026 and 1027.
> Not sure if you all have been experiencing the same. Is this something
> that I should be concerned about ?
>
> Thanks,
> Tony T.
>
>
> _______________________________________________
> Intrusions mailing list
> Intrusions at lists.sans.org
> http://www.dshield.org/mailman/listinfo/intrus> ions
>

_______________________________________________
Intrusions mailing list
Intrusions at lists.sans.org
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
Intrusions at lists.sans.org
http://www.dshield.org/mailman/listinfo/intrusions