[Dshield] Rise in version.bind scans?

Ian Marks imarks at comcast.net
Mon Jan 17 22:55:09 GMT 2005


Could these scans be related to the new NetworkManager package in Fedora 
Core 3 which has a dependency of Bind.  I had 3 separate Fedora boxes 
install bind this weekend when doing a package update with YUM, luckily 
it doesn't start the service.  I haven't been running any DNS services, 
so I'm not sure why all of the sudden it's required.  Maybe someone 
figured that a ton of new  Fedora hosts are potentially running  a 
default install of Bind now, so they started looking for them?

Ian


Joel Esler wrote:

> I've noticed @ work, and now at home that there seems to be an 
> increase in version.bind scans.  CHAOS? version.bind is the string 
> (who hasn't seen that before ;)  but there seems to be alot more of 
> them than there used to be.
>
> Joel
>
> -------------- Sponsor Message ------------------------------------
> SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
> http://www.sans.org/orlando05
>
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: 
> http://www.dshield.org/mailman/listinfo/list
>




More information about the list mailing list