[Dshield] VNC activity?

Jeff Kell jeff-kell at utc.edu
Wed Feb 22 13:16:44 GMT 2006


This is just a quick note about some weird activity on my snort sensor
this morning... five dorm computers suddenly showing signs of a VNC
server, all on different nonstandard ports.  Are the bots now going to
this level of remote control?

Haven't seen IRC activity from these hosts, so this could be anything. 
Will have more time to check when I get to the office.  But it is weird
to see a very definite VNC-like response from so many hosts at once, out
of the blue, on a nonstandard port.

Of course MacOS remote admin also looks like this, so it may be trolling
for Macs, due to recent exploits.  I would expect that on the usual port
though (5900).

Jeff


More information about the list mailing list