[Dshield] 2967/TCP (SSC-AGENT) Scans

Olivier Meyer roguefugu at gmail.com
Tue Jan 9 03:33:25 GMT 2007


Same here!
I regularly get SYNs to 445, 139, 135, and especially 2967.
Of course, running OpenBSD does not expose me to any risk...

On 1/7/07, Robert Nelson <nelsrob at mts.net> wrote:
> I'm wondering if some little bot/trojan/whatever isn't busy scanning. I've noticed scans of that port on my local DSL neighborhood,
> too, along with 5900, 445, 135, 139, 1433...
>
> Robert
>
> -----Original Message-----
> From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org] On Behalf Of Jon R. Kibler
> Sent: January 7, 2007 1:11 PM
> To: General DShield Discussion List
> Subject: [Dshield] 2967/TCP (SSC-AGENT) Scans
>
>
> Hi,
>
> Just looked at weekly scan stats. Port 2967/tcp is now the top blocked port and  almost 1.5x the number of VNC scans, the next most
> frequently scanned port. (Most amazing, ssh scans have dropped to 10th place!)
>
> Is there a new Symantec exploit, or is this still trying to exploit the vulnerability first reported last summer?
>
> Jon
> --
> Jon R. Kibler
> Chief Technical Officer
> A.S.E.T., Inc.
> Charleston, SC  USA
> (843) 849-8214
>
> _________________________________________
>
> SANS 2007 March 29 - April 6 in San Diego, CA offers 52 Courses
> taught by our top rated instructors plus a huge vendor tools expo.
> Register Today! http://www.sans.org/info/2501 (BROCHURECODE: ISC)
>


-- 
--
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)


More information about the list mailing list