[unisog] any one seeing an increase in 17300 SYN

Peter Van Epp vanepp at sfu.ca
Wed Feb 12 20:40:16 GMT 2003


	Yep, us too. Started around 23:00 PST Feb 10 and has continued 
(unsuccessfully) from a variety of sources til about 23:00 on the 11th but so 
far not thereafter. From the 1st to the 10th, there were a couple of probes 
(again unsuccessful) at specific machines but no apparant scanning.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada


On Wed, Feb 12, 2003 at 09:56:10AM -0600, Harris, Michael C. wrote:
> I assume others of you are seeing a recent upswing in what we assume is Kuang2 (SYN 17300) in the last  48 hours? 
> We are seeing a odd increase at midnight 00:00 cst on 02/11/03  and 01:13 cst on 02/12/03 only.  
> Is there something in this virus controlling the timing? or is someone trolling for infected machines?  I've never looked at a live copy or the code itself for Kuang2.
> 
> notice the heavy upswing in sources beginning on the 5th...
> http://isc.incidents.org/port_details.html?port=17300
> 
> anyone done much investigation other than writing it off as KUANG2?
> 
> Mike
> 
> 
> --------------------------------------------------
> Michael C Harris
> System Security Analyst - GSEC
> ITS / Research Education and Support
> University of Missouri Health Center
> Phone: 573-882-3392 
> 
> harrismc at health.missouri.edu
> --------------------------------------------------
> no Kuang2 is not a town in France...
> 
> 
> 



More information about the unisog mailing list