RE: [Firestarter-user] Hackt?
Brought to you by:
majix
Menu
▾
▴
RE: [Firestarter-user] Hackt?
|
From: Mike <ma...@rm...> - 2003-04-30 00:16:10
|
You are infact being port scanned by someone using a port scanner like nmap trying to see what ports are open and what services might be running to find a weak spot. Make sure your up to date on any patchs and Close any ports not being used ASAP. If you want I'll port scan you using nmap and you can see the same results.. M;) -----Original Message----- From: fir...@li... [mailto:fir...@li...] On Behalf Of Thomas Sch=F6nhoff Sent: Tuesday, April 29, 2003 1:24 AM To: Firestarter Subject: [Firestarter-user] Hackt? Hello, I recently found these hits on my Firestarter (0.8.1) screen: 33044 62.245.190.21 unknown Apr 27 12:32:42 33044 62.245.190.21 unknown Apr 27 12:33:05 23 80.134.44.223 telnet Apr 27 14:40:33 22 80.134.44.223 ssh Apr 27 14:40:33 19 80.134.44.223 chargen Apr 27 14:40:33 11 80.134.44.223 systat Apr 27 14:40:33 7 80.134.44.223 echo Apr 27 14:40:33 88 80.134.44.223 kerberos Apr 27 14:40:34 81 80.134.44.223 unknown Apr 27 14:40:34 79 80.134.44.223 finger Apr 27 14:40:34 66 80.134.44.223 unknown Apr 27 14:40:34 43 80.134.44.223 whois Apr 27 14:40:34 42 80.134.44.223 nameserver Apr 27 14:40:34 514 80.134.44.223 shell Apr 27 14:40:35 513 80.134.44.223 login Apr 27 14:40:35 443 80.134.44.223 https Apr 27 14:40:35 407 80.134.44.223 unknown Apr 27 14:40:35 396 80.134.44.223 unknown Apr 27 14:40:35 389 80.134.44.223 ldap Apr 27 14:40:35 256 80.134.44.223 unknown Apr 27 14:40:35 179 80.134.44.223 bgp Apr 27 14:40:35 143 80.134.44.223 imap2 Apr 27 14:40:35 118 80.134.44.223 unknown Apr 27 14:40:35 The first though came to my mind was that I've been hacked, so cut the=20 connection and fetch the newest chkrootkit to test my system, without=20 finding sniffer.logs or similiar things! Since I am not an expert in networking issues I am not quite sure if=20 this is right? So I decided to ask you to give me your opinion of this incident? Even if I am not hacked, it semms to me like being attacked, isn't it? cheers Thomas ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Firestarter-user mailing list Fir...@li... https://lists.sourceforge.net/lists/listinfo/firestarter-user |