Security Incidents: Re: ingreslock message

[hdm () SECUREAUSTIN COM (H D Moore)]

Ingreslock is the most common port that crackers put thier rootshells
on, because the majority of system admins don't know what it is and may
overlook it easily.  It was probably just some script kiddie (or
"security consultant" who knows these days) scanning for forgotten
rootshells.

-HD

Dino Amato wrote:
> I logged this:
> Mar  5 15:58:23 monitor tcplogd: ingreslock connection attempt from unknown () sleipnir1 cs ucl ac uk
> what does the ingreslock mean and what was this person trying to do?
> Thanks