Security Incidents: Re: ingreslock message

[emaiwald () FRED NET (Eric Maiwald)]

On Sun, 5 Mar 2000, Dino Amato wrote:
> I logged this:
> Mar  5 15:58:23 monitor tcplogd: ingreslock connection attempt from unknown () sleipnir1 cs ucl ac uk
> what does the ingreslock mean and what was this person trying to do?
> Thanks
The ingresslock port is 1524 (I think).  It has been used recently
as a backdoor by some intruders.  They add a line to inetd.conf to
accept connections on 1524.

This person may have been looking for systems that have been broken.

Eric

---------------------------------------------------------------------
Eric Maiwald                                        emaiwald () fred net
So Many Hobbies, So little time
---------------------------------------------------------------------