Re: Scan of on port 5232

Hello,

> We were on the receiving end of a scan on port
> 5232 the other night. I

now we had also a scan on port 5232 (SGI
Distributed Graphics).

Two machines were cracked, a trojan ssh
listening on port 13000 was installed.

A bit unclear is which service was used to
breakin.

The recent telnetd feature is unlikely in the one
case I have studied because this machine had
wrappers installed and the logs indicate
refused connects.

The attacker re-configured
this machine not to offer objectserver, autofs
and pcnfsd so it most likely that one of these
was used.

Bye, Jens Hektor
Received on Sep 02 2000