Security Incidents: Re: Lion Worm/crew.tgz

[Chris Keladis <Chris.Keladis () CMC CWO NET AU>]

Funnily enough SubSeven usually sits on that port.

Perhaps this is some form of SubSeven server/client/honeypot under the
guise of the asp protocol?



Regards,

Chris.

At 04:30 PM 3/26/01 -0500, John Jasen wrote:

> On Mon, 26 Mar 2001, Cooper wrote:
>
> > > asp stream tcp nowait root /sbin/asp
> >
> > What is asp?
>
> asp             27374/tcp                       # Address Search Protocol
> asp             27374/udp                       # Address Search Protocol
>
> beyond that, I have no friggin clue.
>
> --
> -- John E. Jasen (jjasen1 () umbc edu)
> -- In theory, theory and practise are the same. In practise, they aren't.