Security Incidents: Re: Trojan of somesort - Update

[Derek <cissp_ds () cox net>]

In-Reply-To: <182030000.1085678189 () utd49554 utdallas edu>

Paul Schmehl said:
------------------
> Good luck scanning for ports.  The ports they use are completely 
> arbitrary and infinitely changeable.
[snip]
> I have port scanned *known* tagged boxes and found nothing to raise 
> suspicions.  These guys aren't stupid.  They're going to try and make the 
> box look as normal as possible.  Some of them even moderate downloads and 
> uploads to try and stay under the radar and not raise suspicion due to 
> unusual traffic patterns.
And using port knocking will make things even more invisible.  Anyone seen RATs using this?

Derek