Re: connection request to port 25

[carric () com2usa com (Carric Dooley)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You are probably being used by spammers as an open relay... either
shutdown sendmail, or get the bat book to learn how to secure your
box...

Carric Dooley
Network Security Consultant

"I have often regretted my speech, never my silence." 
- - Xenocrates (396-314 B.C.) 

- ----- Original Message ----- 
From: "SHAIFUL HASHIM" <s.hashim () usa net>
To: <ids () uow edu au>
Sent: Monday, June 12, 2000 5:08 AM
Subject: IDS: connection request to port 25

> Archive: http://msgs.securepoint.com/ids
> FAQ: http://www.ticm.com/kb/faq/idsfaq.html
> IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
> HELP: Having problems... email questions to ids-owner () uow edu au
> NOTE: Remove this section from reply msgs otherwise the msg will
> bounce. SPAM: DO NOT send unsolicted mail to this list.
> UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
> --------------------------------------------------------------------
> --------- Hi all,
>
> I believed one of the workstations in my university has been
> compromised. I've monitored any connection from outside to the
> machine using snort. What I've got are overwhelming connection
> request to port 25 with SYN bit set from multiple of hosts.
> Currently the mail has not been used much but the log have shown
> that the mail port is very active. Can you tell me what sort of
> attack this might be and what is possibly going on?
>
> Thanks
> Shaiful
> UKM
>
> ____________________________________________________________________
> Get free email and a permanent address at
> http://www.netaddress.com/?N=1 

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBOUVgEFUqWOkDpMZ2EQLVZwCcD1Jfd0WwTkGK2F3ifTcVi/kPeLkAoIvb
qzy8a569lRdaaKPoztlM/MDS
=oQea
-----END PGP SIGNATURE-----