Re: pop2 scan and .jp contact question

[Robert Bussey <robert () PCIWIZ COM>]

I saw this same thing. I found the following contact:

hostmaster () nic ad jp


**** DISCLAIMER ****
"This e-mail and any attachments thereto may contain information
which is confidential and/or protected by intellectual property
rights and are intended for the sole use of the recipient(s) named above.
Any use of the information contained herein (including, but not limited to,
total or partial reproduction, communication or distribution in any form)
by persons other than the designated recipient(s) is prohibited.
If you have received this e-mail in error, please notify the sender either
by telephone or by e-mail and delete the material from any computer.
Thank you for your cooperation."

Robert A. Bussey
Network Engineer
(617) 535-3004
robert () pciwiz com

"Perpetual optimism is a force multiplier." -Colin Powell


-----Original Message-----
From: Ian Eure [mailto:ieure () SICKFUCK ORG]
Sent: Monday, August 14, 2000 6:25 PM
To: INCIDENTS () SECURITYFOCUS COM
Subject: pop2 scan and .jp contact question


just saw this:

(times are UTC -0700)
-- snip --
Aug 14 04:44:16 spindle kernel: Packet log: ltraf REJECT eth0 PROTO=6
their.ip.was.here:109 my.ip.was.here:109 L=40 S=0x00 I=39426 F=0x0000 T=21
SYN (#11)
Aug 14 04:44:16 spindle kernel: Packet log: ltraf REJECT eth0 PROTO=6
their.ip.was.here:109 my.ip.was.here:109 L=40 S=0x00 I=39426 F=0x0000 T=21
SYN (#11)
-- snip --
a quick grep in /etc/services shows port 109 as pop2. there was a
vulnerability for uw-imap's pop2d about a month ago... most likely a scan
for such.

some digging shows it as a  linux 2.0.xx box at the science university of
tokyo - SUTNET in whois.nic.ad.jp. after some more digging, it appears to
be a student system in noda. despite much digging with whois, i could not
find a contact for SUTNET.

so... how do i go about notifying the net admins that they have either a
malicious student, or a compromised student system? i
found www-admin () sut ac jp on www.sut.ac.jp, but that's about it.

--
 ______________________________________________
| "the whole scale of cosmic dimensions are falling from my mouth
| in the description of a kiss of the interimlovers"
|   - einsturzende neubaten, "interim"