Re: echo scans

["J. Oquendo" <intrusion () ENGINEER COM>]

Seems like they scanned in an effort to find an easily rootable service. DNS, NFS, etc, etc... As for the echo stuff 
they could've been searchin for something like an outlet for DoS's eg.
echo | chargen or some type of other bouncy like DoS.

As for the scan starting at 2443, thats PCCSF (powerclient central storage facility) which I have never seen on any 
security related list. Same with ports 516 (videotex) ,511 (passgo) ,633 (servstat), etc etc... They could've just 
scanned in a funky order maybe with thoughts that if it seemed funky it would throw off an admin? (sounds crackheadish 
I know...)

> > > > > >
2443, 53, 516, 511, 162, 111, 109

633, 987, 171, 241, 848, 278, 700, 119, 899, 317

196, 909, 129, 128, 883, 840, 904, 553, 177, 679, 803, 106, 418, 340,
126, 635, 373, 834

90, 959, 545, 217, 187, 1011, 967, 677, 19, 630, 858, 758

538, 949, 818, 642, 711

905, 873, 562, 317, 764, 637, 280, 378

881, 191, 688

then the 4 minute scan on tcp/udp port 7.

Regards.
> > > > > >

FYI here is a link for a listing of port numbers which I'm praying people will save and do some little homework on... 
e.g.: Someone port scans you on say... 1706 ... Then look up on Security Focus for Jetform or whatever program 'should' 
be running on the defined port.

"maybe someone some where will appreciate it"

http://www.antioffline.com/TID/assignments/port-numbers

--------------------------------------------------
Jesus Christ

sil () deficiency org  || www.deficiency.org
sil () macroshaft org  || www.macroshaft.org
sil () antioffline com || www.antioffline.com

PGP ID 0x889D1540 DH/DSS CAST
FB96 1B34 ED52 73A0 AEA5  0D7C 671D 224B 889D 1540
http://keys.pgp.com | sil () antioffline com

"No enterprise is more likely to succeed than one
concealed from the enemy until it is ripe for
execution."  Niccolo Machiavelli, The Prince 1521

0000 0011 0000 0001 0000 0011 0000 0011 0000 0111

______________________________________________
FREE Personalized Email at Mail.com
Sign up at http://www.mail.com/?sr=signup