Large scans in progress...

[UnixGeek <ed () XWING CENTIGRAM COM>]

Just an FYI:

Seems large chunks of various netblocks are being scanned from Israel,
currently, from IP 62.0.56.66(does not appear to be a multi-host,
coordinated scan).

After checking my snort logs this afternoon, I nmap'd the offender and
poked around.  Entry to the system was trivial and the contacts(via
RIPE)responsible for the netblock have been notified.

Attack is underway with synscan(which Snort missed specifically, though it
did flag the scan).  Means of entry is unknown, but it looks similar to
the ingreslock exploit.  System is RH 6.2.  Output below is from my trip
to the system(which raises the legitimate question -- if I'm investigating
the perpetration of a crime[or attempted crime] against myself or my
property, am I as culpable as the person who broke into the system and
used it for a malicious purpose?[the thought of killing off all the
synscans, killing inetd and bailing crossed my mind, to stop the abuse,
but then that might affect evidentiary proceedings, no?].

-----------wheee------------
telnet 62.0.56.66 1
Trying 62.0.56.66...
Connected to 62.0.56.66.
Escape character is '^]'.
bash# ls
ls
bin
boot
bru
dev
etc
home
lib
lost+found
misc
mnt
opt
org
proc
root
sbin
test
tftpboot
tmp
usr
var
bash#
bash# ps
ps
  PID TTY STAT  TIME COMMAND
  759   1 S    0:00 /sbin/mingetty tty1
  760   2 S    0:00 /sbin/mingetty tty2
  761   3 S    0:00 /sbin/mingetty tty3
  762   4 S    0:00 /sbin/mingetty tty4
  763   5 S    0:00 /sbin/mingetty tty5
  764   6 S    0:00 /sbin/mingetty tty6
 9327  ?  S    0:00 /bin/bash
 9337  ?  S    2:43 ./synscan 63 63.log eth0 0 21
 9340  ?  S   15:35 ./synscan 63 63.log eth0 0 21
10933  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10934  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10935  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10937  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10939  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10940  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10941  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10942  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10943  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10944  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10945  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10954  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10955  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10958  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10962  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10976  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10987  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10990  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10991  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10992  ?  S    0:00 ./synscan 63 63.log eth0 0 21
10994  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11123  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11124  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11125  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11126  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11127  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11128  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11129  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11130  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11131  ?  S    0:00 ./synscan 63 63.log eth0 0 21
11132  ?  S    0:00 ./synscan 63 63.log eth0 0 21
bash#
bash#
bash# cd /dev/mdev/sysnscan
cd /dev/mdev/sysnscan
sh: /dev/mdev/sysnscan: No such file or directory
bash#
bash# cd /dev/mdev/synscan
lcs
d /dev/mdev/synscan
bash#
bash# ls
150.log
192.log
193.log
196.log
63.log
Makefile
README
bpf.h
cgis.txt
host2ip
host2ip.c
ircd.txt
libpcap.a
m0h.log
meh.log
nsd.c
numip
numip.c
pcap.h
rah.log
rpcs.txt
synscan
synscan.c
tcpsock.c
upscan
upscan.c

---------------------------------------------------

-ed

                            Edward Mitchell
        Centigram Unix Geek, BOfH, Network Admin, Darth Sysadmin
                         ed () xwing centigram com
                      http://www.the7thbeer.com/ed
                          Sheepish Lord of Chaos
--------------------------------------------------------------
"Fear leads to anger. Anger leads to hate. Hate leads to using
Windows NT for mission-critical applications."
     -- What Yoda *meant* to say