Re: Printer exploit?

["Jeremy Sanders" <jsanders () newsouthfederal com>]

It didn't make it past my router filters to the ids but here are the router logs for port 515 attempts


Jun 16 00:19:31 nsfbrd 205242: 2w2d: %SEC-6-IPACCESSLOGP: list 101 denied tcp 216.129.142.30(2425) (Serial0/0 DLCI 300) 
-> x.x.x.254(515), 1 packet
Jun 16 00:19:45 nsfbrd 205244: 2w2d: %SEC-6-IPACCESSLOGP: list 101 denied tcp 216.129.142.30(3934) (Serial0/0 DLCI 300) 
-> x.x.x.131(515), 1 packet
Jun 16 00:19:48 nsfbrd 205245: 2w2d: %SEC-6-IPACCESSLOGP: list 101 denied tcp 216.129.142.30(3931) (Serial0/0 DLCI 300) 
-> x.x.x.128(515), 1 packet
Jun 16 00:19:55 nsfbrd 205247: 2w2d: %SEC-6-IPACCESSLOGP: list 101 denied tcp 216.129.142.30(3969) (Serial0/0 DLCI 300) 
-> x.x.x.159(515), 1 packet
Jun 22 13:50:14 nsfbrd 25962: 1d21h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 213.154.144.33(1810) (Serial0/0 DLCI 300) 
-> x.x.x.254(515), 1 packet
Jun 28 03:41:16 nsfbrd 10859: 17:20:44: %SEC-6-IPACCESSLOGP: list 101 denied tcp 213.77.158.147(4207) (Serial0/0 DLCI 
300) -> x.x.x.254(515), 1 packet
Jun 28 18:36:50 nsfbrd 20586: 1d08h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 211.250.97.130(2701) (Serial0/0 DLCI 300) 
-> x.x.x.254(515), 1 packet
Jun 28 18:36:53 nsfbrd 20587: 1d08h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 211.250.97.130(4610) (Serial0/0 DLCI 300) 
-> x.x.x.128(515), 1 packet
Jun 28 18:36:56 nsfbrd 20589: 1d08h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 211.250.97.130(4611) (Serial0/0 DLCI 300) 
-> x.x.x.129(515), 1 packet
Jun 28 20:50:25 nsfbrd 21312: 1d10h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 193.219.185.11(3790) (Serial0/0 DLCI 300) 
-> x.x.x.254(515), 1 packet
Jun 29 02:20:35 nsfbrd 22693: 1d16h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 217.80.77.237(1087) (Serial0/0 DLCI 300) 
-> x.x.x.150(515), 1 packet
Jun 29 02:20:38 nsfbrd 22694: 1d16h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 217.80.77.237(1067) (Serial0/0 DLCI 300) 
-> x.x.x.130(515), 1 packet
Jun 29 04:39:45 nsfbrd 23214: 1d18h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 209.0.219.12(1706) (Serial0/0 DLCI 300) 
-> x.x.x.254(515), 1 packet
Jun 29 04:40:04 nsfbrd 23217: 1d18h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 209.0.219.12(3116) (Serial0/0 DLCI 300) 
-> x.x.x.128(515), 1 packet

Jeremy Sanders, CCNP CNE
Advanced Systems Engineer
New South Federal Savings Bank

> > > Vangelis Haniotakis <haniotak () ucnet uoc gr> 06/28/01 10:56AM >>>
On 28 Jun 2001, John Leach wrote:

> We've noticed a sudden influx of tcp 515 printer port scans over the
> last month on nearly all of our boxes (different sites, different isps)
>
> We *do* have a *really* good HP colour laserjet, I guess the word got
> out.

 Hmm, guess our printers must look tasty as well.

 We got hit by 3 different attackers today, all looking for port 515 on
random IP's. A total of about 60,000 probes launched towards all of our
class B network.

 Is this beginning to look a bit worrying?


--
Vangelis Haniotakis - Network & Communications Centre, University of Crete



----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com 




----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see:

http://aris.securityfocus.com