Unfortunately, completely no light in details. Here they are: ====================================== :Auth Level 6 :Auth Type 14 :intruder-ip-addr x.x.x.79 :intruder-port 4473 :UUID 000001a0-0000-0000-c000-000000000046 :victim-ip-addr x.x.x.154 :victim-port 135 algorithm-id 3118019 IANAProtocolId 6 Packet DestinationAddress x.x.x.154 Packet DestinationPort 135 Packet DestinationPortName epmap Packet SourceAddress x.x.x.79 Packet SourcePort 4473 ======================================
About application used DCOM, - I don't know exactly. Can DCOM be used in network printing? Where can I read something about encryption? In microsoft.com? Where? Thank you. --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 495 745 89 50 tel +7 495 777 77 07 (1613) > -----Original Message----- > From: Robert Graham [mailto:[EMAIL PROTECTED] > Sent: Tuesday, January 30, 2007 11:12 PM > To: Soldatov, Sergey V.; [email protected] > Subject: Re: [ISSForum] MSRPC_SuspiciousEncryption events > > --- "Soldatov, Sergey V." <[EMAIL PROTECTED]> wrote: > > Our NS 7.0 detects tons of MSRPC_SuspiciousEncryption > events from one > > desktop to another. > > > > Suspicious UUID that I see is 000001a0-0000-0000-c000-000000000046. > > > > So, my questions are: > > - Where can I find description of > > 000001a0-0000-0000-c000-000000000046 interface (now I know > only that > > its name is ISystemActivator)? > > - Where is this interface used? Can it be used in Microsoft > > Network Printing? What for it was developed? > > - Can this interface be used between two workstations (not between > > workstation and server)? On what conditions? In which cases? > > The interface is one of those used in the Blaster worm. Newer > attack tools for that old vulnerability will try to encrypt > the data in order to evade the IDS. > ISS currently believes that no legitimate use of the > ISystemActivator interface would use encryption, but that > could be in error. > > The interface is used in Microsoft's DCOM to initiate > communication between two applications. Do you have DCOM > applications running on those workstations that are supposed > to talk to each other? > > There should be more "event details" with the event that > might shed some light on the matter. > > > > > > > ______________________________________________________________ > ______________________ > Bored stiff? Loosen up... > Download and play hundreds of games for free on Yahoo! Games. > http://games.yahoo.com/games/front > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
