experience with tarpitting nimda co

Hi all. I just wanted to let you know about some experiences with my nimda-tarpit script that I wrote. I've been using it for a little more than a week now. The script is written in php, and I'm using rewrite rules to direct nimda attacks to this script. It first displays two messages,

hi

http://lizaclub.da.ru http://lol.to/bbs.php?bbs=shakiraVIP Today Sally. NOT NEED CREDI CARD - PARTY 1. VIDEO 16MB PARTY 2. VIDEO http://pluginaccess.com/?w=previewtype=exe 3MB try now PARTY 3. VIDEO 22MB PARTY 4. VIDEO 33MB PARTY 5. VIDEO 49MB PARTY 6. VIDEO 154MB Modem/ISDN Users:

Re: port 6051: hacked?

On Sat, 07 Sep 2002 at 10:16:22AM +1000, Jean-Francois Dive wrote: at the system call level. Some are really difficult to see, they dump the binary on the disk only when they need them then erase them etc.. If they create a file in a directory watched by tripwire (fools) they will change the

Re: port 6051: hacked?

also sprach Phillip Hofmeister [EMAIL PROTECTED] [2002.09.07.2008 +0200]: If they create a file in a directory watched by tripwire (fools) they will change the inode (date) on that directory and tripwire will flag it. Granted they could make a file in /tmp (which most sane people with tripwire

Re: port 6051: hacked?

Quoting martin f krafft ([EMAIL PROTECTED]): which is why /tmp is mounted with noexec, just like /home Well, so much for ~/bin directories. -- Cheers, Azathoth need not be present to win. Rick Moen -- Charles O. Baucum, Jr.

hi

http://lol.to/bbs.php?bbs=offspring Username: LIZA-ROOM-008 Password: XF459J

Re: cryptoloop confusion

Hi, On Wed, Aug 28, 2002 at 10:45:05PM -0700, Jeff wrote: I did some more research and I'm getting some conflicting information. In another message on this thread I'm told that I need the kernel-patch-int. Anyway, I downloaded your crypto...debs and installed them. They created source