FTP Bounce scan

Today, I saw in the snort logs the following: (removed ip date to get it in 78-col format) 193.189.224.13:21 - ip:58153 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42940 - ip:113 SYN 12S* RESERVEDBITS 193.189.224.13:42941 - ip:58154 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42942 -

Re: FTP Bounce scan

Oops... *shame on me* Just noticed that source.rfc822.org - ftp2.de.debian.org (switched to that one because ftp.de.debian.org seemed down) It must have been apt-get update that tried to use active FTP which got blocked by the firewall and logged by snort... Excuse me for waisting

FTP Bounce scan

Today, I saw in the snort logs the following: (removed ip date to get it in 78-col format) 193.189.224.13:21 - ip:58153 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42940 - ip:113 SYN 12S* RESERVEDBITS 193.189.224.13:42941 - ip:58154 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42942 -

Re: FTP Bounce scan

Oops... *shame on me* Just noticed that source.rfc822.org - ftp2.de.debian.org (switched to that one because ftp.de.debian.org seemed down) It must have been apt-get update that tried to use active FTP which got blocked by the firewall and logged by snort... Excuse me for waisting

Portsentry iptables

After noticing some more portscans (fast, even in order - nice snort logs though) I remembered portsentry. Thanks to debian's apt-get I didn't take long to install check it out of course. I noticed in standard-mode, it binds to some ports and just waits until somebody connects to them. The

Portsentry iptables

After noticing some more portscans (fast, even in order - nice snort logs though) I remembered portsentry. Thanks to debian's apt-get I didn't take long to install check it out of course. I noticed in standard-mode, it binds to some ports and just waits until somebody connects to them. The

Re: I've been hacked by DevilSoul

On 13 Jan 2002, Florian Weimer wrote: Henrique de Moraes Holschuh [EMAIL PROTECTED] writes: On Fri, 11 Jan 2002, Ricardo B wrote: Isn't there a way to turn module loading off (a way that can't be chagend back - without rebooting) ? None that cannot be undone if you're root in a

Re: I've been hacked by DevilSoul

On 13 Jan 2002, Florian Weimer wrote: Henrique de Moraes Holschuh [EMAIL PROTECTED] writes: On Fri, 11 Jan 2002, Ricardo B wrote: Isn't there a way to turn module loading off (a way that can't be chagend back - without rebooting) ? None that cannot be undone if you're root in a

Re: I've been hacked by DevilSoul

On Sat, 12 Jan 2002, Richard wrote: On Fri, Jan 11, 2002 at 10:25:03PM +0100, martin f krafft wrote: i doubt that a kernel module can override the linux kernel filesystem abstraction layer. but i guess it could be possible. Oh, it certainly can! knark is a perfect example

Re: I've been hacked by DevilSoul

On Sat, 12 Jan 2002, Richard wrote: On Fri, Jan 11, 2002 at 10:25:03PM +0100, martin f krafft wrote: i doubt that a kernel module can override the linux kernel filesystem abstraction layer. but i guess it could be possible. Oh, it certainly can! knark is a perfect example of

Deducing key from encrypted original data

Hi, this is something I've been wondering for some time now: Is it possible (or at least much easier) to extract the encryption key if you both have the encrypted and original data? Dries PS. I know it isn't debian-related, but it's a good question anyway... -- To UNSUBSCRIBE, email

Deducing key from encrypted original data

Hi, this is something I've been wondering for some time now: Is it possible (or at least much easier) to extract the encryption key if you both have the encrypted and original data? Dries PS. I know it isn't debian-related, but it's a good question anyway...