Re: odd worm (?) activity?

Charles Heselton <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]> 
On Fri, 10 Sep 2004 19:48:47 -0500, Chris Norton
<[email protected]> wrote:
> Just wondering if anyone has noticed any activity like this? This is all from the same IP address:
> 
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111xxx.:1450 -> 68.212.111.xxx:135, flags: SYN , seq:159470950 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1452 -> 68.212.111.xxx:1025, flags: SYN , seq:159504595 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1453 -> 68.212.111.xxx:445, flags: SYN , seq:159547845 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1454 -> 68.212.111.xxxx:6129, flags: SYN , seq:159599147 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxxx:1455 -> 68.212.111.xxx:139, flags: SYN , seq:159634329 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1456 -> 68.212.111.xxx:3410, flags: SYN , seq:159688821 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1457 -> 68.212.111.xxx:5554, flags: SYN , seq:159735284 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1458 -> 68.212.111.xxx:1433, flags: SYN , seq:159782567 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:35] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1459 -> 68.212.111.xxx:5000, flags: SYN , seq:159844021 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:36] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1480 -> 68.212.111.xxx:80, flags: SYN , seq:161072104 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1450 -> 68.212.111.xxx:135, flags: SYN , seq:159470950 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1454 -> 68.212.111.xxx:6129, flags: SYN , seq:159599147 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1457 -> 68.212.111.xxx:5554, flags: SYN , seq:159735284 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1452 -> 68.212.111.xxx:1025, flags: SYN , seq:159504595 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1455 -> 68.212.111.xxx:139, flags: SYN , seq:159634329 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1458 -> 68.212.111.xxx:1433, flags: SYN , seq:159782567 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1453 -> 68.212.111.xxx:445, flags: SYN , seq:159547845 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1456 -> 68.212.111.xxx:3410, flags: SYN , seq:159688821 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1459 -> 68.212.111.xxx:5000, flags: SYN , seq:159844021 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:38] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1480 -> 68.212.111.xxx:80, flags: SYN , seq:161072104 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1459 -> 68.212.111.xxx:5000, flags: SYN , seq:159844021 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1458 -> 68.212.111.xxx:1433, flags: SYN , seq:159782567 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1455 -> 68.212.111.xxx:139, flags: SYN , seq:159634329 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1452 -> 68.212.111.xxx:1025, flags: SYN , seq:159504595 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1457 -> 68.212.111.xxx:5554, flags: SYN , seq:159735284 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1454 -> 68.212.111.xxx:6129, flags: SYN , seq:159599147 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1450 -> 68.212.111.xxx:135, flags: SYN , seq:159470950 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1456 -> 68.212.111.xxx:3410, flags: SYN , seq:159688821 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1453 -> 68.212.111.xxx:445, flags: SYN , seq:159547845 ack:0, win:8760, tcplen:0
> [10/Sep/2004 18:35:44] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1480 -> 68.212.111.xxx:80, flags: SYN , seq:161072104 ack:0, win:8760, tcplen:0
> [10/Sep/2004 19:36:23] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1499 -> 68.212.111.xxx:135, flags: SYN , seq:2401699874 ack:0, win:8760, tcplen:0
> [10/Sep/2004 19:36:29] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1499 -> 68.212.111.xxx:135, flags: SYN , seq:2401699874 ack:0, win:8760, tcplen:0
> [10/Sep/2004 19:36:32] DROP "Default traffic rule" packet from Dial-Up, proto:TCP, len:48, ip/port:68.212.111.xxx:1499 -> 68.212.111.xxx:135, flags: SYN , seq:2401699874 ack:0, win:8760, tcplen:0
> <<snip>>
> 
> I would have just thought regular worm activity if the ports 80, 1433, and 6129 wasn't tossed in the mix. But this isn't a port scan either I don't believe as the box continues to check port 135 on my computer. I haven't seen a scan like this from any other IP except this one. Anyone have any clues they might can add to this?
> 
> --
> Chris Norton
> UAT Student Software Engineering Network Defense
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
> 

Just to take a wild guess, I would think that this is probably a bot
scan, possibly from a tool/worm like the Gaobot/Phatbot strain.  I
believe that this particular worm/bot scans for several attack
vectors, including those created by other worms.

There are more duplicated ports than just 135.  And all of the ports
are common worm backdoor ports.  Also, since the scan is sourced from
another system on the same subnet, it is likely that the "scanner" is
unaware of the infection.

-- 
Charlie Heselton
Network Security Engineer
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.