RE: Interesting development using tcpdumpinconjunctionwith SQUID filtering and thiis hostname-bubba.scps.k12.fl.us

>From: "David McCall" <[email protected]>
>Reply-To: "Intrusions List (GCIA Practicals)" <[email protected]>
>To: "Intrusions List (GCIA Practicals)" <[email protected]>
>Subject: RE: [Intrusions] Interesting development using 
>tcpdumpinconjunctionwith SQUID filtering and thiis 
>hostname-bubba.scps.k12.fl.us
>Date: Fri, 28 Jan 2005 07:16:25 -0800
>
>Thanks for the advice,
>
>after watching them for a 2nd day, and seeing them disappear from the
>net for about 38 min. (seeing my hit rate go way down), and reappear
>will full force I did consider contacting them.  But finally they have
>vanished from the logs entirely.  Good sign.
>
>
>Oh,  and yes, the attacks sill continue.
>
>I'm surprised we haven't seen anything from the reverse engineering/virus
>killing/Symantic-Mckfee-ISS-and community friends about this thing.  I've
>got to still call it a thing cause it's not threatening enough for the
>global internet community to even bother a look or a comment (watch, just
>after I make the icky remark - someone will hunt me down and tie my shoes
>together)..
>
>todays snipplet:
>
>1106925023.432     23 68.217.248.169 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925038.826     58 65.149.15.193 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925043.249      0 136.142.163.163 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925074.765      0 68.255.162.186 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925094.499      3 85.65.90.221 TCP_DENIED/403 432 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925096.949      4 138.89.60.182 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925112.126     12 65.11.90.193 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925153.346      5 64.222.111.71 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925170.129     20 68.211.91.158 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925171.576      0 208.251.77.28 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>1106925191.636     65 172.160.226.197 TCP_DENIED/403 427 GET 
>http://mpecllc.com/robots.txt - NONE/- text/html
>
>By the way, for some reason our network engineer decided to zero out the 
>untrusted file on Monday which
>had reached about 56,000 + blocked IP numbers. So heres the count today:
>
>wc -l /etc/untrusted
>    33563 /etc/untrusted
>root:/var/squid/logs:5#
>
>And I also want to mention that Verio & Global Crossing have been 
>exlemplary in taking care of their specific
>IP blocks of possible infected machines....this was nice to see from an 
>admins point of view.
>
>David C.McCall
>UNIX Administrator
>===================
>EschelonTelecom
>[email protected]
>[email protected]
>
>
>David McCall wrote Tuesday, January 25, 2005 11:47 AM
>
> > The IP for bubba doesn't appear in the untrusted list and after each new
> > IP the appears in the SQUID list something gets sent to bubba,........
>
>Have you looked through the SQUID logs for the seemingly legitimate queries
>that bubba is making, corresponding with the new DoS bots and the tcpdump
>records? Is it just asking for the same page over and over? Is it trying to
>do something naughty that did not trigger any previous alarms?
>
>Florida k12 schools do have overworked security people who go around taking
>care of problems, and have some experience with botnets etc. A phone call 
>to
>them might get your problem to the top of their list if there is a strong
>correlation with the drones or if the k12 host is trying something 
>obviously
>wrong.
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions
>
>
>!DSPAM:41fa4ee2256126449014439!
>
>
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions




If i get just 1 your spam mail i swer that i will hack into ur pc or company 
no mather
i will use many hacking methods.
Methods like:netbios hacking,google hacking,social engeniring,box 
hacking,telnet hacking...
What ever takes.
So time to choose its time to choose.

Twisted Ev!L sez:God has created earth in 7 days and ur computer will be 
crashed in 7 days.

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar - get it now! 
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions