Re: Fw: Hack Attack - Let's guess mail file names (in Domino).

"tim the Enchanter" <[email protected]> Mon, 27 Oct 2008 14:40:02 +0100
Newsgroups gmane.comp.systems.as400.security
Message-ID <[email protected]>
It makes one wonder what would have happened if a suitable mailbox was
found. Maybe something new?

And yes, it looks like an "out of the box" security scan. :)

Lucien

On Mon, Oct 27, 2008 at 2:15 PM, <ChadB-wiCRs0dFRMj+7NiPasB1ylaTQe2KTcn/@public.gmane.org> wrote:

>
> Looks like the types of log entries you'll get from certain 'security scan'
> type software packages or tools.  Any possibility your network group was
> doing some vulnerability testing?  If not, looks like you got scanned by
> someone 'outside'!
>
>
>
>
>             [email protected]
>             Sent by:
>             security400-bounc                                          To
>             es-Zwy7GipZuJhWk0Htik3J/[email protected]           security400-Zwy7GipZuJhWk0Htik3J/[email protected]
>                                                                        cc
>
>             10/27/2008 09:08                                      Subject
>             AM                        [Security400] Fw: Hack Attack -
>                                       Let's guess mail file names (in
>                                       Domino).
>             Please respond to
>                 Security
>             Administration on
>                the AS400 /
>                  iSeries
>             <security400@midr
>                 ange.com>
>
>
>
>
>
>
> Rob Berendt
> --
> Group Dekko Services, LLC
> Dept 01.073
> Dock 108
> 6928N 400E
> Kendallville, IN 46755
> http://www.dekko.com
>
>
> ----- Forwarded by Rob Berendt/DEKKO on 10/27/2008 09:06 AM -----
>
> [email protected]
> Sent by: domino400-bounces+rob=dekko.com-Zwy7GipZuJhWk0Htik3J/[email protected]
> 10/27/2008 09:03 AM
> Please respond to
> Lotus Domino on the iSeries / AS400 <domino400-Zwy7GipZuJhWk0Htik3J/[email protected]>
>
>
> To
> domino400-Zwy7GipZuJhWk0Htik3J/[email protected]
> cc
>
> Subject
> Hack Attack - Let's guess mail file names.
>
>
>
>
>
>
> I am noticing a lot of these in our Sametime server in the DMZ.
> 10/27/2008 02:07:33   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/root.nsf]
> 10/27/2008 02:07:33   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/router.nsf]
> 10/27/2008 02:07:33   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/rw.nsf]
> 10/27/2008 02:07:33   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/rz0plm92.nsf]
> 10/27/2008 02:07:33   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sam.nsf]
> 10/27/2008 02:07:34   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sa.nsf]
> 10/27/2008 02:07:34   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sap.nsf]
> 10/27/2008 02:07:34   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/security.nsf]
> 10/27/2008 02:07:34   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/service.nsf]
> 10/27/2008 02:07:34   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/setup.nsf]
> 10/27/2008 02:07:34   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sgiweb.nsf]
> 10/27/2008 02:07:35   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/shutdown.nsf]
> 10/27/2008 02:07:35   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/signa.nsf]
> 10/27/2008 02:07:35   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/soft.nsf]
> 10/27/2008 02:07:35   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/software.nsf]
> 10/27/2008 02:07:35   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sqldba.nsf]
> 10/27/2008 02:07:36   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sqluser.nsf]
> 10/27/2008 02:07:36   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/student.nsf]
> 10/27/2008 02:07:36   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/supervisor.nsf]
> 10/27/2008 02:07:36   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/support.nsf]
> 10/27/2008 02:07:39   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sync.nsf]
> 10/27/2008 02:07:39   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sys.nsf]
> 10/27/2008 02:07:40   HTTP Web Server: Lotus Notes Exception - File does
> not exist [/mail/sysadm.nsf]
>
> Rob Berendt
> --
> Group Dekko Services, LLC
> Dept 01.073
> Dock 108
> 6928N 400E
> Kendallville, IN 46755
> http://www.dekko.com
>
> _______________________________________________
> This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list
> To post a message email: Domino400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/domino400
> or email: Domino400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/domino400.
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400)
> mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
>
>
>
> _____________________________________________________________________________
>
> Scanned by IBM Email Security Management Services powered by MessageLabs.
> For more information please visit http://www.ers.ibm.com
>
> _____________________________________________________________________________
>
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400)
> mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
>
>
>
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.