Re: [Security400] Fw: Hack Attack - Let's guess mail file names (in Domino).
[email protected] Mon, 27 Oct 2008 09:50:18 -0400
| Newsgroups | gmane.comp.systems.as400.domino,gmane.comp.systems.as400.security |
|---|---|
| Message-ID | <OFE3A2F524.AA444AAB-ON852574EF.004B8A8D-852574EF.004C04A6@dekko.com> |
You're right. I found out it was from benevolent hacking from IBM that my boss has a contract for. Those messages were the "good" messages. Apparently there is a lot of databases out there that have anonymous access that they let us know so we can make a decision as to whether or not this concerns us. Among them is names.nsf and several others. "IMPACT: Unauthorized users can gather sensitive information, such as authentication certificates for users, custom database names, logfiles and schedules, by stealing the database." Rob Berendt -- Group Dekko Services, LLC Dept 01.073 Dock 108 6928N 400E Kendallville, IN 46755 http://www.dekko.com ChadB-wiCRs0dFRMj+7NiPasB1ylaTQe2KTcn/@public.gmane.org Sent by: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] 10/27/2008 09:36 AM Please respond to Security Administration on the AS400 / iSeries <security400-Zwy7GipZuJhWk0Htik3J/[email protected]> To Security Administration on the AS400 / iSeries <security400-Zwy7GipZuJhWk0Htik3J/[email protected]> cc Subject Re: [Security400] Fw: Hack Attack - Let's guess mail file names (in Domino). Looks like the types of log entries you'll get from certain 'security scan' type software packages or tools. Any possibility your network group was doing some vulnerability testing? If not, looks like you got scanned by someone 'outside'! [email protected] Sent by: security400-bounc To es-Zwy7GipZuJhWk0Htik3J/[email protected] security400-Zwy7GipZuJhWk0Htik3J/[email protected] cc 10/27/2008 09:08 Subject AM [Security400] Fw: Hack Attack - Let's guess mail file names (in Domino). Please respond to Security Administration on the AS400 / iSeries <security400@midr ange.com> Rob Berendt -- Group Dekko Services, LLC Dept 01.073 Dock 108 6928N 400E Kendallville, IN 46755 http://www.dekko.com ----- Forwarded by Rob Berendt/DEKKO on 10/27/2008 09:06 AM ----- [email protected] Sent by: domino400-bounces+rob=dekko.com-Zwy7GipZuJhWk0Htik3J/[email protected] 10/27/2008 09:03 AM Please respond to Lotus Domino on the iSeries / AS400 <domino400-Zwy7GipZuJhWk0Htik3J/[email protected]> To domino400-Zwy7GipZuJhWk0Htik3J/[email protected] cc Subject Hack Attack - Let's guess mail file names. I am noticing a lot of these in our Sametime server in the DMZ. 10/27/2008 02:07:33 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/root.nsf] 10/27/2008 02:07:33 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/router.nsf] 10/27/2008 02:07:33 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/rw.nsf] 10/27/2008 02:07:33 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/rz0plm92.nsf] 10/27/2008 02:07:33 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sam.nsf] 10/27/2008 02:07:34 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sa.nsf] 10/27/2008 02:07:34 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sap.nsf] 10/27/2008 02:07:34 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/security.nsf] 10/27/2008 02:07:34 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/service.nsf] 10/27/2008 02:07:34 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/setup.nsf] 10/27/2008 02:07:34 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sgiweb.nsf] 10/27/2008 02:07:35 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/shutdown.nsf] 10/27/2008 02:07:35 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/signa.nsf] 10/27/2008 02:07:35 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/soft.nsf] 10/27/2008 02:07:35 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/software.nsf] 10/27/2008 02:07:35 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sqldba.nsf] 10/27/2008 02:07:36 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sqluser.nsf] 10/27/2008 02:07:36 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/student.nsf] 10/27/2008 02:07:36 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/supervisor.nsf] 10/27/2008 02:07:36 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/support.nsf] 10/27/2008 02:07:39 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sync.nsf] 10/27/2008 02:07:39 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sys.nsf] 10/27/2008 02:07:40 HTTP Web Server: Lotus Notes Exception - File does not exist [/mail/sysadm.nsf] Rob Berendt -- Group Dekko Services, LLC Dept 01.073 Dock 108 6928N 400E Kendallville, IN 46755 http://www.dekko.com _______________________________________________ This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list To post a message email: Domino400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/domino400 or email: Domino400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/domino400. _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400. _____________________________________________________________________________ Scanned by IBM Email Security Management Services powered by MessageLabs. For more information please visit http://www.ers.ibm.com _____________________________________________________________________________ _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400. _______________________________________________ This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list To post a message email: Domino400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/domino400 or email: Domino400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/domino400.