Re: FTP Bounce scan

Oops... *shame on me* Just noticed that source.rfc822.org -> ftp2.de.debian.org (switched to that one because ftp.de.debian.org seemed down) It must have been apt-get update that tried to use active FTP which got blocked by the firewall and logged by snort... Excuse me for waisting every

FTP Bounce scan

Today, I saw in the snort logs the following: (removed ip & date to get it in 78-col format) 193.189.224.13:21 -> ip:58153 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42940 -> ip:113 SYN 12S* RESERVEDBITS 193.189.224.13:42941 -> ip:58154 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42942 -

Re: FTP Bounce scan

Oops... *shame on me* Just noticed that source.rfc822.org -> ftp2.de.debian.org (switched to that one because ftp.de.debian.org seemed down) It must have been apt-get update that tried to use active FTP which got blocked by the firewall and logged by snort... Excuse me for waisting ever

FTP Bounce scan

Today, I saw in the snort logs the following: (removed ip & date to get it in 78-col format) 193.189.224.13:21 -> ip:58153 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42940 -> ip:113 SYN 12S* RESERVEDBITS 193.189.224.13:42941 -> ip:58154 UNKNOWN *2*A**S* RESERVEDBITS 193.189.224.13:42942

Portsentry & iptables

After noticing some more portscans (fast, even in order - nice snort logs though) I remembered portsentry. Thanks to debian's apt-get I didn't take long to install & check it out of course. I noticed in standard-mode, it binds to some ports and just waits until somebody connects to them. The d

Portsentry & iptables

After noticing some more portscans (fast, even in order - nice snort logs though) I remembered portsentry. Thanks to debian's apt-get I didn't take long to install & check it out of course. I noticed in standard-mode, it binds to some ports and just waits until somebody connects to them. The

Re: I've been hacked by DevilSoul

On 13 Jan 2002, Florian Weimer wrote: > Henrique de Moraes Holschuh <[EMAIL PROTECTED]> writes: > > > On Fri, 11 Jan 2002, Ricardo B wrote: > > > Isn't there a way to turn module loading off (a way that can't be chagend > > > back - without rebooting) ? > > > > None that cannot be undone if you'

Re: I've been hacked by DevilSoul

On 13 Jan 2002, Florian Weimer wrote: > Henrique de Moraes Holschuh <[EMAIL PROTECTED]> writes: > > > On Fri, 11 Jan 2002, Ricardo B wrote: > > > Isn't there a way to turn module loading off (a way that can't be chagend > > > back - without rebooting) ? > > > > None that cannot be undone if you

Re: I've been hacked by DevilSoul

On Sat, 12 Jan 2002, Richard wrote: > > On Fri, Jan 11, 2002 at 10:25:03PM +0100, martin f krafft wrote: > > > > > > i doubt that a kernel module can override the linux kernel filesystem > > > abstraction layer. but i guess it could be possible. > > > > > > > Oh, it certainly can! knark is a p

Re: I've been hacked by DevilSoul

On Sat, 12 Jan 2002, Richard wrote: > > On Fri, Jan 11, 2002 at 10:25:03PM +0100, martin f krafft wrote: > > > > > > i doubt that a kernel module can override the linux kernel filesystem > > > abstraction layer. but i guess it could be possible. > > > > > > > Oh, it certainly can! knark is a

Deducing key from encrypted & original data

Hi, this is something I've been wondering for some time now: Is it possible (or at least much easier) to extract the encryption key if you both have the encrypted and original data? Dries PS. I know it isn't debian-related, but it's a good question anyway...

Deducing key from encrypted & original data

Hi, this is something I've been wondering for some time now: Is it possible (or at least much easier) to extract the encryption key if you both have the encrypted and original data? Dries PS. I know it isn't debian-related, but it's a good question anyway... -- To UNSUBSCRIBE, email