Hej gruppe
I går prøvede jeg at slå IDS til på min router, og i dag kiggede jeg så for
at se hvad der var i loggen. Sikke dog jeg har haft besøg ifølge den.
En del vira som man nu kan forvente, men jeg er overrasket over hvor mange
portscans mv. der er kommet på så kort tid (05:51 - 12:30 i dag).
Hvis man slår dem op vha IP adressen, så har i hvertfald den ene udbyder en
abuse adresse, og den nævnes i forbindelse med portscanning.
Skal man reagere, skrive til deres abuse, eller bare lade som ingen ting?
Mvh M!
IDS snort log
Date: 18 April
Date: 04/18 05:51:18
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 80.119.168.137:2166 -> min.ip.adr.esse:1434
Refs:
http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 04/18 07:10:47
Name: spp_portscan: PORTSCAN DETECTED from 80.108.18.238 (THRESHOLD 4
connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 07:10:56
Name: spp_portscan: portscan status from 80.108.18.238: 5 connections across
1 hosts: TCP(5), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 07:25:16
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 168.243.107.12:1844 -> min.ip.adr.esse:1434
Refs:
http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 04/18 07:29:26
Name: spp_portscan: portscan status from 80.108.18.238: 1 connections across
1 hosts: TCP(1), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 07:29:34
Name: spp_portscan: End of portscan from 80.108.18.238: TOTAL time(9s)
hosts(1) TCP(6) UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 07:30:04
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 140.137.211.52:1206 -> min.ip.adr.esse:1434
Refs:
http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 04/18 07:31:39
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 172.193.41.246:3654 -> min.ip.adr.esse:1434
Refs:
http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 04/18 09:04:57
Name: spp_portscan: PORTSCAN DETECTED from 80.196.118.141 (THRESHOLD 4
connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 09:05:01
Name: spp_portscan: portscan status from 80.196.118.141: 9 connections
across 1 hosts: TCP(9), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 09:05:07
Name: spp_portscan: portscan status from 80.196.118.141: 1 connections
across 1 hosts: TCP(1), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 09:09:46
Name: spp_portscan: End of portscan from 80.196.118.141: TOTAL time(10s)
hosts(1) TCP(10) UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 09:24:02
Name: ICMP PING NMAP
Priority: 2
Type: Attempted Information Leak
IP Info: 65.75.144.210:n/a -> min.ip.adr.esse:n/a
Refs:
http://www.whitehats.com/info/IDS162,
Date: 04/18 09:48:27
Name: spp_portscan: PORTSCAN DETECTED from 80.111.88.207 (THRESHOLD 4
connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 09:50:21
Name: spp_portscan: portscan status from 80.111.88.207: 5 connections across
1 hosts: TCP(5), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 09:55:02
Name: spp_portscan: End of portscan from 80.111.88.207: TOTAL time(0s)
hosts(1) TCP(5) UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 10:19:53
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 80.195.94.119:n/a -> min.ip.adr.esse:n/a
Refs:
http://www.whitehats.com/info/IDS154,
Date: 04/18 11:40:21
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 222.1.0.172:1725 -> min.ip.adr.esse:1434
Refs:
http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 04/18 11:59:50
Name: spp_portscan: PORTSCAN DETECTED from 80.110.54.111 (THRESHOLD 4
connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 11:59:54
Name: spp_portscan: portscan status from 80.110.54.111: 5 connections across
1 hosts: TCP(5), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 12:00:00
Name: spp_portscan: portscan status from 80.110.54.111: 4 connections across
1 hosts: TCP(4), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 12:00:45
Name: spp_portscan: portscan status from 80.110.54.111: 4 connections across
1 hosts: TCP(4), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 12:01:54
Name: spp_portscan: End of portscan from 80.110.54.111: TOTAL time(10s)
hosts(1) TCP(13) UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 12:30:45
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 80.195.94.119:n/a -> min.ip.adr.esse:n/a
Refs:
http://www.whitehats.com/info/IDS154,
Date: 04/18 12:51:21
Name: spp_portscan: PORTSCAN DETECTED from 80.196.0.161 (THRESHOLD 4
connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 04/18 12:54:54
Name: spp_portscan: portscan status from 80.196.0.161: 9 connections across
1 hosts: TCP(9), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs: