 Link LoggerPremium,MVM
join:2001-03-29
Calgary, AB
kudos:3
 ·Shaw
| reply to Link Logger
Re: Beware Attacks on TCP port 1433 OK so our script kiddie is branching out as yesterday we picked up another MSSQL Hello Buffer Overflow Attack from 217.226.102.87 (note this address is very close to 217.236.27.93 recorded above - dialup accounts in Germany so its possibly the same system). So after trying the SQL Attack 49 times then he goes for open shares on ports 139 and 445, to bad the firewall bounced him. Next time I'll have to watch for him, so I can play with his mind a bit while sending him back some crafted packets.
Dec 31, 2003 16:27:27.692 - (TCP) 217.226.102.87 : 4006 >>> 68.144.128.104 : 1433 SQL Server Scan
Dec 31, 2003 16:27:28.062 - (TCP) 217.226.102.87 : 4015 >>> 68.144.128.104 : 1433 SQL Server Scan
Dec 31, 2003 16:27:38.958 - (TCP) 217.226.102.87 : 4128 >>> 68.144.128.104 : 1433 SQL Server Scan
Dec 31, 2003 16:27:49.864 - (TCP) 217.226.102.87 : 4226 >>> 68.144.128.104 : 1433 SQL Server Scan
-- chop chop chop in the interest of saving electrons --
Dec 31, 2003 16:28:27.057 - (TCP) 217.226.102.87 : 4572 >>> 68.144.128.104 : 1433 SQL Server Scan
Dec 31, 2003 16:28:27.828 - (TCP) 217.226.102.87 : 4577 >>> 68.144.128.104 : 445 SQL Server Scan
Dec 31, 2003 16:28:27.848 - (TCP) 217.226.102.87 : 1043 >>> 68.144.128.104 : 139 SQL Server Scan
Dec 31, 2003 16:28:28.219 - (TCP) 217.226.102.87 : 4582 >>> 68.144.128.104 : 1433 SQL Server Scan
Dec 31, 2003 16:28:30.762 - (TCP) 217.226.102.87 : 4577 >>> 68.144.128.104 : 445 SQL Server Scan
Dec 31, 2003 16:28:30.783 - (TCP) 217.226.102.87 : 1043 >>> 68.144.128.104 : 139 SQL Server Scan
Dec 31, 2003 16:28:36.701 - (TCP) 217.226.102.87 : 1043 >>> 68.144.128.104 : 139 SQL Server Scan
Dec 31, 2003 16:28:36.791 - (TCP) 217.226.102.87 : 4577 >>> 68.144.128.104 : 445 SQL Server Scan
I guess even script kiddies get tired of hitting their head against the same brick. I wonder what he will try next?
Blake
--
Vendor: Firewall Logging Software »www.SonicLogger.com - SonicWall and 3Com »www.LinkLogger.com - Linksys, Netgear and Zyxel |
