psloss
Premium
join:2002-02-24
Alpharetta, GA
| reply to Link Logger
Re: Messenger Spam on 1026 - Bad News Kids
said by Link Logger  :
Today my interest in the recent flood of UDP port 1026 drove me to write PortPuker, which allows me to take captures from PortPeeker and bring them into the lab where I can conduct some experiments on the traffic in question.
This has been discussed a lot recently and someone pointed out a LURHQ advisory from the June timeframe:
»www.lurhq.com/popup_spam.html
Also, spammers are also beginning to send messages to UDP port 1027. I have also seen stray packets to UDP port 1028.
Lawrence Baldwin and I recently modified the myNetWatchman WinPopup tester to send messages to both the endpoint mapper UDP port, 135, and also to UDP ports 1025-1029, inclusive:
»Update: Windows Messenger Spam
Hopefully, this is a more realistic test of what is happening now.
Philip Sloss
--
(Thanks, anonymous!) Feedback? e-mail: stuff@lupwa.org |
