Search:  

 
theme to black backgroundlet page decide theme
HomeFind ServiceReviewsISP NewsFAQsForumsToolsDatabaseAbout 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » Messenger Spam on 1026 - Bad News Kids
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal
Should still use a software firewall with a router »
« Netstat Prompt Results - What does this mean?  
psloss
Premium
join:2002-02-24
Alpharetta, GA

Re: Messenger Spam on 1026 - Bad News Kids

said by Link Logger See Profile:
I would be willing to bet that filtering of UDP port 135 (how many ISP are filtering UDP port 135, as compared to TCP port 135) was just a small factor in spammers switching to this new method, as the real motivator is out and out performance. As you mentioned yourself we have seen this traffic before MSBlast came out so spammers were switching before UDP port 135 filtering started. ISP's will be unable to filter UDP port 1026 traffic so once again the bad guys ultimately win out in the end, because they are free to adapt.
Good point about the filtering, although I'm not sure what you mean by "performance"...the mechanics of sending the packet to one port versus another (or multiple ports) seems fairly similar...what do you mean by "performance?"

Thanks,

Philip Sloss
--
(Thanks, anonymous!) Feedback? e-mail: stuff@lupwa.org
permalink · 2003-09-16 14:24:59 · Print · Reply to this

Link Logger
Premium,MVM
join:2001-03-29
Calgary, AB
·Shaw

Re: Messenger Spam on 1026 - Bad News Kids

For an example of performance, to send a spam message via Net Send it might take a couple of seconds to send a message, but by using this new technique you can send several thousands of messages per second given the availability of bandwidth and CPU. So we are talking many orders of magnitude of performance increase by using this new method and hence why this traffic is increasing on suspected Services.exe ports as spammers let lose with a much faster gatling gun, as they are no longer limited by performance factors they do not control as with using Net Send.

Blake
--
»www.SonicLogger.com - Logging Software for SonicWall and 3Comhttp://www.LinkLogger.com - Logging Software for Linksys, Netgear and Zyxel
permalink · 2003-09-16 14:42:27 · Print · Reply to this
Forums » Up and Running » Security » SecurityShould still use a software firewall with a router »
« Netstat Prompt Results - What does this mean?  

Wednesday, 02-Dec 01:42:04 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.republican-creole
page compression OFF
Most commented news this week
· [140] Comcast Releasing Promised Usage Meter
· [69] Baltimore To Ban Lazy Cable Installs
· [56] Broadband Killed The Game Console
· [53] Latest Consumer Reports Survey Not Kind To AT&T
· [50] Rogers Unveils The ISP Dream Model
· [41] Rural Carriers Quickly Embracing Fiber
· [37] ACTA: Global Three Strikes
· [35] Charter Exits Chapter 11
· [33] AT&T Top Lobbyist Cicconi Has His Feelings Hurt
· [25] Vivendi Agrees, Comcast/NBC Deal Soon
Most people now reading
· Download speeds very slow. [AT&T West]
· IMG 1.7 (IMG Updates and Discussion) [Verizon FIOS TV]
· 16% packet loss. damn dsl. los angeles [AT&T West]
· netTalk tk6000 [VOIP Tech Chat]
· Considering Leaving Vonage, who should I Consider? [VOIP Tech Chat]
· [Newsgroups] Newzleech down? [Filesharing Software]
· [Snow Leopard] NFS Mounts - no more Directory Utility [All Things Macintosh]
· Windows 7 boot manager editing questions [Microsoft Help]
· Connecting to Google Voice Via SIP [VOIP Tech Chat]
· [Equipment] Tomato with VOIP warning [VOIP Tech Chat]