 |
 |
On Monday 18 October 2004 15:51, Lee Duynslager wrote: > Has anybody out there been seeing scans of port 445 from machines on > campus? > > Oct 17 13:52:37 myhostname [2370]: attackalert: TCP SYN/Normal scan from > host: haydn.cse.msu.edu/35.9.26.157 to TCP port: 445 > > From what I understand this is an attempt to test for then exploit > avulnerability. > > 1. Anybody know the specifics on this? > > 2. Isn't scanning other departments machines without their consent > against Acceptable Use Policy? > > Lee Duynslager Well, yes it is, but we're dealing with zombied machines, not humans. This doesn't make it right, but it does mean that there can be hundreds to thousands of them out there. There are a LOT of things that scan on port 445, so there isn't any one or two exploits out there that cause this. Me, I'd try to contact the person responsible for the machines and let them know that they have compromised machines in all likelyhood. The number of zombied WIndows machines out in the world is a big problem. --STeve Andre'