Re: [cobalt-users] Active System Attack Query

[Justin Seton-Browne <justin@xxxxxxxxxxxxxxxxxx>]

Port 111 is for RPC, and there are various attacks out there on the net 
that use vunerabilities to hit rpc.statd on unix platforms. I am getting 
many scans on this port and on 1080 (known firewall vunerabilities on this 
one) as well. I run utilities to stop these are they are detected.

check out the CERT Advisory below:
http://www.cert.org/advisories/CA-2000-17.html

Justin

At 01:09 PM 3/13/01, you wrote:

> I'm in the process of compiling a standard email to be sent to
> the owners of the IP's that scan me. I realize that theor systems
> may have been taken over but at least they should be informed.
>
> (One of the Haqr's (I jst luv that !!)  had an IP that traced to Ulan Bator,
> outer Mongolia !?!?!?
>
> I am currently getting 1 or 2 scans a day - always to TCP Port 111
> Does anyone know what they are trying and why this port ?
>
> Blessings
> Revd Leonard