Re: [cobalt-users] Active System Attack Query

["Jonathan Michaelson" <michaelsonjd@xxxxxxxxxxx>]

> > So we're basically talking real hacking attempts to use recent exploits
> > found in rpc.statd and rpc.mountd to name but two.
> >
> IIRC, neither of which are standard on the RaQ.

Correct, which is why PortSentry is able to bind to those ports and report
the attempts. This just shows how the attempts are either automated or from
s'kiddies who trawl domains/ip addresses looking for potential
vulnerabilities.

As has been said before, you should see PortSentry as a Wake Up call, not a
solution, and check what else they may have been attempting. Then it's the
long haul to reporting them to their provider and getting someone to respond
positively.

Regards,
Jonathan Michaelson