<HTML><BODY STYLE="font:10pt verdana; border:none;"><DIV>Looks like FlexNet (<A href="http://www.flex.com">http://www.flex.com</A>) webpage has been "hacked" </DIV> <DIV> </DIV> <BLOCKQUOTE style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px"> <DIV style="FONT: 10pt Arial">----- Original Message -----</DIV> <DIV style="BACKGROUND: #e4e4e4; FONT: 10pt Arial; COLOR: black"><B>From:</B> Dusty</DIV> <DIV style="FONT: 10pt Arial"><B>Sent:</B> Saturday, July 28, 2001 4:10 PM</DIV> <DIV style="FONT: 10pt Arial"><B>To:</B> Linux & Unix Advocates & Users</DIV> <DIV style="FONT: 10pt Arial"><B>Subject:</B> [luau] more attacks</DIV> <DIV> </DIV>Well someone tried another MS exploit on the OpenBSD again last night. This time it was the Win2K NULL.printer exploit. Log looks like this:<BR><BR>66.24.106.119 - - [26/Jul/2001:05:18:59 -1000] "GET /NULL.printer HTTP/1.0" 400 324<BR><BR>I also have been getting several attemps to connect to port 111 (rpc) and 53 (dns). They are both blocked from the outside so no problem. Stuff like this:<BR><BR>Jul 27 02:46:09 manapua ipmon[3873]: 02:46:08.451611 le0 @0:12 b 211.184.139.130,2117 -> my.external.ip.address,111 PR tcp len 20 60 -S IN<BR>Jul 27 00:43:18 manapua ipmon[3873]: 00:43:17.326058 le0 @0:12 b 203.200.119.157,4624 -> my.external.ip.address,53 PR udp len 20 58 IN<BR><BR>I also recieved a few request for is_this_the_index.cfm. I don't know what this file is, but the are alot of weblog files that have this and a few people asking what it is, but I haven't found out yet. Anyone else know? The log entry looks like this:<BR><BR>216.38.169.247 - - [24/Jul/2001:11:41:50 -1000] "GET /is_this_the_index.cfm HTTP/1.0" 404 287<BR><BR>and it is always preceded by this<BR><BR>216.38.169.247 - - [24/Jul/2001:11:41:50 -1000] "GET /is_this_the_index.cfm HTTP/1.0" 404 287<BR><BR>I hope everyone on this list is running a firewall of some sort. If you don't think you need it check out this http://project.honeynet.org/papers/stats/ they set up a few anonymous systems on the internet and just monitored them to see if they got attacked. The results are scary.<BR><BR><BR>Dusty<BR><BR>---<BR>You are currently subscribed to luau as: ken_iwata@msn.com<BR>To unsubscribe send a blank email to $subst('Email.Unsub')<BR></BLOCKQUOTE></BODY></HTML><br clear=all><hr>Get more from the Web. FREE MSN Explorer download : <a href='http://explorer.msn.com'>http://explorer.msn.com</a><br></p>