RE: Strange Netbios connections

["Hall, Philip" <phall@xxxxxxxx>]

> At 09:21 AM 8/11/2003, Phil Hall wrote:
> 
> >"port 445 is also an attack vector for RPC-DCOM and 445 is 
> only found on 2k/
> >xp / 2k3 as well. As a side note, ASP running on IIS links to dcom 
> >functions, and port 80 is also another vector. With the 
> prevelance of the 
> >dcom exploit, i imagine the port 445 scan is a side affect 
> of routine 
> >exploit fingerprinting from would-be attackers."
> 
> I thought port 445 was the default for SMB or TCP, and as 
> such is just part 
> of the normal windoze background noise. Not so? I've seen 
> plenty of hits on 
> my firewall, but nothing that looks remotely like a scan, 
> just mindless 
> repetitive tries from single source IPs.

Pete,

True, but it's apparently now being used as an 'attack vector' for the most 
recent DCOM exploit for Windows(2K/XP/2K3). The original DCOM exploit (MS has 
it numbered as MS03-026) was targeted at port 135, and this is what most of the 
exploits went after.

However, Microsoft have 'owned up' to it also being exploitable via ports 80, 
139, 445 and 593 - there may even be others. My original note to Oliver was 
really just a heads up, as he was seeing what he believed to be "strange 
NETBIOS connections", that there is something nasty out there going after that 
- and other - ports. 

I'm certainly not saying that's what he was seeing as I've not seen (nor do I 
want to) any traces from him to prove it one way or the other.

Hopefully if anything my note will make people wary of strange traffic on these 
ports, and more importantly I hope people keep their Windows updates current !

--phil