From owner-freebsd-security@FreeBSD.ORG  Fri Aug 13 14:55:56 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id DA2D516A4CE
	for <freebsd-security@freebsd.org>;
	Fri, 13 Aug 2004 14:55:56 +0000 (GMT)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
	[212.227.126.177])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 81EDE43D49
	for <freebsd-security@freebsd.org>;
	Fri, 13 Aug 2004 14:55:56 +0000 (GMT)
	(envelope-from jan.muenther@nruns.com)
Received: from [212.227.126.162] (helo=mrelayng.kundenserver.de)
	by moutng.kundenserver.de with esmtp (Exim 3.35 #1)
	id 1BvdTH-00088P-00; Fri, 13 Aug 2004 16:55:55 +0200
Received: from [212.202.43.252] (helo=localghost.muenther.de)
	by mrelayng.kundenserver.de with asmtp (Exim 3.35 #1)
	id 1BvdTH-0002z5-00; Fri, 13 Aug 2004 16:55:55 +0200
Received: by localghost.muenther.de (Postfix, from userid 1001)
	id AF43C21E87B; Fri, 13 Aug 2004 16:57:07 +0200 (CEST)
Date: Fri, 13 Aug 2004 16:57:07 +0200
From: Jan Muenther <jan.muenther@nruns.com>
To: Sandor Berta <berta@beco.hu>
Message-ID: <20040813145707.GB2097@localghost.muenther.de>
References: <411CCAAE.7020505@beco.hu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <411CCAAE.7020505@beco.hu>
User-Agent: Mutt/1.4.2.1i
X-Provags-ID: kundenserver.de abuse@kundenserver.de
	auth:9a8a46f2b40f7808f7699def63624ac2
cc: freebsd-security@freebsd.org
Subject: Re: sequences in the auth.log
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 13 Aug 2004 14:55:57 -0000


Heya, 

this is probably the same piece of malware that has been discussed on f-d 
recently. The username/password combination guest and test are hardcoded into
a little statically linked binary which is commonly used together with a 
SYN scanner. 

Chances are good these attempts are coming from a compromised box - you may
want to look into that if it is in your realms. 

If you need more info, I disassembled them both and made a quick analysis, check
the f-d archives. 

Cheers, J.