From owner-freebsd-security Tue Aug 11 21:33:15 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id VAA16742 for freebsd-security-outgoing; Tue, 11 Aug 1998 21:33:15 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from aniwa.sky (aniwa.actrix.gen.nz [203.96.56.186]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id VAA16730 for ; Tue, 11 Aug 1998 21:33:08 -0700 (PDT) (envelope-from andrew@squiz.co.nz) Received: from localhost (andrew@localhost) by aniwa.sky (8.8.7/8.8.7) with SMTP id QAA20787; Wed, 12 Aug 1998 16:29:56 +1200 (NZST) (envelope-from andrew@squiz.co.nz) Date: Wed, 12 Aug 1998 16:29:55 +1200 (NZST) From: Andrew McNaughton X-Sender: andrew@aniwa.sky Reply-To: andrew@squiz.co.nz To: Daniel Minoru Saito cc: ben@rosengart.com, "Bruce A. Mah" , freebsd-security@FreeBSD.ORG Subject: Re: UDP port 31337 In-Reply-To: <004101bdc599$2c6f9420$4100a8c0@periscope.digital-canvas.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Wed, 12 Aug 1998, Daniel Minoru Saito wrote: > Date: Wed, 12 Aug 1998 11:30:28 +0900 > From: Daniel Minoru Saito > To: ben@rosengart.com, "Bruce A. Mah" > Cc: freebsd-security@FreeBSD.ORG > Subject: Re: UDP port 31337 > > Funny that you see this right now.. > Although you might want to trace where you see this originating from. > > Its the infamous Back Oriface by cDc. It utilizes port 31337. It basically > a virus that someone can fully control a win95/98 box remotely. > > > more information is at the cDc Site: http://www.cultdeadcow.com/tools/ > > dan Or it's traceroute of course. How hard would it be to arrange for a reply to be sent that would cause a back orifice client to send more and distinguish itself from a traceroute? Andrew To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message