North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Exodus / Clue problems

  • From: Jeff Carneal
  • Date: Mon Nov 16 11:22:46 1998

On Sun, 15 Nov 1998, TTSG wrote:

> > removed from the network by request of the owner of the box.
> 
> 	b) WAS the origination actually the box as people have claimed, or
> 		was it spoofed?

I seriously doubt it was spoofed as mentioned before because the attacker
was going after _TCP_ ports on a wide spectrum of machine types.  Unless
he recently found a bug in every OS that allows IP blind spoofing (ISN
generation bugs?), it just about had to be the real address.

--
  Jeff Carneal - Sys Admin - Apex Internet          
  [email protected] http://www.apex.net (502) 442-5363

  The opinions expressed above aren't really mine.
  They belong to someone else who also refuses to 
  take responsibility for them.