Remember our friend 24.164.115.50?

[Wolfie]

Who cares if you are getting the alerts? At least you know that your firewall is stoping them. The ones you don't know about are the ones you have to worry about....

Wolfie

 

[GT1999]

<< Who cares if you are getting the alerts? At least you know that your firewall is stoping them. The ones you don't know about are the ones you have to worry about.... >>



That's 1/2 true. Just because the they are getting blocked does not mean they aren't eating up his bandwidth. The connection is still present and the attacks, if severe enough (DoS) could cripple his connection. As an example, see here.

 

[tigerbait]

I get around 30-40 alerts a day with ZA. They seem to come from a whole slew of IPs. Most of them are looking for TCP port 27374. Whats going on there?

 

[Jfur]

I had someone scan ALL of my ports, one by one, last week -- I had to change my ethernet card!!!

 

[Wolfie]

Geekish Thoughts
At least it's better then freaking about it. I understand your view tho. I have not gotten hit like that in a long time. And that was because I wanted someone to test my ZA. And &quot;usualy&quot; you won't get hit like that. Unless someone &quot;is&quot; out to get you. And why should they pick you? I wouldn't know.

Wolfie

 

[Jfur]

I notice most of the hits I am getting are directed at UNIX systems (not me in particular), but in the last year, it has increased greatly. Remember, there are ways around firewalls software or hardware. Even though ZA is good, it's not foolproof -- keep an eye on your 'attack logs' and update/scan with AV OFTEN to look for trojans.

 

[Wolfie]

TigerBait,

Port 27374



<< Port 27374

(TCP) This is one of the most commonly probed ports on the Internet right now, due to its inclusion within the SubSeven Trojan. The reason it is so sommon is that SubSeven provides the ability to tell a compromised system to scan on its behalf. This allows cr/hackers to scan with impunity. >>



Wolfie

 

[Jfur]

btw, I think TCP port 27374 is &quot;SubSeven&quot; territory

 

[tigerbait]

Just because they're scanning for doesn't necessarily mean I have on my system , right? I run the TDS-3 Trojan scanner and it didnt find anything.

 

[Wolfie]

Tigerbait.

Do you use a firewall? If yes then the firewall &quot;should&quot; block them.

Wolfie

 

[FriedToast]

My cousin called me up freaked out because someone started typing to him on his own computer and then printed something out on his own printer. That's when he hit the Power button.

If any of you that pooh-pooh the idea of firewalls after that, then all the more power to you. Just don't get in my hair because I do use one.

Another friend of mine thinks almost the same way. He thinks AV progs are worthless wastes of time that hog your resources. Nothing like playing w/o a condom He's gotten a couple virii (from his parents, actually!) but he still maintains that he's 'safe'.

*whatever*

 

[tigerbait]

I use Zone Alarm.

 

[Jfur]

I recommend ZA, and its free ZoneAlarm

Also, go to ShieldsUp and let them &quot;probe your ports&quot; ShieldsUp

 

[NicColt]

this is just a Bot looking for vulnerable ports if so it's used in DoS attacks.

 

[JohnnyKnoxville]

You use Zone Alarm for protection?
Now thats funny!!! *cough*known exploits*cough*

 

[Jfur]

yeah, but what doesn't have known exploits. Black Ice is the biggest joke. As we all know, most people cracking at a system are unskilled kiddies. If a skilled cracker wants into my PC, there's little I can do to stop him or her. But ZA does offer some protection for the other 99.9%. Of course, any succssful cracker would be bored sh*tless with what I have... reading all my papers would be a horrible punishment

 

[skywhr]

Apparently ZA makes you a platinum member, youll get there pretty soon at this rate

 

[mackstann]

<< Of course, any succssful cracker would be bored sh*tless with what I have... reading all my papers would be a horrible punishment >>


heheh...lack of sleep...funny statements.....must go to bed.....you crack a me up a when i am a tired-ah.

 

[hopefloats]

The ZoneLog Analyser is a very cool and useful utility to use with ZoneAlarm. It can also generate a letter with all the info that an ISP would need.

 

[Demon-Xanth]

I've been using Freesco for a dialup router and it does make me feel more comfortable. There is no FTP locally (other than floppynet) and it allows my IP to be a comfortable 192.168.x.x

 

[PG]

Things will only get worse over time.

Go read about some potential problems with winXP here: http://media.grc.com:8080/files/grcdos.pdf

 

[Kazi]

haha big deal, whatever..configured mine to max out at 1000 and look at this pic...BAH and you think your safe!

Beware!