Skip to main content
gamedev.net
🔒 Locked

Script Kiddies

Started by Monder Jan 24, 2003 at 4:42 PM 8 replies 300+ views
Original Post
Monder
Monder
Right so far I''ve been on the net about half an hour and I''ve already had 500 alerts from zone alarm(max it''ll save) that''s almost 17 a minute. I''ve been flicking through them and most of them seem to be ZA blocking connections to the kind of ports that are used by script kiddies to exploit flaws in windows(most common seems to be 1900). That means there must be a hell of a lot of script kiddies out there. Seeing as I''ve got ZA running I doubt any of them actually manage to exploit anything but if you think of all the people who don''t have any kind of firewall running then there are a hell of a lot of fairly easily exploitable computers out there. Script kiddies who spend most there time h4x0ring must have 1000''s if not 10''000''s of zombies all ready to do a DOS or whatever. This can''t be a good thing Anyone else notice there firewall throwing up a lot of alerts?
Evil Bill
Evil Bill
I dunno where my firewall logs to (Linux iptables). I''ll take a look.
What is special about port 1900?

Member of the Unban Mindwipe Society (UMWS)
Oxyacetylene
Oxyacetylene
I get a few suspicious alerts on zonealarm. No where near as much as that though... I do get a lot more since I got a cable modem though. Perhaps that''s cause I leave my computer running a lot.
Monder
Monder
Port 1900 is the Universal Plug and Play port. Not quite sure what exploit can be used on it but I do know it is a secutity vulnerability
sanguineraven
sanguineraven
Yea, I run an IIS http and ftp server so I get uptime of around 23 or 24hrs a day average, on a broadband connection. But I only get like 1000-2000 high risk alerts per week, I don''t usually bother checking the ports though there have been some suspicious ones.

When we fall, earth will die, sun will set, and moon will shine, and the only image will be the Raven''s shadow in your eyes. So it is written, so it shall come to pass.
Quoth the Raven, nevermore...
KalvinB
KalvinB
When I tested ZA over my NAT I got a bunch of ping and NetBIOS attempts.

Nothing serious. The "worst" attack I had was when some bozo tried to brute force his way past the All Access Pass protection on my site 127,006 times in a 3 hour period.

What''s funny is that there were two usernames that you could find in a dictionary at that time. He didn''t try either of them. I doubt he has the same ISP anymore.

Another dumbass tried a bunch of IIS attacks on my Apache server. I don''t think he has the same ISP anymore either.

If you have a cable modem then you''re more likely to come under attack because there aren''t a whole lot of cable companies and they have a well known range of IPs. As long as you have a decent firewall it''s nothing to worry about.

You also might want to make sure you have it set up properly. You should allow all outbound UDP and TCP ports and limit incomming. See if that clears anything up.

To see what a port is, just seach for "port 1900" on google. If it''s a script kiddie port there will be plenty of info on it.

Ben


IcarusIndie.com [ The Labyrinth | DevZone | Indie Mail | Hosting | Tiberian Merchandise | GameShot | Fun With Cutouts ]
Monder
Monder
I''ve just looked at the I.Ps on my ZA alerts for port 1900 and most of them appear to be from one i.p. address(62.64.223.148) so either ZA likes putting up alerts about 300x or there''s a very stupid script kiddie out there. Ok it''s got to be the second option. Anyway it explains why I have so many alerts

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.