Fwd: XXFwd: [unisog] Attacks on AFS]

[Keith Johnston]

Has anyone else been receiving this attention? We were already blocking 
the port in question so it has not caused us problems but we have been 
having other hardware hassles.
Keith

Begin forwarded message:

> From: Russell Fulton <r.fulton at auckland.ac.nz>
> Date: Fri Jun 07, 2002  03:15:58  PM Pacific/Auckland
> To: csprog at cs.auckland.ac.nz
> Subject: XXFwd: [unisog] Attacks on AFS]
>
> FYI.  Andy is reliable and not prone to panic ;-) so this may be a
> serious issue. If this becomes a problem then we can block 7001 until it
> is sorted out...  I take it 7001 is the default AFS port, if so may be
> we should block it as we do NFS?
>
> Russell
>
> -----Forwarded Message-----
>
> From: Anderson Johnston <andy at umbc.edu>
> To: unisog at sans.org
> Subject: [unisog] Attacks on AFS
> Date: 06 Jun 2002 11:02:46 -0400
>
>
> We've gotten a notice that AFS servers have been crashed at some sites
> by
> a scan of port 7001 followed by "malicious packets".  The attacking
> packets have source IP 130.237.48.109 (sul.e.kth.se).
>
> Does anyone know anything about this?  Particularly about the nature of
> the "mailcious packet"?
>
>                                                 Thanks,
>                                                 - Andy Johnston
>
> ------------------------------------------------------------------------------
> ** Andy Johnston (andy at umbc.edu)          *            pager:
> 410-678-8949  **
> ** Manager of IT Security                 * PGP key:(afj2002)
> 4096/8448B056 **
> ** Office of Information Technology, UMBC *   4A B4 96 64 D9 B6 EF E3 21
> 9A **
> ** 410-455-2583 (v)/410-455-1065 (f)      *   46 1A 37 11 F5 6C 84 48 B0
> 56 **
> ------------------------------------------------------------------------------
>
>
> --
> Russell Fulton, Computer and Network Security Officer
> The University of Auckland,  New Zealand
>
> --
> Russell Fulton, Computer and Network Security Officer
> The University of Auckland,  New Zealand
>
>
                      -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Keith Johnston                                                 Extn 7977
Computer Support
Computer Science Department		Room 106

     This email is brought to you by the letters OS  X and the number 10
                      =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=