From: "Geo." 

From the X-Force "Stumbler" advisory:
> X-Force has been tracking reports of suspicious and widespread Internet
> traffic with a TCP Window size of 55808. A substantial amount of traffic
> captured from sites around the world point to a new distributed port
> scanning system.
... snip ...
> Each agent attempts to map IP addresses and open ports corresponding to
> each IP address by sending a TCP SYN packet with a random destination
port.

This doesn't appear to be the same pattern of activity seen since May. Many
people have reported activity from a single spoofed IP to a single
destination
IP from a random but non-varying source port to a random but non-varying
destination port - for weeks at a time. I've seen this on several networks
we
montor. I see no way this could even pretend to be an effective distributed scan.

Intrusec seems to feel that the trojan they found is a copycat; someone
created a trojan to try and match the described behavior/traffic with
winsize
55808. Probably someone's idea of a joke on the infosec community. The
files ISS describe match the files Intrusec described, so why does
ISS/X-Force feel
that Stumbler is the true source of the traffic?

-Joe

--
Joe Stewart, GCIH
Senior Intrusion Analyst
LURHQ Corporation
http://www.lurhq.com/


----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas,
the world's premier technical IT security event! 10 tracks, 15 training
sessions,
1,800 delegates from 30 nations including all of the top experts, from CSO's to
"underground" security specialists.  See for yourself what the
buzz is about!
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
----------------------------------------------------------------------------

--- BBBS/NT v4.01 Flag-4