[nsp-sec] More password stealers and drops - AS13301, AS24940, AS7738,

[Jose Nazario]

On Wed, 26 Mar 2008, Rob Thomas wrote:

> Is the access all through FTP?  I'm trying to assemble a list of 
> probable compromised hosts.

yep, all TCP port 21 FTP



-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/