[nsp-sec] UDP 2427 scans / Voip Vxworks RPC

[Stephen Gill]

Wow, I guess the old bug in Outlook still hasn't been fixed :D.  Did I
sound inebriated?

Resending, w/ the list detached into a URL.

[ .. ]

I was asked by a friend to look into some scanning he observed on UDP 2427
affecting Vxworks, and at the same time noticed some other groups talking
about an uptick as well.

Here's a recap of some of the Ips we've seen scanning for this port over
the past couple of days.  We went form 0 hits to ~5K+ hits in a day on our
darknets.  

You may wish to look at the Ips within your respective ASNs.   Any malware
or additional back tracing would be greatly appreciated.


[ .. ]


List can be found here using your nsp-sec u/p.

http://cymru.com/nsp-sec/Owned/udp2427_20120713.txt

Cheers,
-- steve

-- 
Stephen Gill, Chief Scientist, Team Cymru
http://www.team-cymru.org | +1 (847) 378-3323  | gillsr at cymru.com

We just launched our new Training Practice, see
http://www.team-cymru.com/Services/Training/