[lug] imap hacking?
Rob Nagler
nagler at bivio.biz
Tue Jul 15 06:31:11 MDT 2003
Someone was visiting all my servers trying to hack my imap ports.
They didn't get in, but I'm wondering if there's a new attack out
there.
It's coming from a dial in in Germany. Here's a sample of entries:
Jul 14 08:58:43 my-host imapd[5653]: Login failed: no CRAM-MD5 entry user=web auth=web host=pD9524D51.dip.t-dialin.net [217.82.77.81]
Jul 14 08:58:43 my-host imapd[5654]: Login failed: no CRAM-MD5 entry user=administrator auth=administrator host=pD9524D51.dip.t-dialin.net [217.82.77.81]
Jul 14 08:58:43 my-host imapd[5660]: Login failed: no CRAM-MD5 entry user=oracle auth=oracle host=pD9524D51.dip.t-dialin.net [217.82.77.81]
Jul 14 08:58:44 my-host imapd[5661]: Login failed: no CRAM-MD5 entry user=sybase auth=sybase host=pD9524D51.dip.t-dialin.net [217.82.77.81]
Jul 14 08:58:44 my-host imapd[5662]: Login failed: no CRAM-MD5 entry user=lizdy auth=lizdy host=pD9524D51.dip.t-dialin.net [217.82.77.81]
I'm running imapd-2001a-1.72.0 for RH 7.2, which was last updated on
4/25/02.
Thanks,
Rob
More information about the LUG
mailing list