Information Security News
With the rise of botnets like Mirai, we have seen ahuge increase of port scans to find new open ports like %%port:2323%% or later %%port:6789%%. If the classic %%port:80%% and %%port:23%% remain" />
The honeypots acceptconnections on ports 80 and 443 and just log attempts performed on other ports.
A few days ago, I deployed a new honeypot that listensto many more ports:
For each protocol, the honeypot collects interesting information related to the application (user, password, commands, filename, path, ...) It">
As you can see databases seems to remaina nice target. The MSSQL scans revealed the">
The NTP scanners issued the monlist command to search for NTP servers vulnerable to amplification attacks.
As you can see, there are bots scanning for many protocols. We need to keep an eye onwhat is happening below the radar. Im planning to listen to more ports in the coming days. I wish you already a wonderful and safe year 2017!
Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant