John Thompson wrote: > Scot L. Harris wrote: > >> A quick google on port 1025 had it listed in one place as network >> blackjack. Not sure how accurate that is. But most likely this just >> someone scanning various ports for something open or for a specific >> exploit on a service that uses port 1025. > > IIRC, Windows uses the ports immediately above 1024 for a variety of > readily-exploitable services. Configure the firewall to reject new > connections on those ports. My experience is that ports 1025-1030 are > the most common targets. > Thought I would add my two bits to this thread... My firewall rejects/logs 20-30 of these TCP/1025 packets a day. Ethereal captures don't reveal anything that points to any particular service exploit mentioned at http://www.incidents.org/port_details.php?port=1025 Also, my firewall rejects/logs hundreds of UDP/1026-1027 packets a day. Ethereal decodes these packets as MS Messenger Service. Sometimes the content of these messages (using ethereal captures to view) are actually quite humorous, but most of the time the message content refers to the MS Security Bulletin MS03-043 (which actaully exists), then informs you that your system is infected and refers you to a NON-microsoft website to install a patch. Ya right! Geeez! I wonder how many folks have actually selected the website mentioned in the message and installed this so called patch. No wonder the internet is so infected with virus's nowadays. Steve Cowles
