Handler on Duty: Renato Marinho
Threat Level: green
Loading...
|
|
Submitted By | Date |
---|---|
Comment | |
2012-08-25 16:07:47 | |
Planet Lab uses this port as well | |
Ronnie | 2010-05-25 20:52:09 |
This port is also used by WinProxy | |
Brian Porter | 2004-02-11 00:46:11 |
MyDoom.C / Doomjuice http://www.lurhq.com/mydoom-c.html http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.doomjuice.html http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_DOOMJUICE.A http://us.mcafee.com/virusInfo/default.asp?id=description&;;;virus_k=101002 http://www.sophos.com/virusinfo/analyses/w32doomjuicea.html http://www.f-secure.com/v-descs/doomjuice.shtml http://www.viruslist.com/eng/alert.html?id=930701 | |
2004-02-06 22:18:45 | |
The Win32.Mydoom computer-virus opens and listens to the TCP port 3127, (if this port is already in use, the worm tries the next one free from the range 3128- 3199). The backdoor appears to have two main functions: execution of remotely-supplied code, and port forwarding. Reference: http://www3.ca.com/virusinfo/virus.aspx?ID=38102 | |
Johannes Ullrich | 2002-10-12 08:57:51 |
scans on port 3128 usually look for badly configured proxy servers in order to use them to hide further intrusion attempts or to bypass company (or country wide) firewall rules restricting access to certain web sites. These scans usually come in sets that scan several ports frequently used by proxies (80,8080...) Port 3128 is usually used by 'squid', a very popular web proxy server that is also able to proxy other protocols (e.g. ftp). If you run a proxy server, make sure it only proxies request from the inside. The two most common configuration problems are to permit strangers to use the proxy server to attack other web sites, or even worse to allow strangers to use the proxy server to access web site ('intranet') sites on the inside. |
CVE # | Description |
---|