[asterisk-users] Security

[Khaled Chehab]

I make an namp search and the result was its was talking to irc server ,is
it normal 

[root at asterisk1 ~]# nmap 65.119.192.235

 

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2006-08-17 02:34 E

Interesting ports on ftp2.c3icare.com (65.119.192.235):

(The 1650 ports scanned but not shown below are in state: closed)

PORT      STATE    SERVICE

21/tcp    open     ftp

135/tcp   filtered msrpc

139/tcp   filtered netbios-ssn

445/tcp   filtered microsoft-ds

990/tcp   open     ftps

1000/tcp  open     cadlock

1025/tcp  open     NFS-or-IIS

3389/tcp  open     ms-term-serv

4899/tcp  open     radmin

10000/tcp open     snet-sensor-mgmt

 

Nmap run completed -- 1 IP address (1 host up) scanned in 352.570 seconds

[root at asterisk1 ~]# nmap 83.133.127.60

 

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2006-08-17 02:42 E

Interesting ports on webdiscounter.ch (83.133.127.60):

(The 1651 ports scanned but not shown below are in state: closed)

PORT     STATE    SERVICE

22/tcp   open     ssh

135/tcp  filtered msrpc

139/tcp  filtered netbios-ssn

445/tcp  filtered microsoft-ds

1422/tcp open     autodesk-lm

6666/tcp open     irc-serv

6667/tcp open     irc

6668/tcp open     irc

7000/tcp open     afs3-fileserver

 

Nmap run completed -- 1 IP address (1 host up) scanned in 496.802 seconds

  _____  

From: asterisk-users-bounces at lists.digium.com
[mailto:asterisk-users-bounces at lists.digium.com] On Behalf Of Khaled Chehab
Sent: Thursday, August 17, 2006 9:41 AM
To: 'Asterisk Users Mailing List - Non-Commercial Discussion'
Cc: asterisk-users-bounces at lists.digium.com
Subject: [asterisk-users] Security

 

Dear 

I am using asterisk at home V 2.6.I used to sniff the server for 24 hours ,the
result was that my server is talking to another servers through port 80 and
22 and 1000,. tcp 

Ips are 4.254.167.67

            65.119.192.235

            83.133.127.60

 

Is there any backdoor or a Trojan ,and how can I fix or debug it to be able
to stop it,

Remark: My hard drive and my network is completely cleaned from viruses,I
used to burn a new image and I get these results .

 

Regards

 

 

 

 



*********************************************
No employee or agent is authorized to conclude any binding agreement on behalf of Xplorium with another party by e-mail without express written confirmation by an officer of Xplorium. Any views expressed by an individual in this electronic message do not necessarily reflect views of Xplorium or its subsidiaries and associates.

This electronic message and its attachments are solely addressed to the addressee(s), and contain confidential information protected from disclosure belonging to Xplorium.

If you are not the intended addressee of this electronic message and its attachments, kindly delete it immediately from your system and notify the sender by electronic mail. You must not copy this message or attachment or disclose its content to any other person.

Xplorium does not guarantee the integrity of this electronic message and any of its attachments, or that they are free from computer viruses or other defects.
*********************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20060816/5a34a569/attachment.htm