PacketViper, LLC

PORT ALERT

HIGH SCAN VOLUME OF UDP 5060: Ongoing intensity of scans on UDP 5060, many originating from high risk countries as well as known offenders.

Vulnerabilities in various services utilizing this port allow a remote attacker to cause a denial of service (DoS) by sending either crafted or malformed packets to UDP 5060.

Create a custom rule blocking inbound UDP 5060 or, if you don’t already have one, create a grouping named HIGH RISK PORT GROUP and add 5060/udp to your HIGH RISK PORT GROUP.

PORT ALERT

HIGH SCAN VOLUME OF TCP 2323: Ongoing intensity of scans on TCP 2323, many originating from high risk countries as well as known offenders.

There are no known vulnerabilities in the common services on this port.  However, administrators may use this port to listen for telnet connections as an alternative to port 23/tcp adding a layer of obscurity to your defensive position.  It seems like the bad guys have caught on.

Create a Custom Rule blocking inbound TCP 2323 or, if you don’t already have one, create a Grouping named HIGH RISK PORT GROUP and add 2323/tcp to your HIGH RISK PORT GROUP.  If your organization makes use of this port, create strict PASS Custom Rules for those networks you wish to have access.

PORT ALERT

HIGH SCAN VOLUME OF TCP 2323: Ongoing intensity of scans on TCP 2323, many originating from high risk countries as well as known offenders.

There are no known vulnerabilities in the common services on this port.  However, administrators may use this port to listen for telnet connections as an alternative to port 23/tcp adding a layer of obscurity to your defensive position.  It seems like the bad guys have caught on.

Create a Custom Rule blocking inbound TCP 2323 or, if you don’t already have one, create a Grouping named HIGH RISK PORT GROUP and add 2323/tcp to your HIGH RISK PORT GROUP.  If your organization makes use of this port, create strict PASS Custom Rules for those networks you wish to have access.

PORT ALERT

HIGH SCAN VOLUME OF TCP 7547: Ongoing intensity of scans on TCP 7547, many originating from high risk countries as well as known offenders.

This port is associated with TR-069 application layer protocol for management of end user devices.  TR-069 has some known exploits, and the uptick in activity can be interpreted as adversaries probing for vulnerable systems.

Create a Custom Rule blocking inbound TCP 7547 or, if you don’t already have one, create a Grouping named HIGH RISK PORT GROUP and add 7547/tcp to your HIGH RISK PORT GROUP.  If your organization makes use of this port, create strict PASS Custom Rules for those networks you wish to have access.

GNL ADDED

GNL Added: Red Hat, Inc. is an American multinational software company providing open-source software products to the enterprise community. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North Carolina, with satellite offices worldwide. Avail: 12/3/16

GNL ADDED

GNL Added: Carbonite is an online backup service, available to Windows and Mac users, that backs up documents, e-mails, music, photos, and settings. It is named after carbonite, the fictional substance used to freeze Han Solo in Star Wars: The Empire Strikes Back. It was the first such service to offer unlimited backup space for a fixed price. Avail: 12/3/16

GNL ADDED

GNL Added: ServiceNow, Inc. is a cloud computing company headquartered in Santa Clara, California. It was founded in 2003 by Fred Luddy, the previous CTO of software companies Peregrine Systems and Remedy Corporation. ServiceNow is listed on the New York Stock Exchange and is a constituent of the Russell 3000 index. Avail: 12/3/16

GNL ADDED

GNL Added: UnitedHealth Group Inc. is an American diversified managed health care company headquartered in Minnetonka, Minnesota. It is 6th on the Fortune 500. UnitedHealth Group offers a spectrum of insurance products and services through various operating businesses & brands, Optum,UnitedHealth Care Inc. In October 2016, the company UnitedHealth Group Information Services Pvt. Ltd. merged with Optum. UnitedHealth Group serves approximately 70 million individuals throughout the United States. Avail: 12/3/16

PORT ALERT

HIGH SCAN VOLUME OF TCP 7547: Ongoing intensity of scans on TCP 7547, many originating from high risk countries as well as known offenders.

This port is associated with TR-069 application layer protocol for management of end user devices.  TR-069 has some known exploits, and the uptick in activity can be interpreted as adversaries probing for vulnerable systems.

Create a Custom Rule blocking inbound TCP 7547 or, if you don’t already have one, create a Grouping named HIGH RISK PORT GROUP and add 7547/tcp to your HIGH RISK PORT GROUP.  If your organization makes use of this port, create strict PASS Custom Rules for those networks you wish to have access.

GNL ADDED

GNL Added: OpenX is a programmatic advertising technology company. The company has developed an integrated technology platform that combines ad server and a real-time bidding (RTB) exchange with a standard supply-side platform (SSP) ensuring the highest real-time value for any trade. Avail: 11/19/16