[SANS ISC] Is this traffic bAD?, (Fri, Jun 25th)

It seems like every time I take a handler shift lately, I’m talking about an uptick of traffic on another port and I’m not breaking that trend today. This really takes me back to the early days of the Internet Storm Center when that seemed to be the main thing we talked about. This time, the port that gotmy attention is UDP port 389. This is the normal port for the Lightweight Directory Access Protocol (LDAP) which is used a great deal by Microsoft Active Directory (AD). 

You’ll notice we aren’t seeing an increase is sources, but they do seem to have increased the amount of scanning they are doing (both number of targets and number of reports). A quick search shows there was a vulnerability reported in March, but I haven’t been able to determine if this new traffic is actually trying to exploit it or not. I haven’t been able to make much sense of the traffic I’ve captured in my personal honeypots, yet, but plan to look more carefully later today/tomorrow. For whatever it is worth, the top three scanners are from the US, India, and Belize. I probably don’t need to tell this audience, but your Active Directory/LDAP is probably not something that should be directly exposed on the internet. If anyone knows what is going on, you can comment below, or e-mail us, or use our contact form.


[1] https://nvd.nist.gov/vuln/detail/CVE-2020-35518

Jim Clausing, GIAC GSE #26
jclausing –at– isc [dot] sans (dot) edu

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Source: Read More (SANS Internet Storm Center, InfoCON: green)

You might be interested in …

[ESET] $5.2 billion worth of Bitcoin transactions possibly tied to ransomware

All posts, ESET feed

Threat actors are increasingly using advanced tactics to obfuscate and launder their illicit gains, a report by the US Government finds The post $5.2 billion worth of Bitcoin transactions possibly tied to ransomware appeared first on WeLiveSecurity Source: Read More (WeLiveSecurity)

Read More

[ZDNet] NATO: Series of cyberattacks could be seen as the same threat as an armed attack

All posts, ZDNet

The age of ransomware raises questions over NATO’s policies on state-sponsored cyberattacks and ransomware. Source: Read More (Latest topics for ZDNet in Security)

Read More

[SecurityWeek] Misconfigured Microsoft Power Apps Portals Exposed Millions of Records

All posts, Security Week

UpGuard security researchers have identified tens of Microsoft Power Apps portals that exposed millions of records due to being misconfigured. read more Source: Read More (SecurityWeek RSS Feed)

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.