It appears the attackers are going after 140.221.76.10 and 13. THe .10 machine appears to sending traffic to a remote IP indicating the possibility of a bash shell on the system. The .13 machine had a number of rest commands happening.. It looks very odd in what's going on. --Gene
We've patched those machines for bash. -- Craig
-----Original Message----- From: [email protected] [mailto:core-sysadmins- [email protected]] On Behalf Of Gene Rackow Sent: Thursday, September 25, 2014 11:25 AM To: [email protected] Subject: more bash stuff.
It appears the attackers are going after 140.221.76.10 and 13. THe .10 machine appears to sending traffic to a remote IP indicating the possibility of a bash shell on the system. The .13 machine had a number of rest commands happening..
It looks very odd in what's going on. --Gene
participants (2)
-
rackow＠anl.gov -
Stacey, Craig J.