Thinking...
[get complete service list]
Top of page
Port Information
Protocol Service Name
tcp dameware Dameware Remote Admin
Top IPs Scanning
Today Yesterday
64.226.70.121 (1)109.205.211.221 (5)
23.95.197.214 (1)89.248.170.65 (5)
162.142.125.133 (1)24.245.13.71 (4)
165.154.173.35 (1)152.32.183.231 (3)
152.32.247.23 (1)107.11.173.129 (3)
146.190.241.56 (1)167.94.146.38 (2)
79.124.62.122 (1)34.74.200.3 (2)
Port diary mentions
URL
Homeland Security Level Raised to Orange, increase in DameWare (port 6129) scans and exploit, Microsoft Retires Products (Including Windows 98), And Earthlink Users Being Targeted by Scam Using IE bug
IE URL Bug; Phishing Attacks; Port 6129 Remains High; Proper Incident Response
122303 CitiBankVisa Account Phishing, ISS IE URL Spoofing filter, Dameware scanning, Apple patch links
Top of page
User Comments
Submitted By Date
Comment
Nick FitzGerald 2005-09-13 02:06:58
Spike 31 Aug thru early September 2005 probably due to remotely exploitable login username buffer overflow in DameWare Mini Remote Control Client Agent Service (dwrcs.exe): http://www.frsirt.com/english/advisories/2005/1596 Reported to affect 4.0 thru, but not including, 4.9.0. Various versions of this agent are often surreptitiously installed by malware as a backdoor, so random scanning may turn up more installations than might otherwise be expected.
ChrisA 2004-04-28 00:21:35
There is at least one known buffer overflow vulnerablity in versions prior to 3.73. This vulnerablity may permit an unauthenticated attacker from executing code on your system.
Jerry Davis 2004-01-03 07:35:13
I have also seen quite a few successful entries via this port from dameware mini r/c. It also seems to be connected to slim FTP that shows up at the same time of infection.
Andreas 2003-12-22 23:18:25
Probably related to http://www.securiteam.com/windowsntfocus/6N00B1P95I.html and/or http://www.k-otik.com/exploits/08.13.nfm-shatterdame.c.php. I've seen multiple successful intrusions via this service today.
Davis Ray Sickmon, Jr 2003-12-22 07:41:30
Normally associated with DameWare and DameWare mini-RC, a remote control agent.
Top of page
CVE Links
CVE # Description
Top of page