Virus by port?

[guano]

Does anyone know of a web site or database that allows searching for known viruses/trojans/malware by port?
I'm thinking like an /etc/services for malware...

The Internet Storm Center is definitely lacking here... And the malware they do list is old. (They don't even list the Sobig variants on 2280 and 3380.)

AV vendors (Symantec, CA, F-Secure) permits searching by name, but not port.

For example:
2280-2285/tcp is Sobig-E

Perhaps even breaking it down by running application:
sobig-e 2280/tcp # worm
sobig-e-telnet 2281/tcp # worm
sobig-e-http 2282/tcp # worm
sobig-e-ftp 2283/tcp # worm
sobig-e-pop3 2284/tcp # worm
sobig-e-smtp 2285/tcp # worm

Pointers would be helpful.
Thanks!

[blackwave]

hopefully this helps :)

http://www.simovits.com/trojans/trojans.html

http://www.jlathamsite.com/dslr/suspectports.htm

http://www.doshelp.com/trojanports.htm

http://www.linux-firewall-tools.com/linux/ports.html

http://www.commodon.com/threat/threat-all.htm

http://advice.networkice.com/advice/Exploits/Ports/

[guano]

Originally posted by blackwave
hopefully this helps :)

http://www.simovits.com/trojans/trojans.html

http://www.jlathamsite.com/dslr/suspectports.htm

http://www.doshelp.com/trojanports.htm

http://www.linux-firewall-tools.com/linux/ports.html

http://www.commodon.com/threat/threat-all.htm

http://advice.networkice.com/advice/Exploits/Ports/

Most of those are pretty outdated. (A few haven't been updated in years.)
But "http://www.commodon.com/threat/threat-all.htm" is fairly recent. Thanks for the pointer!

[telco88]

I use this one often

http://www.cirt.net/cgi-bin/ports.pl

[guano]

http://www.cirt.net/cgi-bin/ports.pl

Unfortunately, this has the same problem as the ones Blackwave listed. It doesn't contain recent virus information. For example, ports 1180-1185 were Sobig-A and Sobig-B. Ports 2280-2285 should also mention Sobig-E/F. 3380-3385 were used at the end of Sobig-F. Etc.

The Sobig-A is more than 8 months old, so I'd expect a virus/trojan port list to include it... Unfortunately, I cannot find any list that includes it.

NOTE: I'm just using Sobig as an example here. There are hundreds of other examples.

But... I like the default password list at the site you listed. :-) Much better than other lists I have seen.

[ch0l0man]

http://www.liquidmatrix.org/trojan.htm
http://www.neohapsis.com/neolabs/neo...neo-ports.html

hope these help.

[guano]

http://www.liquidmatrix.org/trojan.htm
http://www.neohapsis.com/neolabs/neo...neo-ports.html

hope these help.

Both of these are right in line with what I'm looking for! Unfortunately, both appear to be more than a year out of date.

[digital warfare]

wow a lot of trojan oh downloaded all of them all of them heehhehehhehehehhehehehehhe yes evil evil yes

[jrl]

A (mostly) up to date database of ports...

One of the projects the Institute for Security and Open Methodologies (ISECOM - http://www.isecom.org ) is working on is the Open Protocol Resource.

The OPR is an extension of the original Open Source Security Testing Methodology Manual (OSSTMM - http://www.osstmm.org ) Internet protocols list. The OPR is a single resource for information on Internet and network protocols, transport information, and specifications.

You can search by port number, transport protocol, application, reference url, and description.

The URL for the project is here:
http://www.isecom.info/cgi-local/protocoldb/browse.dsp

-jrl