Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations bkrike on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

I feel that I must raise an old iss

Status
Not open for further replies.

SF18C

IS-IT--Management
Feb 5, 2002
187
IT
I feel that I must raise an old issue that has been kicked around this forum a few times. It centers on ethical vs. unethical hacking.

For over 2 weeks my small home web site has been hit by a constant URL scan from a particular host. The scan runs for 10 minutes for every hour of the day. The scans were harmless, other than:
1. Taking away bandwidth that I pay for.
2. Wasting CPU and memory to process and deny the probe.
3. Filling my logs to the point of bust!

Yes, yes, yes I know that I could have filter out this one IP with an ACL and been done with it, but I figured I would try to use the “Internet superhighway rules of the road.” I went through the motions of monitoring, accumulating and reporting. I parsed my log files (router, IIS, and server security logs), conducted ARIN searches and tracked down the owner of the offending machine. I sent emails which went without response (3 times on 3 different days). Friday I called the number listed from the ARIN WHOIS result and actually was able to speak with the gentleman named under abuse reporting (to my surprise being the 2nd of Jan and all). He did confirm that this IP belonged to his organization and informed me that it was their web server! He said he never received any of my emails. So I confirmed his email address again and resent him list while on the phone with him. I asked him if it was possible that this machine had a virus or was being used as a zombie to conduct these probes. At this point he became very upset and asked me who I was to question their security methods. I added that I was only asking if it could have been the before mentioned ideas because I didn’t think these attacks were a deliberate part of their business practice. Well that really set him off and he was off the phone 30 seconds later saying he would look in to it.

After the phone call I LOOKED up the web site and while I was there I resent my email to their customer complaint email address listed with a short synopsis of my conversation with their IT department. I have had no reply to any of my emails. I feel that I have taken the high road and done things the right way…”as envisioned by the internet forefathers.”

Long story short…the probes continued all weekend and are still happening today. Now I know this may take most of TT members by surprise but there are unethical forms that would take a “You can’t crack my web site” post as a challenge, and take it to heart! Short of that, does any one else have a course of action they would take.


SF18C
CCNP, MCSE, A+, N+ & HPCC

"Tis better to die on your feet than live on your knees!"
 
Do I unleash the the scrip kiddies by going to a site, listing the URL and soliciting a challenge? Or is there a better way to resolve this issue that does not involve "laywering up"?

SF18C
CCNP, MCSE, A+, N+ & HPCC

"Tis better to die on your feet than live on your knees!"
 
Send a registered letter to the CEO of the offending company. Tell him your computer is being attacked by one of his computers. Ask him for a response by a designated date, and tell him legal action will be taken if the attacks continue. Attach your short synopsis of the situation.

Contact the feds and your state attorney general to see if there is anything they can do or suggest.
 
Let me add this organization is a small ISP serving the Colorado region. I have sent emails to their customer service department with no response. They do not list a CEO or other members of the board. I have sent emails to ARIN as well without much assistance other than to contact law enforcement. To further add to my demilma I'm not living in the states currently.

SF18C
CCNP, MCSE, A+, N+ & HPCC

"Tis better to die on your feet than live on your knees!"
 
It's easy to ignore an email. Perhaps you should call customer service, start taking names, and work your way up the line.
 
Get the names of those who you've dealt with.
Include hard copies of all the information you've collected.
Call the company and ask for the name of the CEO. As said before send a registered letter with a cover letter and all the supporting information. Don't threaten legal action at this point as it will make them more defencive. You can always step it a level later.

Inform the CEO that this isn't just dmg you but most likely aleast a couple hundred of orders of magitude worse for their company and that as shown by your correspondance no resolution was provided by employees that should have taken care of the situation. Explain that you just want the situation resolved for the sake of both of you.

If this doesn't work look into a few local paper and send them the information suggesting they write an article on this local ISP that does not seem to care about security in their network. Find out who normally writes technology type articles. If you can get a state newpaper to write an article that is even better. If you get one or more of the papers to actually write a small article wait until it is published and forward this on to the C.E.O. If the the company has a board of directors then send it to all of them.

 
Kidd & Semper,
Thanks for the advise! I will send a snail mail letter to the company stating the obvious. I hope this will resolve the issue, not only for me but if this server is probing me it is probably hitting many others.



SF18C
CCNP, MCSE, A+, N+ & HPCC

"Tis better to die on your feet than live on your knees!"
 
Of course, it's possible that it's not coming from their computers or one of their subscribers.

A friend of mine got sued because his IP address was used to attack someone. The attacker used a bogus IP address, which just happened to correspond to my friend's Mindspring dial-up account at the time of the attack. (His homeowner's insurance company defended him in court).

So, don't be quick to assume that the IP address you see is correct.

Chip H.


If you want to get the best response to a question, please check out FAQ222-2244 first
 
It is stated that the IP address that was used was owned by an ISP 99.999% of the time that will mean it is probably a Static IP address. Seeing that an employee verified that the server is theirs and that it was their web server I'll change that to 100%. Even if it isn't a Static IP ISP's would not put a server on a DHCP range that are shared by customers.

We aren't talking about dial up here. There is a good chance your friends computer was the platform someone launched an attack from and he was just hacked too.

 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top