🚀 go-pugleaf

Very shortly I'll have my automated email interface added to
myNetWatchman...then we'll be able to not only backtrace attacks, but
also automatically send an escalation email to the source ISP (when
appropriate).

lb.

Michael Scheidell wrote:
> 
> I had a friend ask me about Hack Tracer.
> It looks like a 'personal firewall' with built in visual traceroute and
> reporting capabilities
> 
> (sorta like blackice, visualroute and mywatchman all rolled into one)
> 
> Has anyone run it? is it easy to use? does it block steve gibson's exploit?
> 
> http://www.zdnet.com/downloads/stories/info/0,,001AJY,.html

-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com - Attack Response System

i got BlackIce running and can get hacker's IP and then find his provider on the internet, email address, etc. so far i reported a few dangerous attacks, but haven't got any reply. my system is save and protected though

regards

Not to be a pessimist, but my biggest realization regarding network
security is that

"SECURE" is not a state of being, it is a VERB describing the *continual
process* of reviewing, researching,
learning of matters of security.

Those that put up a personal firewall have taken an important step,
however, it does not in itself
create a "secure" system.

If BlackIce's only accomplishment was to raise awareness, that alone is
a major accomplishment...but there is oh so much more to do.

lb.

Mirek wrote:
> 
> i got BlackIce running and can get hacker's IP and then find his provider on the internet, email address, etc. so far i reported a few dangerous attacks, but haven't got any reply. my system is save and protected though
> 
> regards

-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com - Attack Response System

"Lawrence Baldwin" <baldwinlSPAMMENOT@mynetwatchman.com> wrote in message
news:3A6296A5.2EA4B529@mynetwatchman.com...
> Not to be a pessimist, but my biggest realization regarding network
> security is that
>
> "SECURE" is not a state of being, it is a VERB describing the *continual
> process* of reviewing, researching,
> learning of matters of security.

I agree.

as in 'security is a process' not a product.
With so many new ways to hack into a system, not to mention the odd 'woops,
I forgot to apply that 15 month old patch to MS II2 and now the Russians
have bill's source code'.

Basically, the only way to make sure, 100% that someone can't break into
your system is to use a little known hardware product, found at home depot,
and purchased for $4.95 (yep, less then $5 us)

Its a pair of wire cutters.

Other than that, it is important to be notified when you are being hacked,
and important that you report it to the ISP.

Important, because that server is either a victim (already been hacked) or
the villain.
Either case, the ISP in question had better take actions or they could find
themselves in the receiving end of an FBI investigation (BellSouth, take
note:  you are really down there on the list of ISP's who take hackers and
security seriously, with 15% of the Cayman routers you install, open to the
outside world with no passwords!)

It isn't 6 hours that goes by that I don't have some luser on a BellSouth
dsl line scanning for either the netbus Trojan, or the sunrpc buffer
overflow.

Stopped the attack? yep, my firewall stopped it from attacking here, but if
I get notified, and let BellSouth know about it and they actually did
something about it, then the infection would spread slower.

(still need the$4.95 hardware security device to stop it)

Bottom line, 15 to 20% of the dsl and cable modem connected computers are
infected with Trojans, sub seven, netbus or something similar.

Just waiting to launch additional attacks.
Stop the attack, identify the attacker (in real time) and complain.

Zone Alarm lets me find out (sorta) who is trying to get into my
system.  The output from Zone Alarm's 'who is' says the attempt came
from Kent State Univ.  Who would I contact there to report a problem?
and what do I say the problem is?  I don't want these guys poking
through my stuff, but who do I complain to and what do I need to relay
to them to get them to take action?  
Thanks---


On Sun, 14 Jan 2001 22:38:04 -0500, Lawrence Baldwin
<baldwinlSPAMMENOT@mynetwatchman.com> wrote:

>Very shortly I'll have my automated email interface added to
>myNetWatchman...then we'll be able to not only backtrace attacks, but
>also automatically send an escalation email to the source ISP (when
>appropriate).
>
>lb.
>
>Michael Scheidell wrote:
>> 
>> I had a friend ask me about Hack Tracer.
>> It looks like a 'personal firewall' with built in visual traceroute and
>> reporting capabilities
>> 
>> (sorta like blackice, visualroute and mywatchman all rolled into one)
>> 
>> Has anyone run it? is it easy to use? does it block steve gibson's exploit?
>> 
>> http://www.zdnet.com/downloads/stories/info/0,,001AJY,.html
>
>-- 
>-------------------------
>Lawrence Baldwin
>Protocol Scientist
>678-624-0924
>http://www.mynetwatchman.com - Attack Response System

Safe and protected?? maybe against incoming packets but if all you are
using is BID then you can't be truly protected and safe as BID can't
detect Outgoing packets.
__ 

S-o-Z

*********

On Sun, 14 Jan 2001 22:08:05 -0800, "Mirek" <mi2@lycosmail.com>
Cracked a cold one and typed:

>i got BlackIce running and can get hacker's IP and then find his provider on the internet, email address, etc. so far i reported a few dangerous attacks, but haven't got any reply. my system is save and protected though
>
>regards

Well said.

"Michael Scheidell" <me@privacy.net> wrote in message
news:lOK86.1826$Dd.10880505@news1.mia...
>
> "Lawrence Baldwin" <baldwinlSPAMMENOT@mynetwatchman.com> wrote in message
> news:3A6296A5.2EA4B529@mynetwatchman.com...
> > Not to be a pessimist, but my biggest realization regarding network
> > security is that
> >
> > "SECURE" is not a state of being, it is a VERB describing the *continual
> > process* of reviewing, researching,
> > learning of matters of security.
>
> I agree.
>
> as in 'security is a process' not a product.
> With so many new ways to hack into a system, not to mention the odd
'woops,
> I forgot to apply that 15 month old patch to MS II2 and now the Russians
> have bill's source code'.
>
> Basically, the only way to make sure, 100% that someone can't break into
> your system is to use a little known hardware product, found at home
depot,
> and purchased for $4.95 (yep, less then $5 us)
>
> Its a pair of wire cutters.
>
> Other than that, it is important to be notified when you are being hacked,
> and important that you report it to the ISP.
>
> Important, because that server is either a victim (already been hacked) or
> the villain.
> Either case, the ISP in question had better take actions or they could
find
> themselves in the receiving end of an FBI investigation (BellSouth, take
> note:  you are really down there on the list of ISP's who take hackers and
> security seriously, with 15% of the Cayman routers you install, open to
the
> outside world with no passwords!)
>
> It isn't 6 hours that goes by that I don't have some luser on a BellSouth
> dsl line scanning for either the netbus Trojan, or the sunrpc buffer
> overflow.
>
> Stopped the attack? yep, my firewall stopped it from attacking here, but
if
> I get notified, and let BellSouth know about it and they actually did
> something about it, then the infection would spread slower.
>
> (still need the$4.95 hardware security device to stop it)
>
> Bottom line, 15 to 20% of the dsl and cable modem connected computers are
> infected with Trojans, sub seven, netbus or something similar.
>
> Just waiting to launch additional attacks.
> Stop the attack, identify the attacker (in real time) and complain.
>
>
>
>
>

" security " is that state of mind That existed immediately
prior to the " panic state" resulting  from the discovery of ,
or the presenace of a  virus or hacker .

Joe S wrote:
> 
> Well said.
> 
> "Michael Scheidell" <me@privacy.net> wrote in message
> news:lOK86.1826$Dd.10880505@news1.mia...
> >
> > "Lawrence Baldwin" <baldwinlSPAMMENOT@mynetwatchman.com> wrote in message
> > news:3A6296A5.2EA4B529@mynetwatchman.com...
> > > Not to be a pessimist, but my biggest realization regarding network
> > > security is that
> > >
> > > "SECURE" is not a state of being, it is a VERB describing the *continual
> > > process* of reviewing, researching,
> > > learning of matters of security.
> >
> > I agree.
> >
> > as in 'security is a process' not a product.
> > With so many new ways to hack into a system, not to mention the odd
> 'woops,
> > I forgot to apply that 15 month old patch to MS II2 and now the Russians
> > have bill's source code'.
> >
> > Basically, the only way to make sure, 100% that someone can't break into
> > your system is to use a little known hardware product, found at home
> depot,
> > and purchased for $4.95 (yep, less then $5 us)
> >
> > Its a pair of wire cutters.
> >
> > Other than that, it is important to be notified when you are being hacked,
> > and important that you report it to the ISP.
> >
> > Important, because that server is either a victim (already been hacked) or
> > the villain.
> > Either case, the ISP in question had better take actions or they could
> find
> > themselves in the receiving end of an FBI investigation (BellSouth, take
> > note:  you are really down there on the list of ISP's who take hackers and
> > security seriously, with 15% of the Cayman routers you install, open to
> the
> > outside world with no passwords!)
> >
> > It isn't 6 hours that goes by that I don't have some luser on a BellSouth
> > dsl line scanning for either the netbus Trojan, or the sunrpc buffer
> > overflow.
> >
> > Stopped the attack? yep, my firewall stopped it from attacking here, but
> if
> > I get notified, and let BellSouth know about it and they actually did
> > something about it, then the infection would spread slower.
> >
> > (still need the$4.95 hardware security device to stop it)
> >
> > Bottom line, 15 to 20% of the dsl and cable modem connected computers are
> > infected with Trojans, sub seven, netbus or something similar.
> >
> > Just waiting to launch additional attacks.
> > Stop the attack, identify the attacker (in real time) and complain.
> >
> >
> >
> >
> >