Reporting organized penetration attempt from multiple sites

Thread View: comp.security.misc

6 messages

[T] Back to Threads [V] Tree View [G] Group Articles

6 total messages Started by Corwin J. Grey Wed, 11 Nov 1998 00:00

#1133

Author: Corwin J. Grey
Date: Wed, 11 Nov 1998 00:00

10 lines
1044 bytes

Where/who would be the best place to report an attempt to penetrate a
single target with the attacks originating from multiple nonresolving
ip addresses (over 120 IP addresses involved)?


---
Corwin J. Grey
Systems Administrator
West Coast Family Network Systems
cgrey@wcfamily.com

Re: Reporting organized penetration attempt from multiple sites

#1134

Author: Lachlan Cranswick
Date: Wed, 11 Nov 1998 00:00

23 lines
1417 bytes


>Where/who would be the best place to report an attempt to penetrate a
>single target with the attacks originating from multiple nonresolving
>ip addresses (over 120 IP addresses involved)?
>---
>Corwin J. Grey
>Systems Administrator
>West Coast Family Network Systems
>cgrey@wcfamily.com

Are you able to give more information publically?  I have just got some
TCPDUMP info from an intermittent web hosting problem I am trying
to track down (possible attempted Denial of Service?) - or just
general non-DoS network wierdness - and at least one nonresolving 
IP address features prominently in the TCPDUMP log.

Doesn't stop my web service - just slows it down - don't really know
what is happening???

Details in a separate post.

Lachlan.

Re: Reporting organized penetration attempt from multiple sites

#1136

Author: Bob Tinsley
Date: Thu, 12 Nov 1998 00:00

17 lines
1471 bytes

Corwin J. Grey wrote:
>Where/who would be the best place to report an attempt to penetrate a
> single target with the attacks originating from multiple nonresolving
> ip addresses (over 120 IP addresses involved)?

Your own internal audit department -- it's time to dust off those
security policies and ensure that they're being complied with.

Second: CERT? Your own ISP to help trace it back? The
police/FBI/whatever
if your site is of a high enough value to get them interested? Just
don't
get your hopes up with this option.

Cheers,

	-- Bob

Re: Reporting organized penetration attempt from multiple sites

#1141

Author: Frank Louwers
Date: Thu, 12 Nov 1998 00:00

16 lines
1330 bytes

Bob Tinsley (bob@earthrise.demon.co.uk) wrote:
> Corwin J. Grey wrote:
> >Where/who would be the best place to report an attempt to penetrate a
> > single target with the attacks originating from multiple nonresolving
> > ip addresses (over 120 IP addresses involved)?

try to find the ISP responsable for the IPs, and send mail to
root@theISP.com, and abuse@theISP.com.

I would also report it to your federal police. 9 chances out of 10,
they'll do nothing, but in the end, they will become aware of the problem
...

Grtnx,

Frank

Re: Reporting organized penetration attempt from multiple sites

#1142

Author: Troutman
Date: Mon, 16 Nov 1998 00:00

20 lines
1642 bytes

Frank - he said non resolvable IPs which means they are being faked.

Frank Louwers wrote:
> 
> Bob Tinsley (bob@earthrise.demon.co.uk) wrote:
> > Corwin J. Grey wrote:
> > >Where/who would be the best place to report an attempt to penetrate a
> > > single target with the attacks originating from multiple nonresolving
> > > ip addresses (over 120 IP addresses involved)?
> 
> try to find the ISP responsable for the IPs, and send mail to
> root@theISP.com, and abuse@theISP.com.
> 
> I would also report it to your federal police. 9 chances out of 10,
> they'll do nothing, but in the end, they will become aware of the problem
> ...
> 
> Grtnx,
> 
> Frank

Re: Reporting organized penetration attempt from multiple sites

#1143

Author: Joe Shaw
Date: Mon, 23 Nov 1998 00:00

20 lines
1564 bytes

On 11 Nov 1998, Corwin J. Grey wrote:

> Where/who would be the best place to report an attempt to penetrate a
> single target with the attacks originating from multiple nonresolving
> ip addresses (over 120 IP addresses involved)?
> 
> ---
> Corwin J. Grey
> Systems Administrator
> West Coast Family Network Systems
> cgrey@wcfamily.com

Your first step should be to contact CERT and your local law enforcement.
It's usually hard to get law enforcement to do anything unless you can
show monetary loss.

Joseph Shaw        - jshaw@insync.net
NetAdmin/Security  - Insync Internet Services
Free UNIX advocate - "I hack, therefore I am."

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads