Ip spoofing

Sorry to appear a "wet blanket" or prophet of doom.

The general concensus would seem to be that this is not a "spoofing" situation. It is either the guy is lying, or he has become "owned" by some sort of Botware.

We have a website hosting games that has certainly been invaded by a malicious person who has had admin or close rights (not that that seems to bother most malware these days?).

We have all the members of the gaming group visiting the site, which to them is a "trusted site" They interact with the site and fellow gamers in an atmosphere of trust but, unfortunately, there is a rotten apple in the barrel?

I would strongly recommend that ALL members of the group carefully check their own boxes for keyloggers, bots, trojans and so on, to ensure that they have not become owned as well.

Remember your firewalls were set to allow the gaming site, and antivirus applications are not good at detecting this type of software as it is not viral :(

http://www.winpatrol.com WinPatrol shows you what is running, in your start-up and so on.

http://www.diamonscs.com.au Get the trial of their anti bot/trojan software. Might as well get RegistryProt whilst you are there.

Do a search for "pest patrol" and get the trial for that

http://www.swatit.org SwatIT v2.1 A very thorough spyware detector, takes a long time to run!

http://www.spywareinfo.com/~merijn/index.html "HijackThis" Will show you what is running or can run on your machine (be careful........it shows everything...you have to decide!)

Make sure everything is up to date and run it in safe mode.

http://www.styopkin.com Keylogger Hunter..............you never know with "rotten apples" ;)

Guess that's enough paranoia for one session?

Hydro, if you agree you might let the others know?


Cheers

for those who had the input here thanks so very much it was very interesting and informative

THIS IS THE PERSON WHO EVERYONE THOUGHT DID IT FINALLY OWNING UP

please review and give insight if youd like

This is a statement surrounding an alleged accusation of the suspension of an Internet Account and a report of being involved in a ‘Hacking Attack’ on the evening of Wednesday 29th of November 2003, reported by Mr ....... to Energis..

So that I can explain the circumstances that arose to the alleged ‘hacking’ report being produced, I feel I must include background information as it will become apparent as to the pertinence of the situation as the statement proceeds.

GAMING COMMUNITY

I belong to a gaming community based around a game from Nova Logic called Delta Force 2 (DF2).

The community comprises of groups (referred to as ‘Squads’ or ‘Clans’) and players who play the game as individuals. Players that belong to Squads generally use ‘Tags’, a form of identity marking and a symbol of their belonging. ‘Tags’ are defacto a shortened version of the squad name.

The Player naming convention is “known player Name” plus “The Squad Tag”

For example: My player name is S, my squad is called ....and the Squad Tag is =SS=. Therefore my online name when actually playing the game is =SS=.

There are hundreds of squads and it is not uncommon for squads to spend an extraordinary amount of time, effort, money and energy on all facets of the game (hardware, software, web space, websites, message forums, automatic statistics pages etc.).

I have been a DF2 player since Mid 1999.

On April 29th 2003 I formed my own squad called Star Snipers, which in due course increased in numbers as I and subsequently the newer members allowed applicants to join, or denied the application to join as we deemed appropriate.

The pertinence of his section is that I am the Leader of Star Snipers and Tony (Mr is the leader of one of our main rival squads called Snipers Of Doom (=SOD=).

In recent times there has been a growing belief that players from =SOD= cheat when they are playing in a match. This has led to friction developing between certain members of both squads, escalating into what is now almost an all out virtual war.

TECHNICAL ASSISTANCE TO THE INDIVIDUAL

Having more technical computing knowledge than most people, I have often found my services to be in high demand and receive requests for assistance with Computing matters on a daily basis, whether it is within the DF2 community or in ‘the real world’.

In the real world it is straight forward. The machine is readily to hand and therefore causes no access problems.

In the ‘virtual’ world this is obviously not the case, one must perform the required tasks remotely i.e. over the Internet. I have an avid interest in computing and enjoy helping people who are in need. It gives them a service which is free of charge and it supplies myself with a continuous opportunity to further develop areas of expertise.

I have, in the last four years or so been voluntarily and willingly provided with access by people to literally hundreds of personal machines or web servers from all over the world. In order for me to undertake the assistance the person requesting the assistance has always volunteered the information needed to log in, such as Login name, password details, server details etc.

This is also pertinent to this ‘case’ as Tony willingly gave me the details of his log in and account password.

For those that I do undertake tasks for I always inform them on the 1st occurrence that they should either uninstall or disable any 3rd party application that we may have used and change any password type login information that we may have used during the session we have performed the tasks in. This is supplementary advice in addition to that which they ‘agree’ to when they form contracts with providers and server resellers.


WHAT ACTUALLY HAPPENED

On Wed 29th October 2003, there were matches (called ‘Team Death Matches’ (TDM)) scheduled, in a pairs tournament between my squad (=SS=) and Tony’s squad (=SOD=).

I am the manager and administrator for the tournament. All tournament and =SS= squad files are held on my web server space, provided through Di Soft Hosting.

During the course of the evening I was bombarded with people contacting me by MSN Messenger (Online near-to-real-time Text driven application) or on Ventrillo (Voice over IP driven) communications applications. The nature of the complaints were mainly accusations of =SOD= players using third party applications to give them unfair advantage over other players whilst playing in the DF2 Matches (Cheating in other words).

Why anyone would cheat in a game is an exhausting subject, but with an inexhaustible list of reasons. Suffice to say that it has been an emotive topic and point of contention within the wider community for as long as I have been playing the game.

Late Wednesday evening I had quite a lot to drink and reached the end of my tether. I decided enough was enough. As I previously mentioned I was almost at the end of my patience anyway, and this perpetual scenario of bickering, accusation and frustration was the straw that broke this particular camel’s back.

I started my CuteFTP (File Transfer Protocol application) and logged into what I thought was my Di Soft Account. I did not realise it at the time, but I had actually logged into Tony’s account with Di Soft. I would like to add at this point that once an account entry has been set up in CuteFTP, it is literally two mouse clicks to complete the log in procedure. For additional clarity I shall provide an image of my FTP Site manager screen:

Image1 – Site manager for Mr ........ FTP and settings.

Image 1 shows the highlighted entry in the left hand pane for Tony’s Server details. To enter a server at this point all is needed is to press the ‘Connect’ button on the button bar at the foot of the screen.

My FTP account with Di Soft is directly listed above that of Tony’s. as you can see and I have it listed as Di Soft Main. Clicking on that entry followed by connect would have taken me into my account.

I have on several occasions been requested to provide assistance from Tony in matters relating to the setting up of Forums, Scripts, DNS Forwarding, Statistics applications etc.. when he has been incapable of being able to ‘work out how to do it’ himself. Each of the instances requires me to log into his web server in order to carry out the tasks he wishes me to undertake.

Tony has sufficient knowledge to go about normal day to day administration tasks and his knowledge and expertise over time has improved accordingly, however he has in the past lacked the technical expertise to be able to undertake the higher level functions of computing and engineering matters, which is were I have been requested to assist. Tony provided to me the login details needed to perform the tasks.

As I said, I entered what I believed to be my account with Disoft, and when presented with the top level FTP menu (which looks the same for every Di Soft Account) I deleted all of my folders and files. After the last files were deleted, I logged out of Cute FTP, disconnected from the internet shortly after and went to bed in a bad mood. For clarity Image2 shows what my FTP Account looks like when connected and viewed online:

Image2 - CuteFTP for Mr..... Di Soft Account

On Friday 31st October 2003, I ‘spoke’ with Tony on MSN as I noticed that his forum appeared ‘off-line’ and asked him if it was a problem that I could assist him with.

He told me that someone had ‘hacked’ into his forum and destroyed his files and that he had made a complaint. He also added that the Internet Protocol Address (IP Address) of the attacker had been recorded and had been traced. The company that owned the Account that the IP address was called Energis and that they were locking the account and would investigate the matter. At that point I was supportive and offered any assistance that I could give to assist in getting his Forum ‘back on its feet’ in a timely manner. He said that he was ok and could manage.

Approximately 30 minutes or so later my Internet Connection stopped working. My Internet Service Provider (ISP) are Freeserve so I contacted them as the indication presented to me was that my account details could not be recognised. Freeserve told me that my account had been ‘locked’ and gave me a reference number (Ref: 00000) and telephone number (00000) to contact Energis (who are Freeserve’s account providers/managers). It was at this point that the dawn of realisation started to draw upon me as up until then I did not know that Energis provided this function.

I contacted Energis and was presented with an answering machine. I left the details as requested and waited for a call to be returned from Energis. When contacted by Energis they then informed me that my account had been ‘locked’ as it had been reported of being involved in a ‘hacking’ attack. They would not discuss the matter further and said the account would remain locked until an investigation had taken place.

I then rung Tony but he was not at home. I immediately sent Tony a text message to his mobile phone letting him know that my account had been locked and was being blamed for ‘hacking’ into his server. Later that evening Tony rang me and we spoke at length about the situation. He said that he had informed the Police and that he had nothing much further to say about the matter until the investigation report was produced by Energis. With the benefit of hindsight I should have immediately told him the truth about what had happened, but did not do so, as I believed that as soon as he knew that I was ‘in the frame’ for deleting the files and folders he would dismiss the matter out of hand, withdraw the complaint and that would be the end of the matter.

I compounded and complicated the matter by posting a message in a Message Forum saying that my IP Address had been ‘spoofed’ and I had been set-up and expanded on the consequences should I be found guilty of ‘hacking’. I thought this would force the issue and bring any charges to an immediate halt. Once again my estimation of the strength of mine and Tony’s friendship was completely misplaced. Over the weekend, the situation developing in the message forum went from bad to worse. It became more and more apparent that Tony was not going to help me by having the complaint withdrawn, so I decided to ‘come clean’ and on the morning of Monday 3rd of November 2003 I spoke with the Police and Energis, as the whole thing was getting completely out of hand.

I explained the situation to Energis and they in turn called me back, informing me that they had sent an Email to Tony. Energis said that the contents of the email explained the actual events listed above and gave him until Friday 7th November 2003 to decide whether he still wanted the complaint to stand or the investigation to still take place. They added that if they received no reply by Friday 7th of November then they would take it that he did not want to proceed with the matter.

On Monday afternoon Sergeant SO AND SO from Police station called me and I explained the sequence of events as outlined above. He took the details for Energis and informed me that he would contact them to establish what has happened, what is happening and any future intentions.

I am sorry for any inconvenience that I may have caused by my unintentional deletion of files and folders from Tony’s web server space. I wish that I had told him the truth when presented with the 1st opportunity. There are two main reasons why I did not do so:

1. I did not believe that anyone would believe that someone with the level of knowledge, training and experience I possess could make such a fundamental error and therefore come to the conclusion that I had done this maliciously and intentionally.

2. I would lose face and credibility in a community I have been part of for years and with friends and other people, that in the main I respect and value.

SUMMARY

I have made a mistake and then compounded that mistake by ‘inventing’ an excuse and posting it in a community message forum.

I mistakenly believed that my friendship with Tony and the application of ‘pressure’ through our community message forum would sway him into dropping the complaint and therefore stop further proceedings.

I am apologetic over the entire situation which has arisen through the lack of my not owning up straight away, but took the course I did with the best intentions for all concerned.

We all make mistakes and I should have been ‘man enough’ to have held my hand up and admitted mine. The circumstances at that time swayed me to take the initial course of action I undertook. I know that my judgement was wrong.

In my defence, I have not ever ‘hacked’ into anyone’s PC or web server and have always been provided with the necessary login and password information by those concerned, and I have never ever abused the facility, ability or privilege to do so or have had anyone ever make a complaint such as this against me.

If Tony had followed the advice that I gave him, the same advice I always give to those I help, to change his password after we have concluded scheduled tasks then I would not have been in a position to delete the folders and files in the 1st place.

I have never logged into his or anyone else’s machine or web server without them requesting me to do it or having an open invitation to do so. This was a genuine mistake for which I apologise unreservedly. I deleted what I thought were my folders containing my files.

I have tried on numerous occasions using Email, MSN Messenger, Mobile text messages and Telephone to try and establish communication with Tony to explain exactly what happened. He has not responded to any of the attempts or returned any of my calls and therefore is not aware of the actual situation, as described above.

I swear that this statement is correct to the best ability of my recollection of events in the last 6 days.

This statement will be submitted to Sergeant PC from Police station on Saturday 8th of November 2003. He is not in a position to do receive the statement before then as he is ‘off-duty’ and he is the ‘Officer In Charge’ of this particular case. Sgt PC can be contacted on 00000000 when he comes back on duty on Saturday 8th of November 2003.

Well, it sounds like:

a) the individual did delete the account (intentional or not) so the issue of "spoofing" doesn't apply.

b) "Tony" may be liable for some issues as some companies take offense to the "distribution of accounts and passwords". While "Tony" should have changed passwords, he more than likely shouldn't have given out the account at all.

c) IMHO, (and some basic Canadian law understanding -- I'm going on the premis that the individual and these events took place in Canada), the individual will probably end up with charges dropped since i) he was given access to the account ii) intent indicates no serious intention to actual damage the forum (the intention was to delete something else that the individual had the right to delete)

d) the individual has probably hurt his reputation. Why he didn't fess up when "Tony" first approached him about the forum being deleted (we do all make mistakes but the fact that he didn't "fess up" right away.. )

Anyways, that's my opinion for what it's worth. Needless to say, this is an interesting discussion..

yes MsMittens

that would have been the easiest thing to do -- the sad thing is he wont ever own up -- the one thing too know though is this whole discussion really does make you think about who to trust over the internet. I for one would always protect against this stupidity from ever happening in the first place

I for one would always protect against this stupidity from ever happening in the first place

HA! Good luck. Stupidity 0wns the 'Net. At best, you might be able to protect your own little world with regular password changes, watching who you give what to, and being more paranoid about some people but stupidity will still range supreme as long as their is a regular user out there who still does the "My computer isn't working and I can't see the keyboard because of the power outage. How can I get my computer to work??" question.

WOW dont ever ask me to commit a crime with you.
Next time keep your mouth shut and deny it all the way!!

Well as you can see the above text you know now the out come which was'nt my intent
If only he told me first time round this would'nt be here now.
He then made a reply being personal to my family which i flipped to show the above.

But on my part i must add i never gave a password out i know the only way he got but this will never happen again.

Thx for all your input here and time ;)

wild

To be blunt from my first impression: It sounds a lot like two little girls fighting.... no offense to little girls intended of course..... ;)

Points I note:-

1. I've played CS for years, (1999, I believe), I'm average at it... I don't get into the "clan" thing simply because the propensity for these silly "bitch fits" about cheating increase exponentially.... I go there, I play, I have fun.... Oh and I kill most of these L33t clan members daily...... But I do it alone..... without cheats.... If I'm cheated on I bitch there and then.... If it continues, I leave.... How hard is that? :rolleyes:
2.

Quote:

---

Late Wednesday evening I had quite a lot to drink

---

Well.....I've said it before and I'll say it again..... Being drunk is _no_ excuse for anything except falling over.... In fact, I'm sat here in a bar typing this.... and I have a beer too.... OMFG..... It's not making me do odd things.....

3.

Quote:

---

logged into what I thought was my Di Soft Account

---

yet a minute ago he said:

Quote:

---

Having more technical computing knowledge than most people

---

Obviously not much experience...... Don't assume... Check!!!!!!

4. After he screwed up without being smart enough to test the deletion he just did, (which would have told him he might have messed up, thus allowing preemtive action, (calling Tony and saying "Jeez, I screwed up" before Tony discovered it himself)), he went to bed..... See Point 2.....

5. When challenged he tried to evade.....

6.

Quote:

---

my IP Address had been ‘spoofed’

---

If you're going to lie, try one that is actually going to work..... Spoofed is a bit silly when you claim what you did under point three.....

7.

Quote:

---

Once again my estimation of the strength of mine and Tony’s friendship was completely misplaced

---

Ah, you trust people over the internet...... Poor misled young man.... Nothing else to say.

8.

Quote:

---

With the benefit of hindsight I should have immediately told him the truth about what had happened

---

Oh dear.... what a concept.......

9.

Quote:

---

to try and establish communication with Tony

---

Tony is being a "wally" to and should grow up and be a man about this.... All he has to do is to ask to have it fixed..... But he won't.... He's such a man he wants the police involved.... Sorry, but he's as sorry as the "attacker"

The moral of this story is long and confused but it comes down to:-

1. It's just a damn game
2. Don't trust anyone on the internet
3. If you are given admin rights, know what the hell it is you are doing
4. lying to "cover your tracks" doesn't work with people that know the systems
5. Be men, (or women), about it: communicate: and determine if there is a way out for both.

OK.... Beer makes me woffle..... :D

Hydro

Still take the security precautions I suggested.....there's a good chap. I do not trust anyone, least of all myself :eek:

There is only one machine that I will remotely manage, and that belongs to a very close friend. we are about 230 miles apart, so it has to be that way...........he backs up to that (my) machine daily...we are mates....I know his mom, his wife his kids...............I trust him, but the box he uses is not connected to this one............my trust goes only so far...

However, if Colin deleted everything off that box, I would just restore from the CD backups and take the piss out of him :D he would only do it by accident..............I promised that I would look after him..........

Take care mate!

Tiger..

I trust you...and we have never met.......but apart from that I agree :D

Cheers

Wild:

Wild said:

Quote:

---

So whats the chance of all this in a 18 minutes i must add.

---

Implication, (that was never refuted): He has logs showing a full 18 minutes of activity.

The Attacker said in his "confession":

Quote:

---

I deleted all of my folders and files. After the last files were deleted, I logged out of Cute FTP, disconnected from the internet shortly after and went to bed in a bad mood.

---

A couple of points:

1. If he deleted his folders and files individually he would have had to notice that they weren't the same folders and files he had under his account, No-one can be that stupid, can they???? - but doing it individually _might_ have taken 18 minutes if he had literally hundreds of folders and files.

2. If he did a mass deletion he _may_ not have noticed that they weren't his folders and files...... But that would have taken a minute or less.......

I, for one, in the situation he claims, would not delete my files individually as if saying goodbye to each one as they go. It's a highlight everything I can and hit the delete button - "Thank you, Goodbye" - Logout - "Screw you"......

I'm afraid that your "buddy" is most probably still lying...... I think he did deliberately enter your account and systematically delete your stuff and when he lost his internet connection he has travelled a road of attempted deceit that wasn't working. His lengthy and over-detailed "final confession" is his last ditch effort to build a plausible story around the facts which, while accepting a reputation as a fool, gets him his internet connection back - which means more than his reputation in this small circle of people.

I would suggest - No Mercy.......