I want to "surprise" this hacker...
This hacker 62.21.5.89 (who has a broadband connection) has tried to anoy me for sometime now. :mad:
I have used NeoTrace and Retina 4.7.1 to get information about his internet supervisor and about his system (OS, open ports etc.)
But although I mailed the traceroute AND the Log file from my firewall to the abuse-section at the network his using nothing has happend and I still get intrusion attempts from him/her.
What I want to do now is to my self contact the so called hacker (e-mail or maybe send a message directly to his computer :fpissed: ) and I was wondering if this can be done???!?!?!
I REALLY appreciate any help!:) :) :hello: :
I'm going through the same thing ...
I host a webserver and quite a few routers here at home. As I work professionally with routers, I've come to understand that packet-level filtering, while great and granular, is not everything.
A couple days ago, I decided to check my access_log and secure_log on my webserver ... I was getting *plenty* of script attempts. Nothing that would do anything against me, but annoying nonetheless. I wrote to root@<isp> and abuse@<isp> and waited ... and waited ... and waited. I then found a template that went something like this:
> I would like to know if anyone has come up with a formal
> message to send to the netblock owners, something that may
> hold up in court if ever need be.
>
email:
abuse@XXXXX - Without prejudice I submit to you this Unsolicited Commercial E-Mail is from your user XXXX. UCE is unappreciated because it costs my provider (and ultimately myself) money to process just like an unsolicited FAX. Please look into this. Thank you.
general:
Without prejudice: I suspect you are the culprit of blah blah blah
It seems that this would be the best way to go.
HOWEVER ... I am working on a Perl script (Perl wizard I am not!) to:
* Auto-ban the offending IP from my network (both from the box and write a DENY entry to my border router,
* Post their IP and the corresponding attack attempt text to a "wall of shame" on my webpage,
* Send an e-mail to "abuse@<ISP>",
* Activate a hold-down timer on above such that if a response isn't had w/in 48 hours, it'll e-mail "abuse@<ISP>" AND "abuse@<1 hop closer to myself from ISP>" ... continue working down the line until it hits abuse@localhost ...
And I would imagine that this *should* stop quite a few script kiddies and/or rootkit'ers from impacting my network. Of course, this all depends on writing the proper heuristics to catch them in the first place! ;)
Anyway - what someone said initially, not to do anything illegal against them, is correct. I'm sure that ISP's have better (and more granular!) logging facilities than someone on a Windows box. ;) And I'm sure they'd be happy to utilize this if a user, say the next user who picked up that IP from the DHCP server ... or the REAL owner of the IP that was spoofed, complained about YOU hitting their box. Much better for you to give the offending ISP a copy of the associated logs, tell them to cross-reference time with their RADIUS server, and be done with it.
Hopefully this will help someone.
~N~
To add to what I said before ...
Admins can also be really pissy. I just had one write me back - he took my "I'm looking to ban your user from my network" as "I will attack your user". <sigh> I guess I'll never never ever try to help out trib.com again. :(
Anyway - definitely don't look to attack the cracker/hacker/guy who's had his box rooted - it'll end up badly.
~N~
