Printable View
I have an online stalker who keeps trying to hack my computer. I have protected my computer with usual protection and more... but the guy keeps trying it... I´m thinking of sending him a message or trying to make him stop. What do u think should I draw the line and take charge? If yes how do I go about it?
MrEsco
The first thing you should do is start logging the attacks. Once you've got a hefty log with the person's IP address or addresses, and a log of the what attacks the person has been using, you should contact appropriate people in law enforcement.
Remember, don't do anything yourself. If you fight back, you are just as guilty as the guy who's trying to hack you. Let the law enforcement deal with him, and you'll be better off.
yeah i agree with that. batten down the hatches,lock down your security tight as possible and log the attempted connections...another alternative might be to show said logged attempts to this individual and maybe itd wake em up and theyd leave ya be..but then if not youll have the logs to show the authoritys.
Taking it to the authorities may be of value, but if they are hacking you, they may request proof of damages before they will do anything with it. If you have a firewall logging the attacks, get the attackers IP and check it out with a whois, http://www.samspade.org/, this will provide you the name of ISP associated with the IP in question. Next step is to report it. Send a copy of the logs to abuse@offendersisp (not all ISPs have an abuse dept, but many do, if this address fails, go to the ISP's site, get the tech support # and they will give you a method for reporting to them)
If your logs truly indicate malicious intent and the ISP fails you, try working it through with the abuse department of your own ISP, they will often times work with you. Alot of this takes much prodding to get them on it though.
Good luck, hope this helps.
Regards.
I too agree with chaoswraith the first thing you have to do is begin accumulating evidence of this individual’s attacks on your system. The more evidence you have the better. Assuming you get this person’s IP from the logs of one of the attacks you should be able to find who this individual’s service provider is and if legal action is unnecessary or not an option then you can at least report this person to their provider and their service will be cancelled. But until you have the evidence to back it up all you can do is tighten every possible way in and entrench yourself with you gather your proof.
if you lock down and log attempted connections it can be passed off as nothing but a random port scan at best. i say go out and buy the cheapest pc you can find, leave it wide open, still implementing strong logging, and let him/her trash it - then take action. this may be a little vindictive, or staged - but you're more likely to get the legal action taken that you desire.
u should log all attacks and IP addresses if it is persistent go 2 samspade get s/he ISP network they use and send them a nice email *not abbusive its not the isp`s fault* with u r logged attacks and possibily soome action will be taken from there but dont reataliate 2 the attacks that would just lower u 2 there level and possibilly get u a criminal record if u get caught
taking it to law enforcement wont work i think.. taking it to the isp has much better effect then law enforcement cuz he will probably get a warning email.. and it'll scare him off..
Good Luck..
ThaVolt
Most ISPs now have it in their TOS that if an account is found to be doing things like port scans or other nefarious activities and it can be proved (your firewall logs), the account will be shut down immediately. At least, that's what Tampa Bay Roadrunner has in its TOS.
MrEsco, to what ISP do you subscribe, and to which ISP does your stalker subscribe? ISP's like Planet and XS4ALL take this very seriously. Further more, contrary to what ThaVolt says, -do- report this to your local police station, but make sure they report it to a section called 'Computercriminaliteit." You cannot report to them directly, but your local police station can. Tell them this, most of the ordinary officers simply do not know.
Quote:
Taken from Justitie.nl
Wat kan Justitie doen tegen computercriminaliteit?
Het Ministerie van Justitie en het Openbaar Ministerie willen de recherchefunctie versterken. In dat kader worden in 2002 verschillende projecten (w.o. werkprocessen in opsporing en vervolging) afgerond. Daarnaast is de politie begonnen met de uitvoering van het nationaal Actieplan Digitaal Rechercheren. Dit moet de opsporing in staat stellen om adequaat op te treden tegen alle vormen van digitale criminaliteit.
The law enforcement tactic mostly doesn't work. I had this twice and both times they said portscanning isn't illegal. Once it just didn't melt my router with an ddos attack because i pulled the plug out . The thing droby10 sais is a good idea.
Mailing the ISP always is worth a trie.
Vorlin & Guus are giving you solid advise. Your first step should be your ISP and the intruders ISP (if you have it). Like they said, ISP's take abuse serious these days and if you can prove (your log files) that one of their subscribers is abusing the system (and you), they will shut him down. Law enforcement would be your next step, if the threats continue. Again, you will need to compile as much evidence as possible (log files again and any e-mails you may have received) to prove you are being threatened and that the individual on the other end of the IP address or e-mail address is the one attacking you.
Good Luck.
Another thing you can do to help is report them to incidents.org, cert.org, or a few other sites like that focus on security and following up in events like this. Usually having SANS or a few other groups like that asking an ISP questions about its customers is more than enough to have them re-evaluate their slow or no response...
Another site that is, at least to me, fascinating: http://www.dshield.org/
Distributed ids...
neb
thx for the info people... I have send an e-mail to the ISP. But he already trashed a couple of my hotmail accounts by changing the passwords. But the funny thing is that I found his hotmail account. I´m waiting on respons from the ISP and I will probably take it to the law enforcement. Is there a way to get my hotmail accounts back? He even changed the secret answer...
Do you know where this person lives? Just kdding! I would set a trap with a honey pot. Let the person get in and do some dammage or take some files. This will be grounds for legal action.
i have had problems with hackers wanting to gain access to my pc (for what gain who knows) and i think i know the person doing it. i have logged and reported every violation they did. eventually it stopped from one IP address and started from another. so i started reporting again. come to find out, it wasnt who i thought it was at all, as the second and following attacks were from other countries. i know the possibility is there that they could have spoofed their IP address, but so is the possibility there is more than one hacker in the world. never underestimate your enemy. firewall logs are all well and goodfor port scans and the like, but what can someone do against buffer overflows, Denial of Service attacks or other exploits that may not get recorded in a firewall log? I have Windows XP and it has a nice event log, but being a newbie some of that stuff is greek to me. and when you click the "For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp." link, all i get is a page telling me "thanks for submitting a question we know nothing about" or something similar. there should be a tutorial aimed at teaching people how to read firewall logs and system performance logs. anyone know of any?
There is a good book put out by SANS on this, I will try to find out what the title is...
Found it: Intrusion Signatures and Analysis, Stephen Northcutt, et.al, New Riders, Indianapolis, Indiana, ISBN 0-7357-106305
Kind of dry reading at times, but I found it fairly informative...and it is pretty much what you are asking for...
Neb
The MS article for deciphering event logs is KB article Q308427. It should give you at least some idea of how to read the event logs. The following url has a pretty good article about reading firewall logs: http://www.robertgraham.com/pubs/firewall-seen.html
Hope this helps!
Have you tried changeing ISP and checking to see if by chance you have been trojaned?As most stalkers try and put a trojan on thier victims system.The cleaner at >moosoft.com/ is a very good trojan cleaner.
just log everything s/he does, make sure you tell his/her ISP first, give them a day or two and if they don't do anything then go to the proper authorities, im not sure about the laws over there but i think they are a little bit softer on the computer related crimes, after all thats where some of the best crackers are, just because its harder to prosecute them. ;)
a common mistake made by even the best...
Hacker - 1.One who is proficient at using or programming a computer. 2. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities. 3. One who programs obsessively. 4. An expert at a particular program.
Cracker - 1. One who makes unathorized use of a computer, especially to tamper with data or programs. 2. An individual who attempts to gain unauthorized access to a computer system.
as you can see, what most people refer to as a hacker is really a cracker and most people dont even know they're wrong