I've been hit!

This is my first post, hooray. I've always been very familiar with computers, programming, diagnostics blahblablah but I am now intrested in security and forensics for this reason:
Someone is messin with me. I have Norton Firewall installed on my machine, and it's picking up attacks from someone who is on the same campus as I am. I have their IP address, but I dont know what to do with it other than look it up on antionline ip lookup. Whatever advice anyone can give me would be great, I'm sure whoever is doin this will be suprised to have a 250 pound jocknerd knockin on their door. Thanks.
By the way, I'm not intrested in hearing about what of kind a newb I am or whatever

The more appropriate question is just what do you plan on doing? If indeed someone is attacking you, striking back is not much of an option since you are just going to open yourself up to liability and whatever trouble that may come after. Your best option would probably be to collect your logs and take them to the campus computer geek office and report to them what is going on. They'll be able to work with you to get this matter resolved.

What types of things was your firewall picking up?

Yeah. I was being sarcastic about actually knocking on their door, but what if I wasn't on a campus or network with a helpdesk or techsupport? What if I needed a name or a buisness name to file a lawsuit? Not that I plan to do any of this, its just that I dont like the idea of someone trying to get into my computer without me being able to know whos on the other end. Much like a peeping tom looking at you through a one way window, you know what I'm saying?

orgname, orgID, address, city, state and all that. but the IP lookup tells me its coming from kansas city, which is different from all the other stuff there is. So could it be someone is kinda bouncin around trying to get into my pc?

It could be any number of things. The most likely situation would be that the ip is part of a block assigned to an isp based in one region, but assigned all throughout a larger part of the country to the isp's subscribers.

The end of this situation would be quite similar to the campus problem. If you suffered a real break in you would need to pull the power plug on your box and contact the authorities so they may do a forensic examination and collect the appropriate information. If it's not enough for all that the most you can hope for is figuring out what isp owns the ip that the traffic is coming from and contacting one of their network admins via the information found in a whois of that domain (www.arin.net) and having them further investigate the users activities and taking the appropriate action.

Just a side note, Juridian if you did suffer a real break in and you needed to collect forensic evidence you would not pull the plug on your box. The power down could have undesired effects. You would disconnect from the network, note any running processes, and what may have been going on. Then when your local network guru or whomever you call for help arrives they can take the appropriate measures, i.e. complete disk to disk dump etc.

Just my spare change
AZE

Quote:

---

I have Norton Firewall installed on my machine, and it's picking up attacks from someone who is on the same campus as I am. I have their IP address, but I dont know what to do with it other than look it up on antionline ip lookup

---

How do you know this person is on your campus?
if you have their IP and you know that it belong on your campus.. Why do you need to do a IP search?
Surly the Campus Sys Admin would be interested in hearing your problem.. knock on his door with your firewall logs.. and let him/her worry about it..

EOS

the firewall tells me that its from the campus, because it says the university name in it, and the IP the same as mine except the last few digits. but the firewall locator tells me that its in kansas city, which is 1000s of miles away....

the IP locater usually relies on "Whois" database info.. the registered office for the campus domain is probably in Kansas..

Take the prob to the Campus Sys Admin..

EOS

you can trace the ip with visual route or simply running of the command propmt tracert IP address. which will give you the exact information about the attacker. Next time when your firewall shows that an attack is being launched on ur system ping the IP address or trace it as mentioned above, probably the person is doing Spoofing and pretending to be someone inside ur network.

ok see how visual route goes on this one..

Quote:

---

203.51.230.138

---

best of luck.. I have a beer that says you don't even get the correct state in australia..

cheers

brisbane somewhere near a place called bigpond??? am I even close?

sitting back sipping my beer
can anyone get close to me I would like to know 68.224.227.57

PoSer: Nevada NV 89191-7073, or NV 89496-5000? Just a guess, worth a try

close but still about 150 miles out?
thanks for trying though.

Aze:

Quote:

---

Just a side note, Juridian if you did suffer a real break in and you needed to collect forensic evidence you would not pull the plug on your box. The power down could have undesired effects.

---

I, and the general consensus of the computer forensics community, would disagree with you there. The intent is to preserve the system as it stands once all non-invasive investigation is complete. Thus you do not even disconnect it from the network. If it is being destructive you forego the non-invasive investigation and, literally, pull the plug. If you disconnect it you may trigger an event that alters the state of the box.

Then you remove the drive, place it in another computer with a different drive that you boot from and you make 2 images, one for investigation - thus it will be changed - and one as a backup of the original state should you need to create another image later. The original disk is then protected and secured with a log of what has happened to it and another log of it's "travels" should it be required to be moved. Then you can begin the real investigation.

Hi rmcgoo

Welcome to AO

You are getting connection attempts from "someone" apparently a long way away.

1. Is the IP address always the same EXACTLY? that is, are all four sets of numbers identical?
2. Do you know anyone you can trust, and find out if they are having the same experience?
3. Are the first 2/3 blocks of the IP address the same as your ISP?

The reason that I ask is that there are a number of malwares (virii/worms) that are "network aware" and look for "sub-nets" to spread along. At one time I was getting 500 hits/hour because of this. All from machines in the same ISP address block as myself.

What I am asking is, have we established that this is a deliberate attempt to attack you or is it just some "girl's blouse" with an unpatched NT/2k/XP box who has become infected and does not even know it? In that case question #2 and #3 above are relevant.

Question #1 is not conclusive unless the answer is "yes"..........in that case you are the target and they are probably using cable (I don't know anything about satellite I am afraid).

If you are using 56.6 or DSL and disconnect regularly, you will get a different IP addy each time, but I would expect the first 2 blocks to be the same, certainly the first one (I am going by my English experience here). This would be inconclusive. If there is no change in the attackers addy over (say) 30 minutes then I would say it is an attack on you. If there is a slight change (last 2 blocks) then I suspect a net worm.

"250 lb jock knocking on their door"..........hmmmmmmmmmm......Tiger Shark and I have done some behind the scenes trading......he gets the ticket sales and I get the hot dog franchise :D

Good luck

And I'd like to add some other advice:

Please do not publish IP addresses of yourself or those who are bothering you as not everyone that visits AO is ...errr.. shall we say ethical?

Quote:

---

Originally posted here by aze
Just a side note, Juridian if you did suffer a real break in and you needed to collect forensic evidence you would not pull the plug on your box. The power down could have undesired effects. You would disconnect from the network, note any running processes, and what may have been going on. Then when your local network guru or whomever you call for help arrives they can take the appropriate measures, i.e. complete disk to disk dump etc.

Just my spare change
AZE

---

Well, actually there are a couple of recommended methods according to all my reading, training, etc. It really all depends on if you are going for live acquisition or if you want to capture the hard drive in a single state.

Pulling the power cord is recommended by many agencies (such as SANS/GIAC, ISS, etc) because you never know what may be set off on the drive if you try an actual power down or if you pull the netcable. There is the possibility that there will be a piece of malware looking for the connection with the intent of wiping out the data you need (also why it's recommended that incident handlers carry a hub with them).

It's just the old 'pull the plug' dilemma rearing it's ugly head....

Juridian: Ok.... I can agree with that. Since Aze was talking about plug pulling I stayed on that subject. But yes, you are right if you are looking to capture live data on the wire.... That was my point about the non-invasive evidence gathering/if it is doing harm with regard to pulling the plug.

It is a dilemma, but I tend to fall on the "Pull and be damned side" simply because a proper shutdown does alter the registry hives and also I have no idea at this point what logic bombs the little devil might have planted..... I would leave it until I see no drive activity though if at all possible to minimize the chance of damaging the disk myself.

rmcgoo,

Don't forget that sometimes network devices actually create traffic that may match rules in your firewall. If a rule matches an alarm goes off.

Looking at the logs, the address has used a portscan attack twice last night, twice this morning. I bet this guy got to work last night, went to bed, and got back to work this mornin. I doubt its any kind of worm or virii or whatever because they dont get sleepy like mr hacker.
Nihil-
Same address exactly, i talked got my friends IP's that live on the same floor, and our addresses our ###.###.###.### with the last 3 digits being within 30 of eachother. The hacker is 27 greater than mine.

Quote:

---

Originally posted here by MsMittens
And I'd like to add some other advice:

Please do not publish IP addresses of yourself or those who are bothering you as not everyone that visits AO is ...errr.. shall we say ethical?

---

Thanks for the advice but here's my ip: 62.131.220.214

Nibble, nibble, mousekin,
Who's nibbling at my housekin?

Thanks rmcgoo,

I am sorry to have to say this, but there "is a rat in the granary" so to speak :(

I just had to logically eliminate the "noise" that might be created by the remnant infections of recent worms?

I would now go to the sysadmins with your logs..........

Good luck