Printable View
"Sometime on Wednesday evening someone 'spoofing' my IP address went into Wild =SOD='s Webserver and deleted all of his files. As a result my main ISP account has been suspended
does this sound plausible -- i thought that maybe that this person was guilty but thought id check it out
I don't know about spoofing the ip address, but they could have taken control of the computer and used it to attack the web server and delete the files. Why do you ask?
Possible to carry out the entire attack on a spoofed IP? Yes.
Probable.... Not really.....
I would suggest you take a close look at your box and it's security.... You were probably used as a "proxy"/"zombie".
Since your ISP has seen the logs of the attack taking place from your IP ask them for a log of all incoming connections to your IP at that time...... If there are incoming connections to your machine during the attack period you have grounds to have them reinstate your connection - if you fix your machine and it's security. If they have no logs - Change ISP anyway.... If they refuse - change ISP anyway.
this fella insists that he is innocent although several think he is not -- it has actually become an interesting read -- the person in question noted that he was spoofed and that he had nothing to do with it although the logs of the server show that his ip number was systematically deleted accept for one (a hidden log) My question to him was if the hacker spoofed his ip why would he bother erasing the tracks -- it wouldnt belong to him anyway. this person refused to answer the question so i thought id get another persons perspective
thank you for your time I can link the site where this is going on if youd like to read
Yes it is totally plausible, if the circumstances for deleting the files did not require your ip to receive any information back. It would be a little difficult but if the server was configured improperly and sequence numbers could be determined then it could be done.
Or you could have been compromised by the attacker and he did everything from your computer. You dont have a proxy running right?
And if I did hack from a compromised machine I would still try to delete all your logs just in case the 'compromised computer' had logs and eventually you could get back to me. Erasing logs is mandatory for any good hacker to prevent any kind of back tracing wether you came from another computer or one at the public library.
Just because the "attacker" deleted the server logs from a machine he uses as a zombie doesn't mean crap. If you spent the time to build something you aren't going to risk it being torn down willy-nilly... You want it to stay.... so you delete logs so you can use the resource again.....
As far as this being a spoofed attack..... NOT.... He deleted multiple logs with no feedback and only missed the "hidden" one.... Nope.... He had feedback.... The "attacking" machine is compromised..... If it isn't..... You'll never catch the guy..... He is Uber L33t but he never types that way.....
The computer owner is innocent.... He's hacked and he doesn't know it..... But he's innocent.
so it wouldnt really matter then that they deleted it -- that wouldnt suggest a guilty conscious on the part of the person suggesting he did not actually hack the site and that instead his ip was spoofed
If he is guilty then he should quit "whining"...
If his IP address is all over the log files he may, quite probably be innocent..... The percentage of his innocence, worldwide, is higher than his pergentage of being guilty.... But his IP is on the log files and he can do little to prove his innocence....
My honest suggestion to him, since he doesn't seem to know what he is doing...... Reformat the whole system, (ok.. have someone competent do it for him....), reinstall and find a new ISP _after_ he has put appropriate security devices/software in place.....
Hi all,
I Thank Hydro for his post and intrest in this matter too ;)
As Hydro said this person said his ip was spoofed ??
After i receaved a complete log from my Hosting company I reporting this ip to there ISP
Since then this person i has now claimed his ip address has been spoofed ??
Ok say this person was spoofed whats the chance of them find the right User name and Password the 1st attempt to enter my site to start deleting files ??
Also can this spoofing use a FTP program to delete these files with out the real ip address showing its self on the main log as this person did use a FTP program to delete all these files
according to this log.
So whats the chance of all this in a 18 minutes i must add.
Would be very greatfull for any help on matter ;)
Wild.
I think you are confusing what spoofing really is...
SourceQuote:
spoof Last modified: Tuesday, February 25, 2003
(v.) To fool. In networking, the term is used to describe a variety of ways in which hardware and software can be fooled. IP spoofing, for example, involves trickery that makes a message appear as if it came from an authorized IP address. Also see e-mail spoofing.
As Tiger Shark pointed out, it is possible that his ip was spoofed, but not probable.
What Tiger Shark is suggesting that this "attacker's" machine was broken into first, and then the real "attacker" then used the supposed "attacker's" machine as a launch pad to cause damage to the other machine.
If the person was smart enough to kill the logs... then I'd hope they'd also be smart enough not to do it from their own machine.
In other words, his machine was used as a zombie.
SourceQuote:
zombie Last modified: Tuesday, February 05, 2002
(1) A computer that has been implanted with a daemon that puts it under the control of a malicious hacker without the knowledge of the computer owner.
To really find out, you'd need to get a hold of the machine that was used for the attack.
Then you can perform a forensic analysis and see if that machine had been broken into, has trojans on it, examine logs, etc.
If this person claims he was spoofed... then he might not even know what it is. I'd be very difficult to "spoof" a whole attack. Not impossible... just highly improbable.
Wild: I'm assuming you are the "victim" here, If I'm wrong please tell me....<s>
You may be making a _huge_ assumption as to how this person entered your system.... There are many exploits that result in admin/root on a system immediately.Quote:
Ok say this person was spoofed whats the chance of them find the right User name and Password the 1st attempt to enter my site to start deleting files ??
If your FTP server is not set up correctly I can bounce my attack on someone else off you, legitimately and without having to "crack" your box, and the resultant victim will see you, and only you, as the attacker.Quote:
Also can this spoofing use a FTP program to delete these files with out the real ip address showing its self on the main log as this person did use a FTP program to delete all these files
according to this log.
It took that long... I'm a little surprised.... ;) Seriously, access was made, a determination of what was being logged took place, (though not perfectly), logs were "cleaned" and a web site defaced in 18 minutes...... that's not bad.... hardly a novice, no expert either, but 18 minutes is a pretty short time when you have to explore an unfamiliar system.... So I'd suggest that the person you have had "cut off" was _probably_ not the culprit... Though I will happily admit to being wrong....Quote:
So whats the chance of all this in a 18 minutes i must add.
I'd love to see a _sanitized_ version of the log files..... Can you manage that? Just replace the attackers IP/DNS and your IP/DNS information with something innocuous like Attacker and Victim.... Do a search and replace on the pertinent information and post it here please.
This is all very exiting stuff!
I have a few observations/questions which don't seem to have arisen from the thread yet?
1. I am inclined to agree that whilst "spoofing" is possible, it is highly improbable, particularly for this sort of activity. One of the main objectives of spoofing is to gain trust, rather than hide identity, although it is also used by spammers to hide their ID.
2. There is mention of finding a correct User ID and password etc. in 18 minutes, and destroying a website. How do you know that this is the attackers first visit? If your security lets anyone wander around your site and delete files, they could have had weeks to find user profile files and crack them? Then launched their attack. Whose profile and password were used? The point I am making is I might create a valid account (sorry we have no info. on the nature of the site and its access procedures) and then use that as a part of my attack vector? It would appear totally unrelated, but save me all the preliminary effort of cracking a UserID and password. If this is just a site with a single webmaster/owner ID, then what about the security on the machine that is used to maintain the site.......it would only take a simple keylogger?....................
3. A "zombie" attack using "botware" sounds quite likely, but we have no information about the machine that was used for this attack. What about if the attacking machine was PHYSICALLY compromised? A scenario might be that kid brother skiddie loads software he has been given, then uses it to cause damage. If it has been in anyways well-crafted it would have some basic anti-detection algorithms in it, like deleting obvious log files?
4. What is the relationship between the person who claims to have been spoofed and the website/webmaster/group in question? Most murders involve people who know eachother? If the person claiming to be spoofed is a total stranger, I would say that they are almost certainly innocent of the attack, at least.............as for their security :rolleyes:
5. Are we sure that the "attacking machine" was the attacking machine. Could it be that the supposedly spoofed person has been careless with their internet details, and someone just used their account? The only people who would know that would be the ISP, from the line that was used to connect? I very much doubt if they would bother to check that, unless specifically asked to?
6. Do the victim and alleged attacker use the same ISP? The attack could be totally automated? Network aware malware might find the website via the ISP address block/subnet? Every malware has a first victim, so this could be something new?
7. Motivation?.................who really hates you enough to want to trash your website? and why?
Just a few thoughts
Cheers
Nihil: If the chap has 18 minutes of logfiles this was a manual attack rather than an automated bot/worm/script..... Unless the attacking machine is an 8086..... ;)
18 minutes is a long time to hold your breath but is isn't long to dig around an unfamiliar machine and do a good job of deciding what is running and what are log apps. It's all very well saying "oh it's a windows box - delete the .evt files" but I have boxes where if you do that you just took the "bait", because my event logs are somewhat cosmetic. The real event logs are already on a different box that only accepts connections on one port - so you had better have a crack for that app too if you want my logfiles to go away.
I'm not pooh-poohing Wild's seeming determination that the guy who owns the "attacker" is lying but the odds are quite high that he isn't - he may know the term spoofing but he may not understand it - See Phish's post - good explanation.
Also, I wouldn't look too hard at people who know Wild..... On the internet the prinary _assumption_ is anonymity..... and people attack boxes across the world with no idea that it might be their old Aunt Millie's box over there in Hackensack NJ where she emigrated 5 years ago.
Wild.... can you come up with sanitized logs for us..... It would be interesting to see them even if we end up being able to conclude any more than you already have.
It is very easy to spoof the IP. If the ISP has DHCP all you must do is to change your MAC adress and IP adress with the victim's adresses. In windows you can do that by changing the properties of TCP/IP protokol. In Linux just type ifconfig eth0 hw ether MAC_ADDRES up.
ReSpEcT ...
Barove: You better make sure the other box is off when you do that or you will cause errors and the box that is already on that IP keeps the connection while your NIC is disabled 'cos you "came in second". You're also assuming that they both share the same ISP/subnet because you can spoof my address all day and never see a reply because they will be routed to my subnet not yours.
Spoofing attacks are very possible but require a higher level of skill and knowledge or a well written program and a knowledge of the exact program and version you are trying to exploit since the whole attack is blind - you see nothing as the attacker.
Now if you own another box you can spoof to that box's IP and pick up on the replies with a sniffer on that box, (bounce attack or half-blind), but why bother other than for an academic exercise. If you own the other box go ahead and use it - you have to connect to it anyway so the connections could be logged somewhere.
Thx for replys
ok so this person may have been spoofed would this leave any traces on his pc/hd, to say his ip was spoofed ??
Or would it only be on the machine that did the attack its self
Tiger Shark, I thank you for your input here but this is a active case right now would not be right for me to disclose any evidence that i might have hope u understand,Quote:
To really find out, you'd need to get a hold of the machine that was used for the attack.
will post the log file like you asked when the time would be more sutable ;)
wild
Wild: Determining whether the "attacker" was the machine used in the actual event would be a whole lot easier if we had the box or if the ISP does complete logging and archives those logs - which they should.
In the long run what you are asking is impossible to determine for a fact without seeing the evidence. Suffice it to say there are a million boxes out there that are there for the taking and many get taken daily. All I can tell you with my experience is that nowadays the chances of the owner of a box that attacks another site being the actual perpetrator are remote.
I would give this guy the benefit of the doubt but request that his ISP monitor his box more carefully. Unless you know him personally and then it is a simple decision on whether you feel you can trust him.
Still looking forward to the logs and any other stuff that you can show.
Another oddity in all of this is that the person who reportedly has had their ip spoofed and the victim of the attack know one another and the site deleted related to a common interest (gaming).
why would a hacker or should i say how would an attacker know that information unless they are known to the two parties or the person claiming to have been spoofed?
that i find very perculiar any ideas there?
Hydro: Easy one..... ;)
Scenario:
1. The victim hosts a Game server.
2. The "attacker" plays there.
3. The real attacker plays there too.
The real attacker is pi$$ed at the attacker and through other means discovers the IP of the "attacker". (easily socially engineered). A quick scan of the machine and a search for an exploit and Bingo... He owns the "attacker". Then, to do the most "harm" he uses the "attacker's" machine to attack the game server thus getting the "attacker" banned and cut off from the internet.
Hardly far fetched at all.... Probably happened a dozen times this year alone somewhere.
However, now you have made it clear that these two know each other.... All bets are off..... Computer security becomes a whole lot more difficult when you bring personal relationships into it. It takes away a lot of the objectiveness if you know that person A can't stand person B and visca-versa while A is accusing B of hacking. It becomes too easy to allow that knowledge and any comments about the two of them that have passed to interfere with the objective process of determining what _really_ happened. It's too easy to find yourself trying to make things fit your preconception of what might have occured - which, with voluminous logs etc., is all too easy to do.
I still would like to see the logs though Wild...... ;)
Tiger Shark yes, i didn't check it ... the victim's box must be down .... and I post a traffic sniffing i LAN :)
Sorry to appear a "wet blanket" or prophet of doom.
The general concensus would seem to be that this is not a "spoofing" situation. It is either the guy is lying, or he has become "owned" by some sort of Botware.
We have a website hosting games that has certainly been invaded by a malicious person who has had admin or close rights (not that that seems to bother most malware these days?).
We have all the members of the gaming group visiting the site, which to them is a "trusted site" They interact with the site and fellow gamers in an atmosphere of trust but, unfortunately, there is a rotten apple in the barrel?
I would strongly recommend that ALL members of the group carefully check their own boxes for keyloggers, bots, trojans and so on, to ensure that they have not become owned as well.
Remember your firewalls were set to allow the gaming site, and antivirus applications are not good at detecting this type of software as it is not viral :(
http://www.winpatrol.com WinPatrol shows you what is running, in your start-up and so on.
http://www.diamonscs.com.au Get the trial of their anti bot/trojan software. Might as well get RegistryProt whilst you are there.
Do a search for "pest patrol" and get the trial for that
http://www.swatit.org SwatIT v2.1 A very thorough spyware detector, takes a long time to run!
http://www.spywareinfo.com/~merijn/index.html "HijackThis" Will show you what is running or can run on your machine (be careful........it shows everything...you have to decide!)
Make sure everything is up to date and run it in safe mode.
http://www.styopkin.com Keylogger Hunter..............you never know with "rotten apples" ;)
Guess that's enough paranoia for one session?
Hydro, if you agree you might let the others know?
Cheers
for those who had the input here thanks so very much it was very interesting and informative
THIS IS THE PERSON WHO EVERYONE THOUGHT DID IT FINALLY OWNING UP
please review and give insight if youd like
This is a statement surrounding an alleged accusation of the suspension of an Internet Account and a report of being involved in a ‘Hacking Attack’ on the evening of Wednesday 29th of November 2003, reported by Mr ....... to Energis..
So that I can explain the circumstances that arose to the alleged ‘hacking’ report being produced, I feel I must include background information as it will become apparent as to the pertinence of the situation as the statement proceeds.
GAMING COMMUNITY
I belong to a gaming community based around a game from Nova Logic called Delta Force 2 (DF2).
The community comprises of groups (referred to as ‘Squads’ or ‘Clans’) and players who play the game as individuals. Players that belong to Squads generally use ‘Tags’, a form of identity marking and a symbol of their belonging. ‘Tags’ are defacto a shortened version of the squad name.
The Player naming convention is “known player Name” plus “The Squad Tag”
For example: My player name is S, my squad is called ....and the Squad Tag is =SS=. Therefore my online name when actually playing the game is =SS=.
There are hundreds of squads and it is not uncommon for squads to spend an extraordinary amount of time, effort, money and energy on all facets of the game (hardware, software, web space, websites, message forums, automatic statistics pages etc.).
I have been a DF2 player since Mid 1999.
On April 29th 2003 I formed my own squad called Star Snipers, which in due course increased in numbers as I and subsequently the newer members allowed applicants to join, or denied the application to join as we deemed appropriate.
The pertinence of his section is that I am the Leader of Star Snipers and Tony (Mr is the leader of one of our main rival squads called Snipers Of Doom (=SOD=).
In recent times there has been a growing belief that players from =SOD= cheat when they are playing in a match. This has led to friction developing between certain members of both squads, escalating into what is now almost an all out virtual war.
TECHNICAL ASSISTANCE TO THE INDIVIDUAL
Having more technical computing knowledge than most people, I have often found my services to be in high demand and receive requests for assistance with Computing matters on a daily basis, whether it is within the DF2 community or in ‘the real world’.
In the real world it is straight forward. The machine is readily to hand and therefore causes no access problems.
In the ‘virtual’ world this is obviously not the case, one must perform the required tasks remotely i.e. over the Internet. I have an avid interest in computing and enjoy helping people who are in need. It gives them a service which is free of charge and it supplies myself with a continuous opportunity to further develop areas of expertise.
I have, in the last four years or so been voluntarily and willingly provided with access by people to literally hundreds of personal machines or web servers from all over the world. In order for me to undertake the assistance the person requesting the assistance has always volunteered the information needed to log in, such as Login name, password details, server details etc.
This is also pertinent to this ‘case’ as Tony willingly gave me the details of his log in and account password.
For those that I do undertake tasks for I always inform them on the 1st occurrence that they should either uninstall or disable any 3rd party application that we may have used and change any password type login information that we may have used during the session we have performed the tasks in. This is supplementary advice in addition to that which they ‘agree’ to when they form contracts with providers and server resellers.
WHAT ACTUALLY HAPPENED
On Wed 29th October 2003, there were matches (called ‘Team Death Matches’ (TDM)) scheduled, in a pairs tournament between my squad (=SS=) and Tony’s squad (=SOD=).
I am the manager and administrator for the tournament. All tournament and =SS= squad files are held on my web server space, provided through Di Soft Hosting.
During the course of the evening I was bombarded with people contacting me by MSN Messenger (Online near-to-real-time Text driven application) or on Ventrillo (Voice over IP driven) communications applications. The nature of the complaints were mainly accusations of =SOD= players using third party applications to give them unfair advantage over other players whilst playing in the DF2 Matches (Cheating in other words).
Why anyone would cheat in a game is an exhausting subject, but with an inexhaustible list of reasons. Suffice to say that it has been an emotive topic and point of contention within the wider community for as long as I have been playing the game.
Late Wednesday evening I had quite a lot to drink and reached the end of my tether. I decided enough was enough. As I previously mentioned I was almost at the end of my patience anyway, and this perpetual scenario of bickering, accusation and frustration was the straw that broke this particular camel’s back.
I started my CuteFTP (File Transfer Protocol application) and logged into what I thought was my Di Soft Account. I did not realise it at the time, but I had actually logged into Tony’s account with Di Soft. I would like to add at this point that once an account entry has been set up in CuteFTP, it is literally two mouse clicks to complete the log in procedure. For additional clarity I shall provide an image of my FTP Site manager screen:
Image1 – Site manager for Mr ........ FTP and settings.
Image 1 shows the highlighted entry in the left hand pane for Tony’s Server details. To enter a server at this point all is needed is to press the ‘Connect’ button on the button bar at the foot of the screen.
My FTP account with Di Soft is directly listed above that of Tony’s. as you can see and I have it listed as Di Soft Main. Clicking on that entry followed by connect would have taken me into my account.
I have on several occasions been requested to provide assistance from Tony in matters relating to the setting up of Forums, Scripts, DNS Forwarding, Statistics applications etc.. when he has been incapable of being able to ‘work out how to do it’ himself. Each of the instances requires me to log into his web server in order to carry out the tasks he wishes me to undertake.
Tony has sufficient knowledge to go about normal day to day administration tasks and his knowledge and expertise over time has improved accordingly, however he has in the past lacked the technical expertise to be able to undertake the higher level functions of computing and engineering matters, which is were I have been requested to assist. Tony provided to me the login details needed to perform the tasks.
As I said, I entered what I believed to be my account with Disoft, and when presented with the top level FTP menu (which looks the same for every Di Soft Account) I deleted all of my folders and files. After the last files were deleted, I logged out of Cute FTP, disconnected from the internet shortly after and went to bed in a bad mood. For clarity Image2 shows what my FTP Account looks like when connected and viewed online:
Image2 - CuteFTP for Mr..... Di Soft Account
On Friday 31st October 2003, I ‘spoke’ with Tony on MSN as I noticed that his forum appeared ‘off-line’ and asked him if it was a problem that I could assist him with.
He told me that someone had ‘hacked’ into his forum and destroyed his files and that he had made a complaint. He also added that the Internet Protocol Address (IP Address) of the attacker had been recorded and had been traced. The company that owned the Account that the IP address was called Energis and that they were locking the account and would investigate the matter. At that point I was supportive and offered any assistance that I could give to assist in getting his Forum ‘back on its feet’ in a timely manner. He said that he was ok and could manage.
Approximately 30 minutes or so later my Internet Connection stopped working. My Internet Service Provider (ISP) are Freeserve so I contacted them as the indication presented to me was that my account details could not be recognised. Freeserve told me that my account had been ‘locked’ and gave me a reference number (Ref: 00000) and telephone number (00000) to contact Energis (who are Freeserve’s account providers/managers). It was at this point that the dawn of realisation started to draw upon me as up until then I did not know that Energis provided this function.
I contacted Energis and was presented with an answering machine. I left the details as requested and waited for a call to be returned from Energis. When contacted by Energis they then informed me that my account had been ‘locked’ as it had been reported of being involved in a ‘hacking’ attack. They would not discuss the matter further and said the account would remain locked until an investigation had taken place.
I then rung Tony but he was not at home. I immediately sent Tony a text message to his mobile phone letting him know that my account had been locked and was being blamed for ‘hacking’ into his server. Later that evening Tony rang me and we spoke at length about the situation. He said that he had informed the Police and that he had nothing much further to say about the matter until the investigation report was produced by Energis. With the benefit of hindsight I should have immediately told him the truth about what had happened, but did not do so, as I believed that as soon as he knew that I was ‘in the frame’ for deleting the files and folders he would dismiss the matter out of hand, withdraw the complaint and that would be the end of the matter.
I compounded and complicated the matter by posting a message in a Message Forum saying that my IP Address had been ‘spoofed’ and I had been set-up and expanded on the consequences should I be found guilty of ‘hacking’. I thought this would force the issue and bring any charges to an immediate halt. Once again my estimation of the strength of mine and Tony’s friendship was completely misplaced. Over the weekend, the situation developing in the message forum went from bad to worse. It became more and more apparent that Tony was not going to help me by having the complaint withdrawn, so I decided to ‘come clean’ and on the morning of Monday 3rd of November 2003 I spoke with the Police and Energis, as the whole thing was getting completely out of hand.
I explained the situation to Energis and they in turn called me back, informing me that they had sent an Email to Tony. Energis said that the contents of the email explained the actual events listed above and gave him until Friday 7th November 2003 to decide whether he still wanted the complaint to stand or the investigation to still take place. They added that if they received no reply by Friday 7th of November then they would take it that he did not want to proceed with the matter.
On Monday afternoon Sergeant SO AND SO from Police station called me and I explained the sequence of events as outlined above. He took the details for Energis and informed me that he would contact them to establish what has happened, what is happening and any future intentions.
I am sorry for any inconvenience that I may have caused by my unintentional deletion of files and folders from Tony’s web server space. I wish that I had told him the truth when presented with the 1st opportunity. There are two main reasons why I did not do so:
1. I did not believe that anyone would believe that someone with the level of knowledge, training and experience I possess could make such a fundamental error and therefore come to the conclusion that I had done this maliciously and intentionally.
2. I would lose face and credibility in a community I have been part of for years and with friends and other people, that in the main I respect and value.
SUMMARY
I have made a mistake and then compounded that mistake by ‘inventing’ an excuse and posting it in a community message forum.
I mistakenly believed that my friendship with Tony and the application of ‘pressure’ through our community message forum would sway him into dropping the complaint and therefore stop further proceedings.
I am apologetic over the entire situation which has arisen through the lack of my not owning up straight away, but took the course I did with the best intentions for all concerned.
We all make mistakes and I should have been ‘man enough’ to have held my hand up and admitted mine. The circumstances at that time swayed me to take the initial course of action I undertook. I know that my judgement was wrong.
In my defence, I have not ever ‘hacked’ into anyone’s PC or web server and have always been provided with the necessary login and password information by those concerned, and I have never ever abused the facility, ability or privilege to do so or have had anyone ever make a complaint such as this against me.
If Tony had followed the advice that I gave him, the same advice I always give to those I help, to change his password after we have concluded scheduled tasks then I would not have been in a position to delete the folders and files in the 1st place.
I have never logged into his or anyone else’s machine or web server without them requesting me to do it or having an open invitation to do so. This was a genuine mistake for which I apologise unreservedly. I deleted what I thought were my folders containing my files.
I have tried on numerous occasions using Email, MSN Messenger, Mobile text messages and Telephone to try and establish communication with Tony to explain exactly what happened. He has not responded to any of the attempts or returned any of my calls and therefore is not aware of the actual situation, as described above.
I swear that this statement is correct to the best ability of my recollection of events in the last 6 days.
This statement will be submitted to Sergeant PC from Police station on Saturday 8th of November 2003. He is not in a position to do receive the statement before then as he is ‘off-duty’ and he is the ‘Officer In Charge’ of this particular case. Sgt PC can be contacted on 00000000 when he comes back on duty on Saturday 8th of November 2003.
Well, it sounds like:
a) the individual did delete the account (intentional or not) so the issue of "spoofing" doesn't apply.
b) "Tony" may be liable for some issues as some companies take offense to the "distribution of accounts and passwords". While "Tony" should have changed passwords, he more than likely shouldn't have given out the account at all.
c) IMHO, (and some basic Canadian law understanding -- I'm going on the premis that the individual and these events took place in Canada), the individual will probably end up with charges dropped since i) he was given access to the account ii) intent indicates no serious intention to actual damage the forum (the intention was to delete something else that the individual had the right to delete)
d) the individual has probably hurt his reputation. Why he didn't fess up when "Tony" first approached him about the forum being deleted (we do all make mistakes but the fact that he didn't "fess up" right away.. )
Anyways, that's my opinion for what it's worth. Needless to say, this is an interesting discussion..
yes MsMittens
that would have been the easiest thing to do -- the sad thing is he wont ever own up -- the one thing too know though is this whole discussion really does make you think about who to trust over the internet. I for one would always protect against this stupidity from ever happening in the first place
I for one would always protect against this stupidity from ever happening in the first place
HA! Good luck. Stupidity 0wns the 'Net. At best, you might be able to protect your own little world with regular password changes, watching who you give what to, and being more paranoid about some people but stupidity will still range supreme as long as their is a regular user out there who still does the "My computer isn't working and I can't see the keyboard because of the power outage. How can I get my computer to work??" question.
WOW dont ever ask me to commit a crime with you.
Next time keep your mouth shut and deny it all the way!!
Well as you can see the above text you know now the out come which was'nt my intent
If only he told me first time round this would'nt be here now.
He then made a reply being personal to my family which i flipped to show the above.
But on my part i must add i never gave a password out i know the only way he got but this will never happen again.
Thx for all your input here and time ;)
wild
To be blunt from my first impression: It sounds a lot like two little girls fighting.... no offense to little girls intended of course..... ;)
Points I note:-
1. I've played CS for years, (1999, I believe), I'm average at it... I don't get into the "clan" thing simply because the propensity for these silly "bitch fits" about cheating increase exponentially.... I go there, I play, I have fun.... Oh and I kill most of these L33t clan members daily...... But I do it alone..... without cheats.... If I'm cheated on I bitch there and then.... If it continues, I leave.... How hard is that? :rolleyes:
2.Well.....I've said it before and I'll say it again..... Being drunk is _no_ excuse for anything except falling over.... In fact, I'm sat here in a bar typing this.... and I have a beer too.... OMFG..... It's not making me do odd things.....Quote:
Late Wednesday evening I had quite a lot to drink
3.yet a minute ago he said:Quote:
logged into what I thought was my Di Soft Account
Obviously not much experience...... Don't assume... Check!!!!!!Quote:
Having more technical computing knowledge than most people
4. After he screwed up without being smart enough to test the deletion he just did, (which would have told him he might have messed up, thus allowing preemtive action, (calling Tony and saying "Jeez, I screwed up" before Tony discovered it himself)), he went to bed..... See Point 2.....
5. When challenged he tried to evade.....
6.If you're going to lie, try one that is actually going to work..... Spoofed is a bit silly when you claim what you did under point three.....Quote:
my IP Address had been ‘spoofed’
7.Ah, you trust people over the internet...... Poor misled young man.... Nothing else to say.Quote:
Once again my estimation of the strength of mine and Tony’s friendship was completely misplaced
8.Oh dear.... what a concept.......Quote:
With the benefit of hindsight I should have immediately told him the truth about what had happened
9.Tony is being a "wally" to and should grow up and be a man about this.... All he has to do is to ask to have it fixed..... But he won't.... He's such a man he wants the police involved.... Sorry, but he's as sorry as the "attacker"Quote:
to try and establish communication with Tony
The moral of this story is long and confused but it comes down to:-
1. It's just a damn game
2. Don't trust anyone on the internet
3. If you are given admin rights, know what the hell it is you are doing
4. lying to "cover your tracks" doesn't work with people that know the systems
5. Be men, (or women), about it: communicate: and determine if there is a way out for both.
OK.... Beer makes me woffle..... :D
Hydro
Still take the security precautions I suggested.....there's a good chap. I do not trust anyone, least of all myself :eek:
There is only one machine that I will remotely manage, and that belongs to a very close friend. we are about 230 miles apart, so it has to be that way...........he backs up to that (my) machine daily...we are mates....I know his mom, his wife his kids...............I trust him, but the box he uses is not connected to this one............my trust goes only so far...
However, if Colin deleted everything off that box, I would just restore from the CD backups and take the piss out of him :D he would only do it by accident..............I promised that I would look after him..........
Take care mate!
Tiger..
I trust you...and we have never met.......but apart from that I agree :D
Cheers
Wild:
Wild said:
Implication, (that was never refuted): He has logs showing a full 18 minutes of activity.Quote:
So whats the chance of all this in a 18 minutes i must add.
The Attacker said in his "confession":
A couple of points:Quote:
I deleted all of my folders and files. After the last files were deleted, I logged out of Cute FTP, disconnected from the internet shortly after and went to bed in a bad mood.
1. If he deleted his folders and files individually he would have had to notice that they weren't the same folders and files he had under his account, No-one can be that stupid, can they???? - but doing it individually _might_ have taken 18 minutes if he had literally hundreds of folders and files.
2. If he did a mass deletion he _may_ not have noticed that they weren't his folders and files...... But that would have taken a minute or less.......
I, for one, in the situation he claims, would not delete my files individually as if saying goodbye to each one as they go. It's a highlight everything I can and hit the delete button - "Thank you, Goodbye" - Logout - "Screw you"......
I'm afraid that your "buddy" is most probably still lying...... I think he did deliberately enter your account and systematically delete your stuff and when he lost his internet connection he has travelled a road of attempted deceit that wasn't working. His lengthy and over-detailed "final confession" is his last ditch effort to build a plausible story around the facts which, while accepting a reputation as a fool, gets him his internet connection back - which means more than his reputation in this small circle of people.
I would suggest - No Mercy.......
WELL YOU DO KNOW THAT HACKERS NORMALLY DO THAT KIND OF STUFF JUST FOR FUN, BUT IF YOU KNOW THIS PERSON CHANSES ARE THAT HE DID THIS BECAUSE OF A DISAGREMENT YOU MIGHT OF HAD AND HE PROBABLY COPYED ALL THE FILES FIRST, SO IF YOU MAKE AMENDS HE MIGHT HAVE THE FILES FOR YOU TO LOAD BACK ONTO YOU HARD DRIVE.
REMEMBER RETALIATION IS NOT THE KEY
Remember.. YELLING ISN'T EITHER!! (Ok. So I'm ol' school internet.. so byte me)
Please rip out your caps key.
LOL Sorry MsMittens I was just trying to stress the point that wile revenge is sweet it is not the action you should take.
Ms. M: You look so demure and proper in your photograph..... ROFL..... Nice one....Quote:
Ok. So I'm ol' school internet.. so byte me
Look i did not know all caps at this sight is considered yelling and is takin as offense,so i repeat again sorry
Using all caps at just about any site will be considered yelling and people will take offence. Just keep that in mind and everything will be fine.Quote:
Originally posted here by crypticgod
Look i did not know all caps at this sight is considered yelling and is takin as offense,so i repeat again sorry
Cheers:
crypticgod, relax.
It's fine. You apologized. Life goes on.
But be aware that it's not just this site. This is an actual RFC Guideline:
http://www.dtcc.edu/cs/rfc1855.html
ftp://ftp.rfc-editor.org/in-notes/rfc1855.txt <--- seems slow and cranky today. Might want to use the first link. :D
Hi all,
I am the 'alledged' attacker.
I have been watching this topic for quite some time as the link was sent to me by one of Tony's "Squad Mates"
Here are a couple of missing 'items'
- Here is the full 'document' (with images) that would add a little more clarity. http://www.21stcc.biz/streak/Statement.doc
- I am on dial-up and it takes an age to upload, download or delete anything using CuteFTP, so if I did delete the information by highlighting the top level folders containing the files and 'hitting delete', then 18 minutes is not unfeasible.
- When playing in a DF2 match I disable everything (AV, FW etc) less for the 'game', to maximise the machine's potential and that of my 33K Con. Disabling these 'extras' improves the quality of the game and has been a practice that I have employed for 4 years. A practice I hasten to add that I no longer employ.
- I have no programing or hacking experience, however, I do have more than the average Joe's knowledge when it comes to the run of the mill matters. In reality you have only been presented with one side of the story.
I may/may not have been 'spoofed', 'Zombied' or actually setup by Tony or even one of his 'team mates' and I may have even done it myself either intentionally or unintentionally. One thing is certain though, and that is no matter what people read or say, the recipient will see what they want to see and make their own mind up accordingly. As has been the case in 'our community'.
Those that chose to believe I did it, believe that.
Those that chose not to believe I did it, believe this instead.
Suffice to say that the Password and the account details were given to me several times not just once when Tony was incapable of conducting the tasks himself.
There is more than an elemet of 'reasonable doubt' surounding the entire 'saga' and it comes down to a view on standpoint.
Neither I, nor anyone else from our comunity possesses sufficient expertise to class themselves as 'professional' in hacking or these types of matters, hence how it 'drifted on the wind' until it landed here.
It is not beyond the realms of possibility or probability that I did it, and it is also not beyond the realms of possibility or probability that I didn't.
Here's a hypothetical scenario. How hard would it be for a 3rd party, who knew my IP address, knew I had access to the server webspace in question, and also knew the password and account details themselves, to set me up for this?
I have found this a rivetting read, and I thank those from outside of 'our community' for their posts and their answers. One thing is most definitely for certain though and that is I will not be accepting invitations to assist these people again in the future. It leaves you wide open for abuse as you immediately become the 'FBI/CIA/MI6's No. 1 subject'.
Thanks and kindest regards
Steve
You online game on a 33.6 connection....... And you take this stuff seriously....... ROFL......
Steve.... You were being petulent, you were drunk, you weren't paying attention and you tried to lie your way out of the situation.
As my Drill Sergeant used to say to me......
"If you're looking for sympathy you'll find it in the dictionary.... Between **** and syphilis"
Get a different ISP, get high speed for god's sake....... If it ends up costing you more it might make you pay attention, be less petulent and stay a little more sober when doing questionable things to anyone's computer.... Put it down to a learning experience.......
How hard would it be for a 3rd party, who knew my IP address, knew I had access to the server webspace in question, and also knew the password and account details themselves, to set me up for this?
It wouldn't be easy unless they used a trojan and then removed it afterwards.