Printable View
Someone told me about a software/program that you can install on your computer that when it DOES detect unauthorised access will send something back to the offending IP resultnig in the hard drive being wiped (I'm assuming we're probably talking some simple code running an f-disk on the offfending PC...)
Anyone heard of this and does it work and more importantly is it legal?
Tinks
That kinda goes along with the scenario here in the US...
-Burglar invades your house, and you catch him stealing, shoot him, and he gets taken off by the cops.
-The burglar comes back and sues you, and wins....
Only in America!...I don't know about England though :P
Just my 2 cents
disc0rd something that you learn when you get your consealed weapon permit is to always kill someone instead of wounding that person because if he needs special medical atention youll have to pay.
SEEK AND DESTROY ! ! ! ! ! !
Haha, very true...sad but true Graphictron :)
if you kill someone in self defense you don't go to jail because it was self defense. If you shot someone and that person is not able to walk anymore you have to pay for all of his treathment. Don't you see something wrong with this picture ? ? ?
*****
and as this thread , ive never seen one of those programs or know of some one that had been afected by them. But i read in IRC and other chat rooms L33t-H4x0rs saying that they do that, someof them call them Bouncers and other weird names. Maybe they are a urban legend of L33t H4X0rs.
Plz correctme if im wrong
LOL in England there was an infamous case where a farmer sot and killed one burglar (think he was under 18 actually) and wounded the other who later tried to sue him as he couldn't work (he eventually dropped his claim as it was condemned by the public saying that if during this time he could still commit crime and indeed get jailed for it then he could bl**dy well work too! The farmer was jailed for shooting at the lads and got released earlier this year. But the counrty is very split as I think poeple think it's fair to defend your property, but in all fairness the lad that was killed DID get shot in the back....
Anyway I digress again...
As for the program I know of people running it, but none that I'd trust enough to ask for a copy ;) and I have to say being of the pursuasion that anyone stepping uninvited into my house should be shot or tortured (the cats would see to that) then I'd feel NO shame in running one fo these programs if a) they were safe and b) they are legal (ish)
Tinks
It would probably be pretty damned funny to zap someone's box after they just attempted an attack on you. I am
reminded of a neat anti-car theft device I saw at a general security show. Basically, the device shocked the _HELL_
out of car thieves, not enough to kill, but certainly enough to singe hair and leave an electricity taste in their mouth.
Ultimately this device never got approval because the chances of it doing that to an innocent kid or someone who
inadvertently touched your car the wrong way were too high. Same goes with these kinds of retaliations on the
I.P. that *attacks* you, more often than not the poor bastard has been hacked her/himself and the attacker is
using the compromised box to attack you.
If it were only that simple.... muuuuhahahahahaah :)
-- spurious
I can't find the post but it was covered in here recently.
It was all a big joke.
I did however write a program which opens 2 sequential ports on your computer and if a port scan is detected it sends a few packets to the person scanning the ip address with the message "I'm watching you."
Usually enough to make them stop.
Please allow me to complicate instead of simplify. Anybody ever hear of IP spoofing? Or what about worms like those that assist in DDOS attacks? How do you know the person who owns the PC you are about to fry is really the person behind the "attack". This has been covered here a few times and im supprised nobody else piped up with this point.
Good one zombie man.
I did think of it but my proggie only sends a few packets back to the scanner ip and doesn't do it any harm. Just enough to get the persons attention.
It is a damn fine point for the original post as most e-mail virii now do spoof the senders e-mail address and even the ones that don't are usually the virii sending themselves so if your pc detected this and retaliated the poor buggers would just end up attacked 2 fold.
Having an application that attacks back is about the same as attacking back yourself and is generally not looked upon very well. Also if someone does learn that your machine will do that then it is open to misuse by 'evil doers' and could be used to attack others...just a big can of worms that I don't think you really want to open.
The 'I'm watching you' message is interesting, but I kind of wonder about the legal ramifications of sending such a message. I think I would alter it, adding a bit of text to say that what they are doing is unauthorized and that if they continue the proper authorities will be notified. By simply saying you are watching them it could be argued that you didn't warn them off so it is tantamount to giving them permission to do what they are doing in a supervised manner.
If anyone likes I can pull up some links kind of related to this and banners used on systems.
Entirely agreed on the virii front... But then I seriously hope that all my friends have listened to me nagging them very regularly to have latest updates of their anti virus so it would partially eb their own fault... (add to that that I also keep reminding them to have backups and I even have a small collection of full backups at home on tapes of various peoples machines and yup I specialise in Backup devices for the worlds 2nd or 3rd largest IT company... the dreaded HP) :)
Have to say it WOULD be nice tho if someone could manage to make a program like this fool proof... I mean how excellent would it be if you f-disked someone who was trying to get into your machines???? Phwarharharhar!
"Strikeback" is a program used at GE medical in 98-99. It did Ping of Death and scanned ports. It was pretty infintile to be running at such a corporation, and the legal implications could be nasty. I think Information Weekly released an article about Strikeback, so they pulled it from the proxies they were using at the time.Quote:
Originally posted here by Tinks
Someone told me about a software/program that you can install on your computer that when it DOES detect unauthorised access will send something back to the offending IP resultnig in the hard drive being wiped (I'm assuming we're probably talking some simple code running an f-disk on the offfending PC...)
Anyone heard of this and does it work and more importantly is it legal?
Tinks
"Honeypots" are used all the time. They are fake computers and that emualte a hacked system.
As far as Fdisking an offended PC, I have never seen an app like that (as you describe). I think its just urban legend.
I agree. It would be pretty difficult to do because of so many different operating sytems, configurations, firewalls, and other means of protection. The system would have to be exploited which means unpatched/unprotected. What idiot would attack someone witout being protected themselves?! A zombie, maybe. If the system was patched, the "hack back" program would have to download a crap load of exploits for virtually all operating systems/services/versions. That could take up quite a bit of resources and would be redicuilous if someone just scanned you, or tried to connect to a network drive.Quote:
As far as Fdisking an offended PC, I have never seen an app like that (as you describe). I think its just urban legend.
If such a tool existed, you would have def. of heard of it by now. Especially with all the security lists out there. It would have shown up in one place or another and spread like wildfire.
Your best bet is just to protect yourself and keep good backups. Not to mention, keep all sensitive/important data on removable drives and only mount those drives when you need access to that data.
Hi Tinks
If you zapped a foreign owned, and located computer I am sure that it would be legal, as English law is very poor at protecting anyone who is not resident in England or a British Citizen overseas.
As already pointed out, the "attacker" is most likely "owned" or "spoofed". This means that at worst they might be considered guilty of stupidity. If stupidity were a crime then "they" would certainly be in a majority, and we would be in jail.
As in "Eat more sh1t, three trillion flies can't be wrong" :)
I have not heard of such a program, so I suspect it might be an urban legend/myth?
It is hard to say what the legal position is, as English law is not up to date as regards computers. If a burglar breaks into your house and electrocutes himself on a faulty light fitting then YOU are liable, because your faulty light fitting is illegal, and was there first.
If someone breaks into your computer and runs fdisk on their box (a normal,legitimate, and legal program) then I would say that you are OK, because your computer has nothing illegal on it. What I am saying is that it would have to be a standard program.
I still think that you could do it with impunity, as the disk wiping would effectively destroy the evidence, and I don't see a skiddie going to the law. As already stated: take no prisoners :D
It would need a test case to get the definitive legal position?
Cheers
LOL thanks guys :) pointed out some points that I had thought about but didn't quite know and was umming and Ahing... anyway as for recovering an f-disced hard drive... oh it CAN be done, I should know ;) I work in data storage (and hence recovery when fools forget to do back ups of vital data... ) but it isn't cheap but it CAN be done :) (ie the police ahve a permanent account with Vogon.com in the UK to recover files from computers thought to belong to peadophiles...)
Anyway home time
Laters
T
Although this opens the risk of a DOS I use port sentry to detect a scan and then I use iptables MIRROR.
What this does is take a packet from the nic and swap the source and destination addresses and drop it back on the network.
The offending person will end up scanning/hacking their own box.
I don't think this is ilegal at all. The person is doing any damage to themself.
HTH
Steve
/edit
I've been asked how I did this - RH9 Instructions (very brief - I will write a full tut if required)
The changes to /etc/portsentry/portsentry.conf :
# ipchain support for Linux (no logging of denied packets)
#KILL_ROUTE="/sbin/ipchains -I input -s $TARGET$ -j DENY"
#
# iptables support for Linux
#KILL_ROUTE="/sbin/iptables -I INPUT -s $TARGET$ -j DROP"
# sneaky 2 hour mirroring sinbin!
KILL_ROUTE="/sbin/sinbin $TARGET$ $PORT$"
# For those of you running FreeBSD (and compatible) you can
# use their built in firewalling as well.
#
#KILL_ROUTE="/sbin/ipfw add 1 deny all from $TARGET$:255.255.255.255 to any"
#
#
The script /sbin/sinbin :
if [ "$2" = "135" ]
then
date >> /var/log/scans_135.txt
echo $1 >> /var/log/scans_135.txt
else
if [ "$2" = "137" ]
then
date >> /var/log/scans_137.txt
echo $1 >> /var/log/scans_137.txt
else
if [ "$2" = "139" ]
then
date >> /var/log/scans_139.txt
echo $1 >> /var/log/scans_139.txt
else
MailMessage localhost portsentry@llocalhost root@localhost 'Scan Detected' $1:$2
fi
fi
fi
/sbin/iptables -I INPUT -s $1 -j MIRROR
sleep 2h && /sbin/iptables -D INPUT -s $1 -j MIRROR &
Hope this helps
Oh, BTW MailMessage is a perl mailer script I wrote (hacked someone elses actually)
Nice one Steve,
Aren't you worried that they might sue you for growing hairs on the palms of their hands and/or going blind?
:D
Cheers
You might of been thinking of an article like this one:
http://dc.internet.com/news/article.php/2223811
Quote:
U.S. Sen. Orrin Hatch (R.-Utah) suggested Tuesday that he might favor technology that can remotely destroy the computers of those who illegally download music from the Internet. Hatch, chairman of the Senate Judiciary Committee, made his comments during a hearing on peer-to-peer (P2P) networks.
Sorry to dredge up this old history - but here is an example to us all to check out what updates we are applying.Quote:
Originally posted here by steve.milner
Although this opens the risk of a DOS I use port sentry to detect a scan and then I use iptables MIRROR.
What this does is take a packet from the nic and swap the source and destination addresses and drop it back on the network.
The offending person will end up scanning/hacking their own box.
I don't think this is ilegal at all. The person is doing any damage to themself.
HTH
Steve
/edit
I've been asked how I did this - RH9 Instructions (very brief - I will write a full tut if required)
The changes to /etc/portsentry/portsentry.conf :
# ipchain support for Linux (no logging of denied packets)
#KILL_ROUTE="/sbin/ipchains -I input -s $TARGET$ -j DENY"
#
# iptables support for Linux
#KILL_ROUTE="/sbin/iptables -I INPUT -s $TARGET$ -j DROP"
# sneaky 2 hour mirroring sinbin!
KILL_ROUTE="/sbin/sinbin $TARGET$ $PORT$"
# For those of you running FreeBSD (and compatible) you can
# use their built in firewalling as well.
#
#KILL_ROUTE="/sbin/ipfw add 1 deny all from $TARGET$:255.255.255.255 to any"
#
#
The script /sbin/sinbin :
if [ "$2" = "135" ]
then
date >> /var/log/scans_135.txt
echo $1 >> /var/log/scans_135.txt
else
if [ "$2" = "137" ]
then
date >> /var/log/scans_137.txt
echo $1 >> /var/log/scans_137.txt
else
if [ "$2" = "139" ]
then
date >> /var/log/scans_139.txt
echo $1 >> /var/log/scans_139.txt
else
MailMessage localhost portsentry@llocalhost root@localhost 'Scan Detected' $1:$2
fi
fi
fi
/sbin/iptables -I INPUT -s $1 -j MIRROR
sleep 2h && /sbin/iptables -D INPUT -s $1 -j MIRROR &
Hope this helps
Oh, BTW MailMessage is a perl mailer script I wrote (hacked someone elses actually)
Some time in the last few months the MIRROR target had been dropped by the netfilter team and my portsentry had been doing nothing!!!!! since /sbin/iptables -I INPUT -s $1 -j MIRROR errored...
I know the MIRROR target was experimental, and a bit risky but I enjoyed the smug sense of satisfaction that the skiddies were hacking their own box.
Serves me right for being a smartass - good job the server was set up correctly and not relying on portsentry for security, cause I would have been wide open for months.
I don't even know when I did the update that lost the functionality, but just after Xmas I know I demonstrated this to someone and was OK then
Steve
Did you upgrade your kernel ?
Have you ever built a custom kernel ? ( then upgraded to a stock kernel? )
Is it possible that your distro used to build all available targets as modules, then with the latest kernel stopped building it? ( I know FC3 does not build it with a default kernel, you have to build the kernel yourself. Maybe since updates for RH9 are now handled by Fedora Legacy they have done the same thing.)
Im not sure exactly but I think in the UK at least they count a counter attack as a seperate attack therefore making anything in the attack that would be illegal if you started it ilegal and you liable for any damages, also as posted its not always the bad guy ;)
I have upgraded my kernel recently, and I'm sure that's what caused the problem. Both kernels were stock kernels and I'm now running FC3 on the box. It's not too much of a problem, I'm just using a DROP target now, but as I said, I got a preverse sense of satisfaction thinking of the skiddies slowly realinsing they were looking at data from their own box.Quote:
Originally posted here by IKnowNot
Did you upgrade your kernel ?
Have you ever built a custom kernel ? ( then upgraded to a stock kernel? )
Is it possible that your distro used to build all available targets as modules, then with the latest kernel stopped building it? ( I know FC3 does not build it with a default kernel, you have to build the kernel yourself. Maybe since updates for RH9 are now handled by Fedora Legacy they have done the same thing.)
I beg to differ. I have not performed any action whatsoever, not have I configured any of my systems to perform any attacks or counter attacks. I have simply returned any packets sent to me back to the sender, but since I'm using a DROP target the issue isn't relevant.Quote:
Originally posted here by hellforgedangel
Im not sure exactly but I think in the UK at least they count a counter attack as a seperate attack therefore making anything in the attack that would be illegal if you started it ilegal and you liable for any damages, also as posted its not always the bad guy ;)
Stev
I used to have a prog that did something back to anyone who tried to scan my machine. I can't remember what it was called but the icon looked like a big 'clown hand'. I think it sent back some packets which could hold a short message 'piss off' or something like that. I think I still have it on a cd somewhere. I've no idea if it actually worked or not.
I'd rather my machine just sat silent behind the firewall now rather than flag itself up as a target.
Which is the mature & sensible approach that should be takenQuote:
Originally posted here by Aspman
I'd rather my machine just sat silent behind the firewall now rather than flag itself up as a target.
Steve
I hope you got my point, and here in lies your quandary ....Quote:
Some time in the last few months the MIRROR target had been dropped by the netfilter team and my portsentry had been doing nothing!!!!! since /sbin/iptables -I INPUT -s $1 -j MIRROR errored...
I ran through the source quickly of both the latest version of NETFILTER [ 1.3.1 ] and the latest kernel.org source ( and all the change.logs since the 2.6.x kernel ) and found nowhere that they dropped the MIRROR target. I also checked FC3, and although it does not have the MIRROR ( ****, I’m drunk and can’t think! ) .... module built in the stock kernel it is still referenced. I found nowhere that the netfilter team had dropped it. I believe you can still use it if you build a custom kernel, even using the FC3 kernel-source.Quote:
I have upgraded my kernel recently, and I'm sure that's what caused the problem. Both kernels were stock kernels and I'm now running FC3 on the box.
If you really want to know I will build a custom kernel on FC3 and tell it to build the MIRROR module and let you know if it works ... just let me know. Hell, I’ll probably do it anyway within the next day or two, just because!
Although I have only used the MIRROR target in the past to thwart in-progress verbose scans, I do believe quiet a while ago I suggested a way to use the “ user space “ query to do the same thing. It was nice to see someone else had a similar idea!
Truer words never spoken, but what fun is that????Quote:
Which is the mature & sensible approach that should be taken
I'd come to that conclusion myself too, but downlading FC3 kernel source is a pain & I really couln't be bothered.Quote:
Originally posted here by IKnowNot
I ran through the source quickly of both the latest version of NETFILTER [ 1.3.1 ] and the latest kernel.org source ( and all the change.logs since the 2.6.x kernel ) and found nowhere that they dropped the MIRROR target. I also checked FC3, and although it does not have the MIRROR ( ****, I’m drunk and can’t think! ) .... module built in the stock kernel it is still referenced. I found nowhere that the netfilter team had dropped it. I believe you can still use it if you build a custom kernel, even using the FC3 kernel-source.
I and I can't find the link again where I found that the MIRROR target (module ipt_MIRROR.ko) had been dropped - Ahh here it is http://svn.clkao.org/svnweb/linux/lo...x25/ax25_dev.c
Only do this if you're bored!Quote:
If you really want to know I will build a custom kernel on FC3 and tell it to build the MIRROR module and let you know if it works ... just let me know. Hell, I’ll probably do it anyway within the next day or two, just because!
Great minds....Quote:
Although I have only used the MIRROR target in the past to thwart in-progress verbose scans, I do believe quiet a while ago I suggested a way to use the “ user space “ query to do the same thing. It was nice to see someone else had a similar idea!
Steve
Well, it seems they did drop the MIRROR target.
I downloaded the FC3 source ( 2.6.11 ) and it wasn’t there ....
So I downloaded iptables-1.3.1 ( the latest version, FC3 uses is 1.2.11 ).
Nope, not there.
BTW, I’m not bored, just curious.
It wasn’t a total loss though, I also used POM and installed a few other target modules. Since I haven’t used any FC distros for firewalls I haven’t done this yet. I want to see how the build will turn out and play with some of the new modules.
They are right though, the MIRROR target is dangerous. And imagine the slowdowns it would cause if everyone used it!
Been reading too much cyber-punk, methinks.
"Kuang grade 7, ready to launch! Cut their ICE! GOOOOOOOOOoooooooooooooooooo!"
:p