I know why I have never been (knowingly) cracked

No-one gives a rats A$$ about me or my network....

Since implimenting a policy that strips all potentially harmful file extensions at the firewall in SMTP inbound mail I am forced to open an FTP server to allow needed files of a questionable nature in, (something I have resisted because it has always seemed to me to be the most abused system by the biggest group, script and warez kiddies). So off I went, created an FTP site in the DMZ, tested it, told no-one it was there but opened it up with and allow any -> ftp server firewall rule.... A honeypot if you will. Any traffic going there right now has to be suspicious.......

Well.... It's been "swinging out there in the breeze" for 48 hours. Logging is turned to full... not even a connection attempt except when I, (in disbelief), test it. An IDS rule is in place to pick up any SYN on port 21 from the internal or external network..... again, it has only fired when I test it..... Searching the firewall logs for any port 21 inbound also comes up with zip.....

It's almost wierd... I was scanned fairly regularly on port 21 for ever since I can remember.... My home box has had 8 hits during the same period. My work ISP filters nothing so it isn't that.....

So, I have only one conclusion..... The skiddies are "dis'ing" me....... :confused: Bastiges!!!!!!

I wanted some fun...... ;)

If it makes you feel any better, give you your IP and I'll give you a quick portscan, or maybe a ping or two.

Quote:

---

Originally posted here by Lansing_Banda
If it makes you feel any better, give you your IP and I'll give you a quick portscan, or maybe a ping or two.

---

I'll see your portscan and pings and raise you a complete vuln scan with nessus, and maybe a lil retina or Core Impact action as well.... :)

Peace,
HT

Let me know your address and I'll call the Homeland Security Agency and tell them you're providing intel to the Planned Parenthood terrorist league. They'll sieze all of your hardware and it will take months to sort it all out. God I love the Patriot Act.

Quote:

---

I'll see your portscan and pings and raise you a complete vuln scan with nessus, and maybe a lil retina or Core Impact action as well....

---

And ill see your nessus and raise you a trip to google to find an aproriate sploit like a good little skiddie would.

It really is a little surprising.... We can now add another 16 hours and still not even a "tickle".... I know it's just a probability issue but scans on port 21 have been far from rare even in recent history.

For the smarta$$es... ;) The IP address is 127.0.0.1 please email your results to me.... <LOL>

Quote:

---

No-one gives a rats A$$ about me or my network....

---

I'll give you a rats a$$ for you and your whole network if you like Tiger - one of my cats bought me a freshly killed little rodent this morning. Do I get to keep you both forever? :D

Z

When I read this thread I decided to dump the logs of incomming packets (of whatever kind) to closed ports. Withing a few minutes the list already was to long to be interesting. Most where to ports 80 and 135 and there was one portscan... You're just being lucky I guess.

Quote:

---

For the smarta$$es... ;) The IP address is 127.0.0.1 please email your results to me....

---

You're the one that runs that kiddie porn site?!

You should be ashamed!

catch

Catch:

Yes I am....... I admit it......

And if there is a picture of me naked in the shower then _you_ have been "peeking".... Bad boy!! ;)

What nessus.. what, you guys haven't heard of SubSeven? :) And you think you're any good :P

Anyway you should not complain. I mean things might change soon etc :)

:)
Hi Tiger Shark,
I'm doing the ol' CCNA classes at school and read about ACL's a bit.
Question is, are your ACL's configured on a router or the box, and are you
logging from the box (ie. host based or network based logging). I don't know much, so take this with a grain of salt.

g8way2u

Bluthund: Nope... My logging works just fine and my tests prove it. I have Snort running independently and added a simple rule:

alert any any -> $HOME_NET 21 (msg: "Incoming FTP"; Flags: S; classtype: bad-unknown;)

It runs on a box outside the firewall with the server being in the DMZ so it sees all incoming packets. Then the firewall logs all incoming allowed and denied packets for port 21 too and nothing pops up on that either except when I test. I haven't looked for about 16 more hours now so maybe I got something.... I'll have to dig through a lot of logs now though since I spent a long time scanning that server for vulnerabilities last night and a lot of the scanning was against port 21.

[Edit]

Yeah... finally... probably one of you lot trying to make me feel "wanted" ;) scanned my entire public subnet for port 21 at 2:06 am using a computer in Cologne, Germany. No connection attempt has been made..... In the nearly 4 days it has been out there I would have expected to have seen someone trying a couple of commands here and there.... I'm going to be fully implementing it later this week and then, when I don't want all the dross to wade through, I'll probably get a ton of it..... <sigh>

[/Edit]

I will see both of your attempts and raise you a finger,traceroute, portscan, DDOS attack, sploit scan, e-mail trojan offering free pron, and a power cut !!

Okay mark you win

I'll see all comers, but I'll raise you a B&E, and busting the machine apart with a 10lb sledge. :P

That's odd Tiger Shark, but it may have something to do with the segment of the 'net you are on. I found that commercial AT&T access generally had fewer people prodding it than my cable 'net access did. I was doing some mean time to root testing on a box unsafe on AT&T's service, and default IIS + FTP was rooted and someone was uploading files in about three hours (rooted around 1PM, box was put up online at 10AM same day).

Might also have something to do with it being/coming up on exam time, ya never know. :P

chsh:

Quote:

---

Might also have something to do with it being/coming up on exam time, ya never know. :P

---

Love it..... Gave me a good chuckle..... but then you might be right..... :D

Quote:

---

Originally posted here by HTRegz
I'll see your portscan and pings and raise you a complete vuln scan with nessus, and maybe a lil retina or Core Impact action as well.... :)

Peace,
HT

---

So what do you think about that Core Impact software? They have been bugging the bujeebus out of me for the past couple of months. I don't know anyone that has actually used their product/services before so I have just been putting them off.


Oh, and one of my corporate FTP servers that has been sitting out there "swinging in the breeze" for about a year now just started picking up unauthorized attempts on it. yay, it's made my past few weeks much more interesting and fun :)