Ideas on how the hacker is doing it?

[Lansing_Banda]

Just something to point out real quick, when a friend of mine was taken to court for uttering an idle threat back in high school (he was cleared of all charges), the police came to search his stuff. When they decided to take his computer, they didn't take just the hard drive; they took the entire computer. And not just that, the monitor, speakers, keyboard, mouse, and even his webcam!

I asked a friend of mine's dad who is a lawyer about this. It turns out that by just using another monitor, the case can be argued that the computer was tampered with, and thus all data on that computer was void in court.

Pretty messed up stuff to say the least.

If you are sure it is him and you want to press charges, don't do anything to the computer, but act quickly. If you care to let it go, then format and start over. Even if you do decide to take action, after everything is said and done still format and start over.

[br_fusion]

Don't drag the FBI into this.......

Not even his crimes deserve the somewhat unfair wrath of the feds.

Unless you hate and despise the person, it is not worth throwing them in jail for 10+ years. If you have a good idea who it is, which it seems you do, try confronting the person and letting them know you are aware of their actions. (Or confront them in a less obvious way or even by an anonymous email).

cheers

Feds=last resort

[groovicus]

(Or confront them in a less obvious way or even by an anonymous email).

I'm sorry, but ooh, that will leave them quaking in their boots. And just how will that serve as a deterrent? Just exactly what is to keep this person from doing it again? Oh yeah...jail maybe?

I'm not saying your opinion is wrong, everybody is entitled to it. I just disagree. Causing a disruption of business = loss of income = theft.

[qutoe]unfair wrath of the feds[/quote]

Umm..let's just say that's a topic for Cosmos.

[jackell]

My 2 cents

You may have to figure out how much this person is costing your company and way it against the possibility of how much the feds are going to cost your company. Take it from me they are intrusive.

[TheSpecialist]

Originally posted here by br_fusion
Don't drag the FBI into this.......
Unless you hate and despise the person, it is not worth throwing them in jail for 10+ years. If you have a good idea who it is, which it seems you do, try confronting the person and letting them know you are aware of their actions. (Or confront them in a less obvious way or even by an anonymous email).

Mr.TS says: Say no to school. And stay in drugs! And some day you'll grow up to do more important things in life than just be a member of a gang like the bloodz and the krypt siddies.

Come on man! Urp...

Let me put it this way, do you realise that mostly the large majority of ritualistic serial killers start out with minor theft, burglery, drugs, vandalism, assualt & (ect)... eventually riseing to more and more devious crimes which eventually leads to a assortment of murders. Next time I see some interesting characters commiting a crime I won't do darn thing... I'll take your advice and instead of walking away and calling the cops or something of the sort... I'll just walk over to them like a tottal dumb-ass and say hello or something then just let peaple walk away with what ever they feel like doing like a ga' damn pussy.

[dopeydadwarf]

You may have to figure out how much this person is costing your company and way it against the possibility of how much the feds are going to cost your company. Take it from me they are intrusive.

Correct me if I am incorrect here, but isn't there a limit on the damage done before the FBI can even step in? Further more isn't $10,000 what it take to get any type of sentencing in court passed? I remember reading this somewhere. Call the feds, they can help.


off to find source

[jackell]

What the hell is up with this string, The person originally asked for help in finding the hole or holes that this person is using Instead it turned into a FBI yes or no question. F**k
me, this is not right. Did anybody actually suggest filing a report, keeping and logging records, and then just patching all the dam holes that are open. Or is it just me in my infinite damnation that I am thinking this way.

The FBI will do nothing except take a report unless there is a major loss/harm of equipment, life, or revenue.

$10,000 to get a sentence in court. Hhhmmmm don't think you can put a price on a prosecution. They run from $20 a hour your local piglet gets paid for a traffic ticket to millions for SEC filings

[JP]

Greetings All:

No offense to anyone, but I think many of you are offering advice and opinions with an obvious lack of experience and understanding to back them up.

For starters, someone suggested that he simply format everything that's connected to the network and reinstall it all from scratch. That's cute. That may work for a 3 computer network that you have in your bedroom, but this is a literal impossibility for a corporation of any size to do.

Secondly, someone suggest that he contact the perpetrator directly. What exactly this is supposed to accomplish is above and beyond me? Letting him know that you know that he's the one responsible? I think, given the specifics, it's safe to assume that this man WANTS everyone to know that he's responsible. If he's formerly in charge of security, and assuming he's not 100% incompetent, he's more than likely well aware of simple things such as Hotmail passing along the originating IP of these e-mails that he's sending all over hell. He's probably relying on the fact that "no one would bother doing anything about it", which is indeed what many of you suggested he do about it, nothing.

As for this $10,000 in damages before the FBI gets involved, so his case wouldn't even meet that standard. Again, comments coming from those without experience with either the FBI or the Corporate world...

What we have here, is the case of a disgruntled employee, who used to be in charge of the corporation's security that he's now breaching. Who knows how many backdoors this man has left himself? In the routers, in the firewalls, in server configurations, software, scripts, hidden accounts, trojans, the list could go on and on. Some of which might be open holes, others might be time or action activated.

The problem here isn't HOW he's doing it, it's that the former employee in charge of information security has shown that he breached his former trust with the company, and as such, they can't trust ANYTHING that he had his hands on.

How much do you think THAT'S going to cost in man hours to rectify? A lot more than $10,000 I can tell you that (although that $10,000 is an imaginary number to begin with. such intrusions can be prosecuted regardless of monetary damages sustained).

At the very least, if the FBI gets involved, a plea could be offered that would require this former employee to disclose under oath all vulnerabilities that he had in place. Not that you could trust that either, but it would at least be a start.

Also, it's been my experience, that once contacted by the FBI, the ego's and motivation of these types is quickly and completely diminished.

[uno_digerati]

Thank you all for your opinions and insight. Today I will talk to the powers that be and offer them 2 options.
1- Pursue legal prosecution (FBI)
2- Prevention and Preservation

Since this is there decision I will try to inform them with what I know and some of hte insight you have provided. I understand the ramifications of both and appreciate all your input. Once the powers that be decide what it is they want to do I will post here once again.

As several people stated I was hoping to get more information regarding the option to preserve and prevent, however, after reading JP post it is evident that there is so much hardware and software that will need to be examined, tested, and rebuilt.

The recommendation has been made to start with the router and I understand the reasoning. Changing admin passwords and verifying the access list is a great place to start.
My question is this. Why not start with the Active directory accounts and work from the Exchange Server out to the router since that seems to be the target? There is a webmail interface on an external website. My bet is that he has an admin account on the Exchange server and is using the webmail interface to look in peoples email folders........ Comments? Or suggestions for locking this down?

[cacosapo]

Hum, as he was the Admin, and he is a Son-of****, he may inserted a lot of backdoors beside de obvious ones. (JP and others said all about the obvious). For example, He can inserted a trojan that will be trigged by some event (such as a date, a account modification etc) and it will f*** all network.
Since you have your network assets compromissed, im assuming that this guy REALLY knows what he did and I advice you to take precaution.
I true believe that FBI must be in this case, because guys like this must go to JAIL (10 years? too short - life maybe?)
Admin guys that do that are like corrupt cops: they must be taken as EXAMPLE to other smart guys