Re: Hackers left open door to my server..

["Jayson Broughton" <jbroughton () allcovered com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

James,
One place to report this is to CyberSnitch. This is an online,
hightech Computer crime
unit that is manned by fellow Officers of the law.
http://www.cybersnitch.net
Click on the Report a Crime bar, and follow the instructions.  Also
you can do a whois
on their ip address, and grab the Administrative contact to their
ISP(or goto their isp
from the Whois and see if there is a place to contact on their
website).  Provide Date
and time stamps in your time zone(tell them what your timezone is of
course) along with
all logs you can dig up.  This should at least disconnect them, or
allow you to press
charges if they find the right guy. (unless they ran through a
proxy,socks or wingate to
do the damage).  In that case, the administrator for the
socks-proxy-wingate should be
able to look through logs and direct you to another ip addy that was
using the
proxy-socks-wingate at that time...

Goodluck to you,
~Jayson Broughton
HQ-All Bases Covered
Network & Security Admin

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>

iQA/AwUBOI3ry6e75Wq9veF/EQLgBgCdE0/4KDFD/J34dW0aYVLWed45oxcAoPra
gnJLeKPmsFV6z9420Y2KjZYe
=RZgI
-----END PGP SIGNATURE-----


James Hepworth wrote:

> Someone tried to get into one of our boxes here and left a door (rcp) to one
> of their hacked servers.  They also left quite a few files on the server,
> large list of servers, IP addresses, usernames and root passwords + their
> toolbox of toy scripts. Our system did not let them delete these files, but
> they thought they had.  I also have the console log with them chatting to
> each other & the commands they issued.
>
> Is there any one place to report this type of violation or should I just
> clam up and clean up the box?  The connection (rcp) is still up (not for
> long I suspect tho), I would like to catch these buggers.....
>
> Thanks
> JAMES
>
> Tired of bad Internet search results?
> Try http://www.muckymuck.com
> Cut Through the Muck!