RE: Honeypot article

["Bosschert, B. \(is-ks\)" <b.bosschert () pinkroccade com>]

Tom McLaughlin [mailto:tmclaugh () sdf lonestar org] wrote:
> From http://www.geocities.com/shellmaniac/su.c:
>
> /* su.c by xp, modified by logikal@efnet - tested on redhat 5 -> 7 */
>
> Has anyone gone beyond looking at technical clues in investigating and
> looked at "social" means of doing it?  Take the nick from IRC in the
> above code comment.  Look for their presence online.  We 
> don't know how
> that nick is connected to what happened if at all, but it 
> does give us a
> starting point.  Find their channels, see who comes and goes, look at
> what they talk about.  Wait for a script kiddie to boast or find
> possibly where else one could look for the intruder...  Hackers have
> decent social networks.  Damn I wish I could remember the link to the
> article I read recently mentioning hacker social structure. 
>
> Police don't rely on forensics alone and IRC did help catch Mafia Boy.
> Just a thought...  I was a liberal arts major.  :)

What about looking at the more interesting files, like:
http://www.geocities.com/shellmaniac/mech.set

SERVER  129.27.3.14     6667    # graz2.at.eu.undernet.org
...
CHANNEL        #Hackminds
...

Look on Undernet in the channel #Hackminds. There you will probably find
more information about the hacker. Also a nice article about tracing a
"hacker" down, is http://grc.com/dos/grcdos.htm.

ttfn,

Bas