OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Compromised Box -
From: Daniel Harrison (danielhLOUDCLOUD.COM)
Date: Tue Oct 31 2000 - 20:01:12 CST

You could do it that way but just getting an IP address may not be enough. If he
gets on the box and starts IRC'ing, you can get a huge amount of information
about the attacker. If he is a kiddie maybe you'll get lucky and he will do it
from a box that can be easily traced back to him but maybe not. I haven't dealt
to much with the authorities in the past but just giving them an IP address from
a log file probably wouldn't get them to do anything.
Of course this is just my $.02. =)

dan

Andrew Blogg wrote:

> If you want to track and see if an attack happens again on this port, I
> would run something else on that port which simply closes the connection and
> states "Your attempt has been logged" and actually log the IP address date
> and time that a connection was made from.
>
> Then you can have fun with the authorities if you wish.
>
> You could run such a script on that port AFTER you've rebuilt the box,
> because an attacker is unlikely to know that the box has been rebuilt.
>
> Regards,
> Andrew
>