RE: Reporting hacking

["Reeve Fritchman" <reeve@xxxxxxxxxx>]

Maybe channel F-117 (as in Stealth fighter)...
If you have a cable/DSL connection to your PC, you get probed like you're a
patient at a teaching hospital.  It's not safe or smart to be connected to
the Internet without some kind of protection.
It could be an application in error, but likely not.  And it sounds like
you've done all you can.

-----Original Message-----
From: midrange-l-admin@midrange.com [mailto:midrange-l-admin@midrange.com]On
Behalf Of rob@dekko.com
Sent: Monday, August 27, 2001 6:02 PM
To: midrange-l@midrange.com
Subject: Reporting hacking


Is there a channel to report hacking?

My boss is enamored with Op's Nav performance monitoring.  He happened to
notice that the FTP jobs on our web server 400 were eating up some CPU
percentage.  Not much, but some.  We were getting ready to do a ftp site
but not prime time yet.  We fired up our Pentasafe reports and determined
that a certain IP address was trying to probe us for ftp.  Pentasafe was
slamming the door on them.  We decided to try to access that ip address
from one of our browsers and got a Romanian pharmaceutical company.
(Although I am not too good on my Cyrillic alphabet).

Since our ftp is not prime time yet, we changed our firewall to block all
external ftp for now.  Basically as a defense in depth, and to take a load
off of the 400.  We thought about just blocking this IP address:
212.93.151.182

Rob Berendt

==================
A smart person learns from their mistakes,
but a wise person learns from OTHER peoples mistakes.

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com