RE: I've had one **** of a day ...

"Declare the cyber attacks an act of war and have it thus absolve us of all
debt to the Chinese as restitution?"

A $1.3T hack. Cool.

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Friday, November 14, 2014 1:07 PM
To: Midrange Systems Technical Discussion
Subject: Re: I've had one **** of a day ...

Short of using what I saw in that one museum room at Wright Patterson AFB?
I don't know.
Declare the cyber attacks an act of war and have it thus absolve us of all
debt to the Chinese as restitution?

Do you really have Chinese legitimately using your website, etc? If not,
block all their address range. Shouldn't stop them from sending email
through an ISP for that kind of legitimate traffic.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Jeff Bull" <jeff.nyco@xxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 11/14/2014 11:31 AM
Subject: I've had one **** of a day ...
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



I came in to work early this morning, happy and with a spring in my step .



The Firewall settings on my router had been trashed, at the same time
taking
one of my iServer Ethernet lines down. Very suspiciously, only the 'Deny
service' to IP-addresses at Chinese ISPs had been deleted.



My router has been bombarded by 'attacks' from Chinese IP-addresses for a
year now. (I look them up at http://en.utrace.de/ip-addresses/)



This happened at 03:30 this morning, and then again at 14:30 this
afternoon;
I was in the office the second time and actually watched as the firewall
entries disappeared. I changed the router login password as soon as I
suspected the problem might be there; though I am rather guessing a
back-door could be involved.



Now I've got no 'sensitive' data on my systems, client contact details is
about as bad as it gets, but I don't want them to have free access, a
matter
of principle.



Well I've re-entered the firewall entries twice today, oh, and they
managed
to erase my backup too, and I'm pretty peed off I can tell you.



Does anyone know how I can keep the intruders out. I discussed this with
my
ISP and the router supplier (router made in China of course) and I might
as
well have been talking to them in Chinese!





Regards



Jeff