RE: What Can You Do?

Please note that in my original post I did indicate that we were effectively blocking the Telnet attempts before they even see the signon screen.  This is done using our exit point software and implementing IP address range controls.  We do this for all TCP servers.

I like David's idea about blocking an IP address for a couple of weeks, but every access attempt in this series, which has been going on since the start of the month, has come from a different address.

Thanks for all the comments so far.

Rich
-------------------------

Quoting Helge Bichel <hbi@xxxxxxx>:

Hi Rich.

I do recognize the 27 telnet attempts on my site from almost all over the
world.

I have a nice system (Easy400 SECTCP) to block telnet and ftp, it works, but
it takes some time to investigate and add new ip patterns for blocking.
FTP is only open for dedicated ip's since only a few ip's using it.

You could ask: why not just allowed selected/validated ip's for telnet.
It's not an option for telnet, or at least a difficult one, because real
users are connecting from
many different countries on a 24/ basis, and even switches ip between
office, home, airport, hotel etc.
Therefore the need having *all ip's open and try to block ip ranges used by
hackers.

That's what I do.

Best regards
Helge Bichel
Copenhagen
Denmark



-----Oprindelig meddelelse-----
Fra: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] På vegne af Rich
Loeber
Sendt: 20. maj 2015 21:01
Til: Midrange Systems Technical Discussion
Emne: What Can You Do?

    I regularly see and capture information about attempts to gain access to
    my system.  This month, I've seen a repeated attempt by someone to gain
    access by establishing a Telnet session.  So far, our software has
    successfully rebuffed every access attempt.  Because of the pattern, it
    appears to me that someone is specifically targeting our IBM i server.
    Every attempt consists of 27 attempts to establish a Telnet session, none
    of which are successful.  Then, the process repeats itself several hours
    later.  The IP addresses are from all over the place from RIPE in The
    Netherlands to APNIC in Brisbane, Australia and from Time Warner, Comcast
    and more.

    I thought I'd notice law enforcement to see if something can be done
    before damage happens and it turns out that there is NOTHING that can be
    done.  This is clearly malicious in intent but since no crime has been
    committed, nobody can do anything about it.  I checked with the local
    police and the state police and I get the same response from both.  I
    suppose I could call the FBI, but I suspect they will sing the same song.

    So, my question is, is there anything that you can do when you see this
    kind of activity?  Is there any agency that would respond?

    The state police offered to take my system and audit it for me, but that
    is just not an option.

    Is this the state of protection from cybercrime?

    Rich Loeber - @richloeber
    Kisco Information Systems
    [1]http://www.kisco.com

References

    Visible links
    1. http://www.kisco.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.