RE: Is someone trying to hack my system?

Take option 3 Work with TCP/IP connection status. Review the list for "normal" activity. If you suspect people are currently attached that should not be, review your connections that are in an Established state and drop the ones which are not authorized.

As soon as possible, review the ports which are in Listen state and change configurations so that unnecessary ports are not open. Immediately after that establish perimeter security (firewall) to enforce rules about which connections are allowed and from what origins. These are not trivial tasks. You may need some help, and you want to do this as urgently as possible.

Good luck

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bob Voltz
Sent: Wednesday, May 20, 2009 10:58 AM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Is someone trying to hack my system?

This activity is not normal.

What would I look for with NETSTAT?

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Josh Diggs
Sent: Wednesday, May 20, 2009 1:36 PM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: Is someone trying to hack my system?

I would say yes. These logs show that someone from the internet is connecting to your computer. If someone from the internet can connect to your computer, hackers from the internet can connect to your computer. It then follows that someone is trying to hack your system.

It does not follow that these examples are said hackers. You need to be able to define what normal use is. The fact that two of these are Chinese IPs and the other two are African (I think), would be a concern for us, but if you do business in China and Africa, maybe that's normal for you.

Try using netstat to determine if there is anything unexpected happening on the network.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.