Re: What Can You Do?

On 20-May-2015 14:01 -0500, Rich Loeber wrote:

I regularly see and capture information about attempts to gain
access to my system. This month, I've seen a repeated attempt by
someone to gain access by establishing a Telnet session. So far, our
software has successfully rebuffed every access attempt.

Filtered by the firewall, or only later?

Because of the pattern, it appears to me that someone is specifically
targeting our IBM i server. Every attempt consists of 27 attempts to
establish a Telnet session, none of which are successful. <<SNIP>>

Does that mean they do not even get a signon screen? Regardless, if nothing else, be sure the signon screen clearly states "Authorized Access Only" and that "Attempts to gain access to this system either by entering illicitly obtained credentials or credentials not dispensed to you directly by Xxx Corp. will be construed as breaching the Computer Fraud and Abuse Act, and will reported to the USA Federal Bureau of Investigation (FBI)." While effectively meaningless, they do specifically make known to anyone reaching the signon screen, that they are considered /authorized/ only under the auspice of the corporation that owns the server and only with the credentials that corporation has provided to them; essentially, /No Trespassing/ signage placed prominently so a hacker\cracker can not feign ignorance, legitimately.

<<SNIP>> I suppose I could call the FBI, but I suspect they will sing
the same song.

So, my question is, is there anything that you can do when you see
this kind of activity? Is there any agency that would respond?
<<SNIP>>

I would expect about the only agencies that would respond are either specific state agencies in effect for the criminal statutes regarding computing\communications crimes, or federally, the FBI regarding most likely as activity breaching the 1986 Computer Fraud and Abuse Act (CFAA).

Or maybe the NSA is working on finding a way in, so then there is no hope for help from anyone ;-)

I found an article [with a video apparently; I block that content] mentioning the CFAA and apparently talk of updating that with newer\tougher "antihacking" language.?
<http://www.csmonitor.com/World/Passcode/2015/0406/Why-security-pros-don-t-like-Obama-s-proposal-for-antihacking-law-video>