| |||
|
Posted by Colin Blanks on 29 January 2001 at 18:20:22: I blocked a scan with the Netbus trojan from an IBM Netherlands address. I sent the traceroute log to Abuse@IBM.net & await a response - Its a good thing I am not paranoid !!!
Posted by Les Bremner on 30 January 2001 at 10:27:32: In Reply to: Maybe off topic- Trojan Scanned- Paranoia ? posted by Colin Blanks on 29 January 2001 at 18:20:22:
I am sorry, but I do not understand any of this.
Posted by Alan Murphy on 31 January 2001 at 08:27:08: In Reply to: Maybe off topic- Trojan Scanned- Paranoia ? posted by Colin Blanks on 29 January 2001 at 18:20:22: : I blocked a scan with the Netbus trojan from an IBM Netherlands address. I sent the traceroute log to Abuse@IBM.net & await a response - Its a good thing I am not paranoid !!! So it seems that someone at IBM Netherlands is now interested in our activities. Please let us know about any reply you get from Abuse@IBM.net For information:
Posted by Boudicca on 02 February 2001 at 21:29:10: In Reply to: Maybe off topic- Trojan Scanned- Paranoia ? posted by Colin Blanks on 29 January 2001 at 18:20:22: : I blocked a scan with the Netbus trojan from an IBM Netherlands address. I sent the traceroute log to Abuse@IBM.net & await a response - Its a good thing I am not paranoid !!! Colin, what you need is some help. You might naturally think of Before you do you might just consider page 25 of IBM's Annual For those who would rather not dirty themselves in such perilous INFORMATION SECURITY PRACTICE Well anyway we continue... Nanette (top left window... [Ed " with the telescope snooping, Read Lou's oroginal to believe. Hope the Trojan drew a Big Blank with you Colin. Spot on report. Boudicca - Queen of the Britons
Posted by Alan Murphy on 03 February 2001 at 13:45:01: In Reply to: Re: It is on topic- Trojan Scanned- Paranoia? Maybe not. posted by Boudicca on 02 February 2001 at 21:29:10:
The item referred to by Boudicca can be found in the IBM Annual Report 1999 - see the URL: There is a picture taken at night showing 3 people behind windows in a lighted upstairs room. The text reads: Nanette (top left window), Han(center) and Daniel(top right) are on the wanted list. Our customers pay them and their teams of industry specialists and "ethical hackers" to exploit business vulnerabilities and attack computer systems in order to stress-test company defenses and evaluate risks. As security moves to the top of customers' agendas, with growing requirements to protect against theft, industrial espionage and fraud, IBM's information security practice is doubling its revenue annually. The trace of the Netbus Trojan attack shows that the attempt came from IBM Netherlands, via Belgium and the UK IBM networks.
1. BlackIce Defender 2.1 - www.networkice.com Prices range from £25 to £50 Hope that helps
Posted by Colin Blanks on 04 February 2001 at 07:25:34: In Reply to: Re: It is on topic- Trojan Scanned- Paranoia? Maybe not. posted by Boudicca on 02 February 2001 at 21:29:10: Now Moved to Security State Black. Iceni security suite installed. It is now impossible to send this.
Posted by Brian Marks on 04 February 2001 at 19:08:27: In Reply to: Re: Maybe off topic- Trojan Scanned- Paranoia ? posted by Les Bremner on 30 January 2001 at 10:27:32:
I suggest you should be worried at about the same level as you worry about viruses, or [If you think it is IBM doing the scanning, as hinted in some of the messages, then discount
Posted by ACPlanner on 05 February 2001 at 19:47:25: In Reply to: Maybe off topic- Trojan Scanned- Paranoia ? posted by Colin Blanks on 29 January 2001 at 18:20:22:
If you run Unix on your box, you can fake your IP address. For info, what was the IP address that tried to attack you. Email me if you prefer
Posted by Colin Blanks on 06 February 2001 at 18:17:47: In Reply to: Paranoia? posted by Colin Blanks on 04 February 2001 at 07:25:34:
27/01/01 07:42:06] Incoming hack attempt from IP Address: 139.92.144.231
Posted by Boudicca on 06 February 2001 at 22:52:32: In Reply to: Re: Paranoia? For those of a technical bent here's the trace posted by Colin Blanks on 06 February 2001 at 18:17:47: Try consulting the Gods at http://www.samspade.org The Demi Gods there said: IP block lookup for 139.92.144.231 whois -h whois.arin.net 139.92.144.231 IBM Netherlands N.V. (NET-IBMNETHERLANDS) Netname: IBMNETHERLANDS Coordinator: Domain System inverse mapping provided by: NS.UK.IBM.NET 152.158.16.48 --------------------------------------------------- Of course The Netherlands are very big on privacy. Try getting Boudicca
Posted by Ethical Hacker on 07 February 2001 at 21:18:30: In Reply to: Re: Paranoia? For those of a technical bent here's the trace posted by Colin Blanks on 06 February 2001 at 18:17:47: You must escalate this until you get resolution. While I worked at IBM, them sort of activity was absolutely forbidden. The proxies will keep a log of who initiated the attack, and you should demand a proper investigation.
Posted by Colin Blanks on 09 February 2001 at 18:11:41: In Reply to: Re: Paranoia? For those of a technical bent here's the trace posted by Ethical Hacker on 07 February 2001 at 21:18:30:
: An incident reported by you has been updated. Sev: 4 Summary: FW: Netbus Trojan Scanning ------------------------------------------------------------------------- The problem you submitted has already been reported. ------------------------------------------------------------------------- Thank you for the feedback. The issue you have reported is currently under Please continue to inform us of any abuse originating in our domain. *************************************************************************
Posted by Tally_ho_us on 10 February 2001 at 04:58:38: In Reply to: Who is 139.92.144.231? Is it Lou Gerstner? Say Lou not so! posted by Boudicca on 06 February 2001 at 22:52:32: : Try consulting the Gods at http://www.samspade.org : The Demi Gods there said: : IP block lookup for 139.92.144.231 : whois -h whois.arin.net 139.92.144.231 : IBM Netherlands N.V. (NET-IBMNETHERLANDS) : Netname: IBMNETHERLANDS : Coordinator: : Domain System inverse mapping provided by: : NS.UK.IBM.NET 152.158.16.48 : --------------------------------------------------- : Of course The Netherlands are very big on privacy. Try getting : Boudicca Why would they want to "Hack" you. You all have been less vocal than your
|
|||
Back to: Documents Contents |