Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Submission + - Ask Slashdot: How to deal with persistent and incessant port scanner

jetkins writes: What would you do if your firewall was being persistently targeted by port scans from a specific group of machines from one particular company?

I run a Sophos UTM9 software firewall appliance on my home network. Works great, and the free Home Use license provides a bunch of really nice features normally only found on commercial-grade gear. One of those is the ability to detect, block, and report port scans, and under normal circumstances I only get the occasional alert when some script kiddie comes a-knocking at my door.

But in recent months I have been getting flooded with alerts of scans from one particular company. I initially reported it to my own ISP's (RoadRunner's) abuse desk, on the assumption that if they're scanning me then they're probably scanning a bunch of my neighbors as well, and any responsible ISP would probably want to block this BS, but all I ever got back was an automated acknowledgement and zero action.

So I used DNS lookup and WHOIS to find their phone number, and spoke with someone there; it appears that they're a small outfit, and I was assured that they had a good idea where it was coming from and that they would make it stop. Indeed, it did stop a few days later but then it was back again, unabated, after another week or so. So last week I called them again, and was once again assured of a resolution. No dice, the scans continue to pour in.

I've already blocked their subnet at my firewall, but the UTM apparently does attack detection before filtering, so that didn't stop the alerts. And although I *could* disable port scan alerts, it's an all-or-nothing thing and I'm not prepared to turn them off completely.

This afternoon I forwarded the twenty-something alerts that I've received so far today, to their abuse@ address with an appeal for a Christmas Miracle, but frankly I'm not holding out much hope that it will have any effect.

So, Slashdotters, what should I do if this continues into the new year? Start automatically bouncing every report to their abuse address? Sic Anonymous on them? Start calling them every time? I'm open to suggestions.

Comment Back in July - of 2013! (Score 1, Informative) 928

I've read through the lists, and I see a lot of guys insulting each other. You know what? Guys insult each other. It's how we communicate, it's how we bond. It's also brutally honest and helps to enforce the environment that makes for good IT - namely

A woman inserting themselves into that environment should expect to be treated like just another guy.

Oh, and read this:
http://www.computerworld.com/a...

Comment The random numbers are to mitigate kernel exploits (Score 2) 143

Why does the boot process require random numbers, anyway?

They mention this in the article - one way to make a kernel harder to write an exploit for is to randomize the layout of memory somewhat, so system libraries, kernel tables, and the like are located in different places. Obviously if the "random" numbers are predictable, this makes those mitigation techniques less-useful.

Comment Bad info in article (Score 1) 226

From TFA:

Stuxnet only became known to the public when an employee of the Natanz facility took an infected work laptop home and connected to the internet, with the malware quickly spreading around the globe infecting millions of PCs.

Stuxnet never spread via the internet. It spread via USB only and then only up to 3 infections before it removed itself from the USB stick.

Comment Possibly shuttering the futurist think tank? (Score 1) 254

The primary role of the Pentagon is to envision what warfare of the future looks like. They take a 20 year view and ask the following questions (and run the following scenarios):
1) Who is/could be the enemy?
2) What does the battlefield look like (jungle, desert, urban, etc).
3) What kind of weapons/tactics will be used against us.
4) Most importantly, what type of military hardware would we need to have in order to counter that threat 20 years out.

They then take this 'long view' and use that as a road-map to invest in future weapons technologies. Mind you; this road-map gets updated every year. Then again, every year, the Department of Defense (DoD) retires 5% of old military technology, and buys up 5% of what's new... and at the end of that 20 year cycle, you have a 100% refreshed military that his hopefully ready/capable to counter whatever threat is coming at us today.

When the Soviet Union collapsed in the 90's, the war plans changed to a dual-theater conflict between 2 large nation-states (i.e. Russia & China). That is the military they built up to fight, essentially a land war in East Asia. When 9/11 happened, DoD was caught *completely* off guard. The reactionary spending that took place cost hundreds of billions more than it should have to up-armor Humvee's and build MRAP's simply because they had failed to plan for battle in the mountains of Afghanistan/Iraq engaged in guerrilla warfare. (Perhaps this is why it was time to retire Yoda?)

If you shut the think tank, the Pentagon will no longer be the R&D arm of the DoD, and within 10 years, certainly within 20 we will be a completely reactionary military force. From there, I do not see how we could or would remain a military super power. I'm not stating this in order to take a position on this being good or bad; I just wanted to put it out there that this would be the consequence of eliminating this central, core component of the Pentagon - and the role it plays in our entire national defense establishment.

Comment About those margins... (Score 1) 348

But it's far more questionable whether he would welcome the iPhone 5C—almost certainly a low-margin device, despite its current-generation components and plastic body—taking a bite out of the more expensive, and presumably higher-margin iPhone 5S

Seriously? This guys thinks the margins on the iPhone 5c are *lower* than the 5s? In that case, why is everybody else complaining about how expensive the 5c is, and saying it should have been released at a $300 price point? If you believe that the 5c could be made & sold at $300 (and I do), then since it sells at $550, Apple *must* be making something like 40% margins on them. The 5s is $100 more, but I bet it's considerably more-expensive to make.

Comment Re:College used to be inexpensive... (Score 1) 827

No - because then it would be 100% taxpayer funded. College is simply a money laundering operation for political power. Highly subsidized education does nothing to change that. I say the government should get out of the market entirely and let the market decide the fair price on the product being offered.

Comment College used to be inexpensive... (Score 3, Interesting) 827

There was a day when a College education was affordable, and an enterprising student could work their way through college on a part time job. Then the government got involved providing federally guaranteed student loans. This enabled colleges to start raising tuition, because now students could finance their way through college. Today, any college that doesn't raise their tuition is simply leaving money on the table - they'd be fools not to raise rates. The horse has left the barn, and the race is on. There is no upper limit now to what colleges can charge for tuition because the loans are guaranteed.

Now, the political side of this is that conservatives never wanted the government involved in the first place, because government involvement always distorts the market (which is exactly what has happened). Progressives called the conservatives heartless because they wanted to deny education to the poor and underprivileged. Somehow this argument always seems to work - we want life easier today and never think about the consequences. (Progressives and conservatives exist in both parties, don't let anyone fool you into thinking this is a democrat/republican thing.)

Now we have the consequences: Tuition rates that are skyrocketing and it is now near impossible to go through college without taking on obscene levels of debt. Those who decried government involvement in the first place, would like to see government get out of the student loan business. The reaction is obvious: "You are anti-education! You are not for the poor and underprivileged!"

And so here we are, the way to stop it is to collapse the 'Government-Educational-Complex' - shouldn't be hard. The actual value of a college education is rapidly approaching nil, yet people are paying more and more for it. Government is always happy to enslave you to the debt, because then you'll always vote for the party who promises keeping rates low and/or forgiving your student loan debt. If that isn't slavery, I don't know what is.

Comment Someone is taking credit for the hack/disruption (Score 1) 112

There is a TechCrunch article on the breach, and someone by the name of Ibrahim Balic is taking credit for the breach.
What he wrote is below, and the link provided goes directly to the comment.

Hi there,

My name is ibrahim Balic, I am a security researcher. You can also search my name from Facebook's Whitehat List. I do private consulting for particular firms. Recently I have started doing research on Apple inc.

In total I have found 13 bugs and have reported through http://bugreport.apple.com./ The bugs are all reported one by one and Apple was informed. I gave details to Apple as much as I can and I've also added screenshots.

One of those bugs have provided me access to users details etc. I immediately reported this to Apple. I have taken 73 users details (all apple inc workers only) and prove them as an example.

4 hours later from my final report Apple developer portal gas closed down and you know it still is. I have emailed and asked if I am putting them in any difficulty so that I can give a break to my research. I have not gotten any respond to this... I have been waiting since then for them to contact me, and today I'm reading news saying that they have been attacked and hacked. In some of the media news I watch/read that whether legal authorities were involved in its investigation of the hack. I'm not feeling very happy with what I read and a bit irritated, as I did not done this research to harm or damage. I didn't attempt to publish or have not shared this situation with anybody else. My aim was to report bugs and collect the datas for the porpoise of seeing how deep I can go within this scope. I have over 100.000+ users details and Apple is informed about this. I didn't attempt to get the datas first and report then, instead I have reported first.

I do not want my name to be in blacklist, please search on this situation. I'm keeping all the evidences, emails and images also I have the records of bugs that I made through Apple bug-report.

http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev-center-has-potentially-been-breached-by-hackers/?hubRefSrc=permalink#lf_comment=87472293
Short URL: http://fyre.it/tjlVmC.4

Slashdot Top Deals

"Ninety percent of baseball is half mental." -- Yogi Berra

Working...