.

Hacked server but logs show a traceable IP.

<<

petera

Newbie
Newbie

Posts: 7

Joined: Mon May 21, 2007 8:28 am

Post Mon May 21, 2007 8:32 am

Hacked server but logs show a traceable IP.

Hi there

I'm an IT engineer in London. Last Thursday I was called out to a client who I had never been to before. They were having some major server problems. After poking around a bit it transpired that their server had been hacked. Whoever had got in had created himself a user account with domain admin privileges and inserted a virus on the server which ran as "2footninja.exe" or something like that. I spent most of the day locking down the server so it couldn't be repeated. However, I then began checking the logs to see if I could find anything about who had hacked this server. I subsequently found that whoever had hacked this server did so from the IP address <REMOVED AS SOMEONE COMPLAINED>. After doing a quick whois on the ptr record it seemed that this was a "one and one internet" customer (I assume this is a broadband provider in the US). More than that I cannot tell. I then did some portscans and found 3389 and ftp open. I also managed to login via anonymous ftp and located the virus he used to infect my server in a file " foot.zip" I then left and went home, that night I ran tsgrinder against his terminal server port but came up with nothing - no doubt my dictionary attack would have been ineffective against someone who knew what he was doing anyway. I was hoping if I could log into his server I might be able to find out his name or email address...

Other files I located on his server of interest was a directory "artexpo 2007" which seemed to have been files perhaps taken from another company. I tried contacting the person Kim who was listed on the bottom of some of the documents via email but got no reply.

My question is this: Have I reached the end of my detective work? Is there nothing more I can learn about this person? Has he escaped forever without me being able to (at least) send him an angry email?

Any thoughts/coments would be interesting.

Pete
Last edited by petera on Mon May 21, 2007 8:56 am, edited 1 time in total.
<<

LegioX

Newbie
Newbie

Posts: 25

Joined: Sun Sep 24, 2006 5:27 am

Post Mon May 21, 2007 8:40 am

Re: Hacked server but logs show a traceable IP.

Dude - I don't think it's very ethical to post the IP address here... try to keep yuor questions generic and people will be more than happy to help out.
MCSE & MCSA : Security (2003), A+, Network+, Security+, CEH, CCNA, JNCIA-FMW
<<

petera

Newbie
Newbie

Posts: 7

Joined: Mon May 21, 2007 8:28 am

Post Mon May 21, 2007 8:57 am

Re: Hacked server but logs show a traceable IP.

I modified the post so the ip is not shown now. Any ideas?
<<

LegioX

Newbie
Newbie

Posts: 25

Joined: Sun Sep 24, 2006 5:27 am

Post Mon May 21, 2007 9:05 am

Re: Hacked server but logs show a traceable IP.

A WHOIS on the IP should tell you who the ISP is. The best advice I can give you is to complain to them. Especially as you've said you think the person that hacked you is in the US - they have pretty clear laws about breaking into computer systems. If he was in China or Russia you may get less sympathy  :)

Most ISP's have an 'abuse@domain-name' email address to deal with complaints like this. Take some screenshots and copy the logs then attach these to the email.
Be assertive - if it's a business server that's been hacked stress to the ISP that they need to deal with this criminal ASAP.
Chances are they will as they don't want to be sued and if you havae clear evidence then they may get the police/FBI involved.

I wouldn't suggest trying to hack into his TS or FTP server. A simple port-scan can't do any harm, but actively attacking him could get you into trouble ("but he started it" is never going to fly in a court of law).
Also, if he's any good, he has probably just relayed his connection through another hacked box so you might be attempting to hack another legitmate company!
MCSE & MCSA : Security (2003), A+, Network+, Security+, CEH, CCNA, JNCIA-FMW
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Mon May 21, 2007 9:35 am

Re: Hacked server but logs show a traceable IP.

LegioX makes a great point. Breaking into a robber's house also makes you a criminal, even if it's to look for evidence of a crime committed against you. Think of how this would be treated in the real world. Not only would you go to jail, but the evidence would be inadmissable. When all is said and done, you're in the jail and the original crminial goes free. Is it fair? Probably not, but escalating crimes cannot be tolerated by law enforcement for understandable reasons.

Can you show financial loss? Unfortunately, many law enforcement outfits won't help if it does not meet a certain dollar amount. With so many cases out there, they have to draw the line somewhere, because they simply don't have the man-power to handle every case. So showing something like $5000 or more of financial loss may get you more attention from both the ISP and the FBI.

The you have to ask yourself... is it worth it? Again not fair but this is life.

Don
CISSP, MCSE, CSTA, Security+ SME
<<

oleDB

User avatar

Recruiters
Recruiters

Posts: 236

Joined: Thu Jul 20, 2006 8:58 am

Location: HOA

Post Mon May 21, 2007 12:42 pm

Re: Hacked server but logs show a traceable IP.

In the future, if the customer is interested, you might want to take a full dd image of the system once you've determine there's been an incident. That way you can repair it, but still have an image to do your detective work on. Also, to get a conviction out of it, your most likely gonna have to do nothing and allow the hacker back in with a legal wiretap by FBI or UK equivalent. Most companies don't want to do this unless there are major losses. Its not always worth it, but I would recommend getting an image next time. It will give you a really accurate timeline and record of what the hacker did. Plus, many times people will patch the system and the hacker still gets back in due to a rootkit/backdoor that they didn't know about.

Also, I don't think 1&1 is an ISP here, I thought they were only hosting and registrar. And I think there based in Germany.
<<

LSOChris

Post Mon May 21, 2007 2:13 pm

Re: Hacked server but logs show a traceable IP.

the other thing to remember is that that IP is probably the other helpless victim in the mess and "probably" not the real attacker's IP.

that's why contacting the ISP is a good first step.
<<

petera

Newbie
Newbie

Posts: 7

Joined: Mon May 21, 2007 8:28 am

Post Mon May 21, 2007 3:12 pm

Re: Hacked server but logs show a traceable IP.

Hi

Thanks for everyones comments
I understand that there is probably nothing that can be done. This is unfortunate.
With regards to the ip - I don't believe that it is a third party's ip due to some other tests that I have done (nothing dodgey I promise).

I do have a couple of questions though.

1) Why is posting someone else's IP address unethical?
2) If it is considered unethical to login to someones anonymous ftp site then how can a port scan not also be unethical?

Pete
<<

Negrita

User avatar

Sr. Member
Sr. Member

Posts: 299

Joined: Sat Sep 10, 2005 5:45 pm

Location: /dev/null

Post Mon May 21, 2007 4:00 pm

Re: Hacked server but logs show a traceable IP.

The ethics part means that you get written permission from the owner of that server to perform a port scan, run tsgrinder, or to even log on to it. LegioX did not say it was unethical to perform a port scan on it, he said it can't do any harm. (This is not entirely correct, as some port scans on some servers may cause the server to reboot or freeze.)

Posting the IP is a bad idea, as even though this site is an ethical hacking site, it is frequented by many unethical types who are thirsty for the information here. Along comes petera and anounces to the world that at a certain IP, there is an open FTP server with free malware to download.

Now crackers usually use steping stones, such as open proxies or other hacked boxes, so this FTP server is probably just the last step before your customers server. It might even be someone elses production server and they may not even know that it is now being used as an open FTP server or even as a malware repository. One thing is sure. When the owner of this server starts to check what's happening to it, they will surely see all your activities there, and they won't seem as inocent to them as they might seem to you.
CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.
<<

petera

Newbie
Newbie

Posts: 7

Joined: Mon May 21, 2007 8:28 am

Post Mon May 21, 2007 4:09 pm

Re: Hacked server but logs show a traceable IP.

--One thing is sure. When the owner of this server starts to check what's happening to it, they will surely see all your activities there, and they won't seem as innocent to them as they might seem to you.

True but he will have the same problem I have - he wont be able to prove I cost him $5000 in damage. So I don't have much to worry about there then.
<<

Negrita

User avatar

Sr. Member
Sr. Member

Posts: 299

Joined: Sat Sep 10, 2005 5:45 pm

Location: /dev/null

Post Mon May 21, 2007 4:19 pm

Re: Hacked server but logs show a traceable IP.

This is not true. Someone else may have caused him more than $5000 damages (perhaps important production files were stolen from the server, or the companys roadmap was on there), yet the only evidence of anyone ever being there will be yours.
CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.
<<

petera

Newbie
Newbie

Posts: 7

Joined: Mon May 21, 2007 8:28 am

Post Mon May 21, 2007 4:26 pm

Re: Hacked server but logs show a traceable IP.

And that proves that it must have been me how? Lets face it nothing is going to happen at all and your just being paranoid.
<<

Negrita

User avatar

Sr. Member
Sr. Member

Posts: 299

Joined: Sat Sep 10, 2005 5:45 pm

Location: /dev/null

Post Mon May 21, 2007 4:44 pm

Re: Hacked server but logs show a traceable IP.

petera wrote:And that proves that it must have been me how? Lets face it nothing is going to happen at all and your just being paranoid.


Thank you for the compliment.  :)  Perhaps if you were a bit more paranoid yourself, you might be a good ethical hacker.

When I learned security, I was told that if you follow 2 rules you will (almost) always be safe;
1. Never install anything that you don't have access to the source code and that you can't compile on your own.
2. Never trust anyone online, not even the person masquerading as your grandmother. Everyone online is out to screw you. The only person you can ever trust with a computer is yourself.
CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.
<<

petera

Newbie
Newbie

Posts: 7

Joined: Mon May 21, 2007 8:28 am

Post Mon May 21, 2007 4:50 pm

Re: Hacked server but logs show a traceable IP.

That advise is ridiculous. What type of firewall do you implement on your pc? Do you physically cut the network lead with scissors when your done surfing the internet?

You do realize that there is a balance between security and compatibility right?

And finally, who said I wanted to be an ethical hacker? This is an assumption that you made based on what evidence?

Petera
1337 HaXxOr Crew. 8)
<<

LSOChris

Post Mon May 21, 2007 10:17 pm

Re: Hacked server but logs show a traceable IP.

petera wrote:
And finally, who said I wanted to be an ethical hacker? This is an assumption that you made based on what evidence?

Petera
1337 HaXxOr Crew. 8)


then you'll probably get no more help here. 

bye

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software