[ILUG] reporting hacking

[Chris Higgins]

On Tue, 2 Nov 2004 23:22:43 +0000
Liam McDermott <theirishmole at gmail.com> wrote:

> hi
> 
> my brother is running a linux box connected to adsl 24/7 and has hag
> several attempted ssh connections from the same ip address.

First off - take the IP address and go match it in the Ripe database (www.ripe.net ) to find
out who owns it. Ripe may send you to ARIN or APNIC ( US and Asia/Pacific equivalent databases )

Once you know who owns it you should have an admin contact for the address range. 
They normally have an 'abuse@' email address that you should contact.

If it's an IP address from somewhere in ireland, then the admin's for the address range are
probably reading - but what can they do  ? 

Let's assume that it was my address that probed you - I'll just claim to anyone that emails
me that it was a violated windows machine on the network. :-)

Our office firewall is probed continually - you might consider looking at fightback as part
of http://www.dshield.org

> 
> who should he contact? , the gardai?, or is there another specialist
> department.

I suspect that unless something more than a probe has happened, the gardai won't be
the slightest bit interested .. and even if the were - what can they do ? Arrest someone
because a machine somewhere on the net sent some packets ? You'd need to be 
broken into - and damage to have occurred before I'd expect the gardai to do anything
more than point you at ripe themselves :-)

> 
> cheers
> 
> liam
> -- 
> Irish Linux Users' Group
> http://www.linux.ie/mailman/listinfo/ilug/
> 


-- 
Chris Higgins                              
Darach Technology Ltd                      tel: +353-1-6204370
email: chris.higgins at darach.ie          fax: +353-1-6204371
http://www.darach.ie