RE: Incident response to being scanned

From: Allan Schon (allanschon_at_mckinleymachinery.com)
Date: 04/25/03

  • Next message: Greg Tracy: "Re: Cable Vs. DSL" 
    Date: Fri, 25 Apr 2003 13:07:50 -0400
To: <security-basics@securityfocus.com>

    Bob,
    I think filing abuse reports might be rather extreme, unless you suspect that they are actively attempting to attack your network. Rememeber, most of them are either script-kiddies who just downloaded nmap for the first time or incompetent admins who have infected machines, and don't know it.

    If I were to do anything at all, I'd try to track down an e-mail address associated with the IPs from your logs and send a polite letter informing them of the problem... Truth be told, though, I would probably just block out the IP, and forget about it entirely...

    --Allan

    -----Original Message-----
    From: Bob Kelley [mailto:b0bk3ll3yjr@adelphia.net]
    Sent: Friday, April 25, 2003 1:16 AM
    To: security-basics@securityfocus.com
    Subject: Incident response to being scanned

    In reviewing my firewall and web server logs, I see repeated attempts from
    several ip addresses to scan my network as well as infect my webserver
    with code red. The source addresses are not always the same. I am
    confident that I don't have any holes in my firewall and my webserver is
    up to date. I perform weekly vulnerability scans of my equipment to make
    sure I am covered.

    What is considered the best practice for dealing with these incidents?
    Should I be filing abuse reports with the ISPs of the source IPs? This
    obviously takes time. I am looking for a business case to justify the
    time spent responding.

    Thanks

    ---------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
    world's premier event for IT and network security experts. The two-day
    Training features 6 hand-on courses on May 12-13 taught by professionals.
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor
    sales pitches. Deadline for the best rates is April 25. Register today to
    ensure your place. http://www.securityfocus.com/BlackHat-security-basics
    ----------------------------------------------------------------------------

  • Next message: Greg Tracy: "Re: Cable Vs. DSL"

    Relevant Pages

    • Administrivia: RE: Logs showing GET /.hash=...
      ... It has passed the point of being useful from an incident response ... and moved into how to control specific activity on a network. ... Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the ... Training features 6 hand-on courses on May 12-13 taught by professionals. ...
      (Incidents)
    • Re: Fl Turbo quote
      ... in your network from its inception. ... Make a list of all authorized wireless Access Points in your ... If you already have a standard incident response policy, ...
      (rec.gambling.poker)
    • Re: ADSL Internet connection slow on w3svc service IIs 6.0 Win2k3
      ... The first thing i would do is check for network traffic on the webserver. ... I would consider this server to be "dirty" and re-install, ... > Since one month I have some problems with my ADSL internet connection. ...
      (microsoft.public.inetserver.iis)
    • Re: Working on a Web Server 2003
      ... Are you trying to setup and secure a webserver on a DC? ... A built in account that has a high level of access rights ... Interacts throughout the network with the computer account ... The services you mentioned, NetworkService, Local system, Local service, as ...
      (microsoft.public.windows.server.active_directory)
    • Re: Working on a Web Server 2003
      ... Are you trying to setup and secure a webserver on a DC? ... A built in account that has a high level of access rights ... Interacts throughout the network with the computer account ... The services you mentioned, NetworkService, Local system, Local service, as ...
      (microsoft.public.inetserver.iis)