Re: Dealing with script kiddies

From: Frank S (fsexton@qwest.net)
Date: 06/07/02 

From: "Frank S" <fsexton@qwest.net>
Date: Thu, 06 Jun 2002 23:56:20 GMT

Few things...

First, what you are seeing is CodeRed/Nimda attacks. Virtually everyone
running a web server is getting these, just as you are.

Next, they are not being "typed" into the attackers keyboard, they are
automated. That is why you see 20 or more successive failed attempts.

Next, the computer they are coming from may not even be the bad guy. The
bad guy is using the good guy's computer to do this.

Best bet is to protect your system against them and forget it. Save
yourself some time. Trying to "catch" the perps of these automatic attacks
is not worth the time, IMHO.

-Frank

"Michael A. Covington (Portable computer)"
<look@www.covingtoninnovations.com.for.address> wrote in message
news:OhKYzRaDCHA.1272@tkmsftngp04...
> In my IIS logs, it's obvious that, several times per day, "script kiddies"
> are trying to penetrate the system by running cmd.exe through an HTTP GET
> command.
>
> They're not succeeding, even though many of them try it over... and
over...
> and over, like people who dial a wrong number on the telescope.
>
> I have full information about the dates, times, and IP addresses from
which
> they are connecting.
>
> My question is: How aggressive should I be about reporting these to their
> ISPs?
>
> I realize that most of them have to be ignored, simply because we have
> better things to do with our time. But I think I'm in favor of reporting
> them to their ISPs whenever feasible.
>
> The reason? ISPs used to tolerate spammers and even crackers, until they
> learned, gradually, that if they harbor such people, they will get a
barrage
> of complaints from the intended victims.
>
> Another reason: Any kind of crime prevention has to focus on unsuccessful
> attempts, not just successful ones. It's better to catch people earlier
in
> their careers and try to get them to realize that we don't admire what
> they're doing.
>
> Thoughts, anyone?
>
>
> --
>
> Michael A. Covington - Associate Director
> Artificial Intelligence Center, The University of Georgia
> http://www.ai.uga.edu/~mc
>
>
>
>

Relevant Pages

  • Re: French Riots: Attacks Against Jews Under-reported
    ... One reason for not reporting such things ... >> in the MsM would be to minimise the possibilities of copy-cat attacks. ... > I'm not clear on who you're saying is not reporting. ...
    (soc.culture.jewish.moderated)
  • Re: Dealing with script kiddies
    ... what you are seeing is CodeRed/Nimda attacks. ... But I think I'm in favor of reporting ... > them to their ISPs whenever feasible. ... > Another reason: Any kind of crime prevention has to focus on unsuccessful ...
    (microsoft.public.inetserver.iis.security)
  • RE: Denial of service question.
    ... to work is if your provider puts a firewall or other filtering device ... It is a popular misconception that their is nothing anyone can do about DoS ... attacks. ... wide-scale DoS attacks and neither the ISPs nor the consulting firms ...
    (Security-Basics)
  • Re: Bye Bye
    ... month down to a handfull -sad but life goes on. ... so anyone who wants to as well -I'm on Facebook -search ... That seemed to help as the ISPs intervention and ... the efforts of others coincided with the attacks ceasing. ...
    (uk.rec.equestrian)
  • Re: Why are women too dumb to program a computer???
    ... then I will begin complaining to all of your ISPs on ... The first attack post dated on or after Nov. 10, ... will be the first to be the subject of such a complaint. ... And it will resume if the attacks ever resume. ...
    (comp.lang.java.programmer)