Intrusion detection

Hi! I've been intruded! Sounds personal, but...I like my space to be my
space. An IP address did a port scan, actually about 7 of them. I used the
whois and found them, contacted the ISP who is supposedly doing an
investigation.

I've found this site, http://www.columbia.edu/acis/security/aprocedure.html,
is it a good one to follow? The ISP told me they couldn't tell me anything,
that I'd have to subpeona their records. Who wants to go through all that?
I just want to know who it is and why they're doing it? What rights do we,
the non-intruder have?

Any advice?

Obviously, I need to block the particular IP in ISA, but beyond that...

Marcia Porter

Dave
Thu Oct 23 17:09:45 CDT 2003

I hope we get a lot of comments and answers to this question. I don't know
much about it, but to throw in my $.02, I get the occasional port scan that
shows as being from a reputable, computer related manufacturing company. I
don't have any idea why their server would be scanning my IP, but I can't
imagine it's anything malicious.

I'm not sure a port scan is an intrusion per se - I've never had any other
sign of trouble from these people other than that every few months, a port
scan is logged from the IP of their web server.


"Marcia" <mporter@martechgroup.net> wrote in message
news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> Hi! I've been intruded! Sounds personal, but...I like my space to be my
> space. An IP address did a port scan, actually about 7 of them. I used
the
> whois and found them, contacted the ISP who is supposedly doing an
> investigation.
>
> I've found this site,
http://www.columbia.edu/acis/security/aprocedure.html,
> is it a good one to follow? The ISP told me they couldn't tell me
anything,
> that I'd have to subpeona their records. Who wants to go through all
that?
> I just want to know who it is and why they're doing it? What rights do
we,
> the non-intruder have?
>
> Any advice?
>
> Obviously, I need to block the particular IP in ISA, but beyond that...
>
> Marcia Porter
>
>

Marcia
Thu Oct 23 17:15:23 CDT 2003

Couldn't port scans simply be hackers trying to break MS code...

Perhaps releasing a new virus or worm later....

I feel intruded and threatened. I too hope to get some good answers.

Where's Susan?

Marcia

"Dave Nickason" <gwdibble@NOSPAM.frontiernet.net> wrote in message
news:OdjrfJbmDHA.1284@TK2MSFTNGP09.phx.gbl...
> I hope we get a lot of comments and answers to this question. I don't
know
> much about it, but to throw in my $.02, I get the occasional port scan
that
> shows as being from a reputable, computer related manufacturing company.
I
> don't have any idea why their server would be scanning my IP, but I can't
> imagine it's anything malicious.
>
> I'm not sure a port scan is an intrusion per se - I've never had any other
> sign of trouble from these people other than that every few months, a port
> scan is logged from the IP of their web server.
>
>
> "Marcia" <mporter@martechgroup.net> wrote in message
> news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> > Hi! I've been intruded! Sounds personal, but...I like my space to be
my
> > space. An IP address did a port scan, actually about 7 of them. I used
> the
> > whois and found them, contacted the ISP who is supposedly doing an
> > investigation.
> >
> > I've found this site,
> http://www.columbia.edu/acis/security/aprocedure.html,
> > is it a good one to follow? The ISP told me they couldn't tell me
> anything,
> > that I'd have to subpeona their records. Who wants to go through all
> that?
> > I just want to know who it is and why they're doing it? What rights do
> we,
> > the non-intruder have?
> >
> > Any advice?
> >
> > Obviously, I need to block the particular IP in ISA, but beyond that...
> >
> > Marcia Porter
> >
> >
>
>

Craig
Thu Oct 23 18:23:36 CDT 2003

I believe there are a lot of things out there that do automatic type of
port scans. Accessing some domain like maybe some government site might do
a port scan for security sake. Who knows.

The article pretty much sums it up. Its kinda like being raped, the raper
has more rights than the victim.

They are right, you would have to go through all that to get their name. If
you didn't have to go through all that there sure would be a lot of people
getting subpeona's from the music industry for file sharing. Although it
would be nice to get hands on that little <explitive>. But then they would
institute some stupid type of marcia'l law on the internet and we got enough
issues the way it is now.

Best just report your suspicions and let it go. You never know you might
just find out it is a game server trying to respond back to one of your
clients who is trying to play the latest greatest game.

As for your server, if it really bothers you that someone is knocking on
your door, make sure your locks are up to snuff and all the windows closed.
If it still bothers you, disconnect it from the net.

Craig P.


"Marcia" <mporter@martechgroup.net> wrote in message
news:O75vaMbmDHA.1284@TK2MSFTNGP09.phx.gbl...
> Couldn't port scans simply be hackers trying to break MS code...
>
> Perhaps releasing a new virus or worm later....
>
> I feel intruded and threatened. I too hope to get some good answers.
>
> Where's Susan?
>
> Marcia
>
> "Dave Nickason" <gwdibble@NOSPAM.frontiernet.net> wrote in message
> news:OdjrfJbmDHA.1284@TK2MSFTNGP09.phx.gbl...
> > I hope we get a lot of comments and answers to this question. I don't
> know
> > much about it, but to throw in my $.02, I get the occasional port scan
> that
> > shows as being from a reputable, computer related manufacturing company.
> I
> > don't have any idea why their server would be scanning my IP, but I
can't
> > imagine it's anything malicious.
> >
> > I'm not sure a port scan is an intrusion per se - I've never had any
other
> > sign of trouble from these people other than that every few months, a
port
> > scan is logged from the IP of their web server.
> >
> >
> > "Marcia" <mporter@martechgroup.net> wrote in message
> > news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> > > Hi! I've been intruded! Sounds personal, but...I like my space to be
> my
> > > space. An IP address did a port scan, actually about 7 of them. I
used
> > the
> > > whois and found them, contacted the ISP who is supposedly doing an
> > > investigation.
> > >
> > > I've found this site,
> > http://www.columbia.edu/acis/security/aprocedure.html,
> > > is it a good one to follow? The ISP told me they couldn't tell me
> > anything,
> > > that I'd have to subpeona their records. Who wants to go through all
> > that?
> > > I just want to know who it is and why they're doing it? What rights
do
> > we,
> > > the non-intruder have?
> > >
> > > Any advice?
> > >
> > > Obviously, I need to block the particular IP in ISA, but beyond
that...
> > >
> > > Marcia Porter
> > >
> > >
> >
> >
>
>

Henry
Thu Oct 23 19:27:59 CDT 2003

Complaining about Port scans is like complaining that people in the
traffic outside your office are looking at it to see if you've left
doors or windows open. ...and even a passing Police unit will do that.
( eg: My ISP regularly does port scans of all clients to see if users on
the "Home" account are running mail servers in
contravention of their ULA ).

I don't know of a single place where Port Scanning per se is illegal.
You should port scan yourself regularly just to see if you ( or some
malware ) has opened your network to possible intrusion.

It certainly pays to be aware of what is happening, ...but I'd not
stress about it provided you've protected yourself to Current Best
Practice.

--
Henry Craven
---------------
42


"Marcia" <mporter@martechgroup.net> wrote in message
news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> Hi! I've been intruded! Sounds personal, but...I like my space to be
my
> space. An IP address did a port scan, actually about 7 of them. I
used the
> whois and found them, contacted the ISP who is supposedly doing an
> investigation.
>
> I've found this site,
http://www.columbia.edu/acis/security/aprocedure.html,
> is it a good one to follow? The ISP told me they couldn't tell me
anything,
> that I'd have to subpeona their records. Who wants to go through all
that?
> I just want to know who it is and why they're doing it? What rights
do we,
> the non-intruder have?
>
> Any advice?
>
> Obviously, I need to block the particular IP in ISA, but beyond
that...
>
> Marcia Porter
>
>

Marcia
Thu Oct 23 21:10:16 CDT 2003

It wasn't our ISP doing the port scan. I do regular scans myself and
believe that I'm protected well. But, it is very suspicious that the same
IP (not known to us) is scanning us--attempting to invade our privacy.

OK....I'll not sweat over it. I didn't view it is complaining, rather I was
seeking advise. Sorry for bothering you.

Marcia


"Henry Craven" <IUnknown@d.com> wrote in message
news:OontfVcmDHA.2272@tk2msftngp13.phx.gbl...
> Complaining about Port scans is like complaining that people in the
> traffic outside your office are looking at it to see if you've left
> doors or windows open. ...and even a passing Police unit will do that.
> ( eg: My ISP regularly does port scans of all clients to see if users on
> the "Home" account are running mail servers in
> contravention of their ULA ).
>
> I don't know of a single place where Port Scanning per se is illegal.
> You should port scan yourself regularly just to see if you ( or some
> malware ) has opened your network to possible intrusion.
>
> It certainly pays to be aware of what is happening, ...but I'd not
> stress about it provided you've protected yourself to Current Best
> Practice.
>
> --
> Henry Craven
> ---------------
> 42
>
>
> "Marcia" <mporter@martechgroup.net> wrote in message
> news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> > Hi! I've been intruded! Sounds personal, but...I like my space to be
> my
> > space. An IP address did a port scan, actually about 7 of them. I
> used the
> > whois and found them, contacted the ISP who is supposedly doing an
> > investigation.
> >
> > I've found this site,
> http://www.columbia.edu/acis/security/aprocedure.html,
> > is it a good one to follow? The ISP told me they couldn't tell me
> anything,
> > that I'd have to subpeona their records. Who wants to go through all
> that?
> > I just want to know who it is and why they're doing it? What rights
> do we,
> > the non-intruder have?
> >
> > Any advice?
> >
> > Obviously, I need to block the particular IP in ISA, but beyond
> that...
> >
> > Marcia Porter
> >
> >
>
>

Henry
Thu Oct 23 21:31:21 CDT 2003

Not a bother at all Marcia,
and this is definitely the forum to ask advice and raise concerns re
anything to do with your SBS Network.

The scanning out there is just a fact of life on the Net. The SPAMers
are to blame for a lot of it, looking for Open relays to use, and worse,
systems that they can compromise to use to launch DOS and other attacks
against the SPAM Blacklist sites. - They have brought down 3 that I know
of, and unfortunately seem to be winning.

One thing you might want to do is set your F/W - Router to not respond
to Ping requests. This cuts down on a lot of the scanning as many won't
bother to do Port Scans on IP's that don't first respond to a ping.

--
Henry Craven
------------------
31 Oct = 25 Dec

"Marcia" <mporter@martechgroup.net> wrote in message
news:eIwtqPdmDHA.1072@TK2MSFTNGP09.phx.gbl...
> It wasn't our ISP doing the port scan. I do regular scans myself and
> believe that I'm protected well. But, it is very suspicious that the
same
> IP (not known to us) is scanning us--attempting to invade our privacy.
>
> OK....I'll not sweat over it. I didn't view it is complaining, rather
I was
> seeking advise. Sorry for bothering you.
>
> Marcia

Rick
Fri Oct 24 20:59:13 CDT 2003

I have the BlockAttacker.vbs running on my SBS, if someone does an Intrusion
detection then it automatically creates a packet filter to block the
offending IP. But I ALWAYS report the offense to the ISP that owns the IP,
just like this article shows. Does it do any good, don't know but I feel
that I have atleast done something. Henry's comment is valid but I think it
is more than looking through windows. It is more like someone walking down
the neighborhood, checking people's house if their front and back door is
unlocked or any windows that can be opened. If you saw someone going down
the street doing that to every house, I would call the cops and in my town,
they will come out and investigate the complaint. Most ISP when I complain
do reply that they will look into it. And if you look at most ISP's, port
scanning is usually against their Acceptable Use Policy by their
subscribers. But to report nothing, I think is irresponsible.
So I think you are on the right track. :-)

Rick in the Midwest

"Marcia" <mporter@martechgroup.net> wrote in message
news:eIwtqPdmDHA.1072@TK2MSFTNGP09.phx.gbl...
> It wasn't our ISP doing the port scan. I do regular scans myself and
> believe that I'm protected well. But, it is very suspicious that the same
> IP (not known to us) is scanning us--attempting to invade our privacy.
>
> OK....I'll not sweat over it. I didn't view it is complaining, rather I
was
> seeking advise. Sorry for bothering you.
>
> Marcia
>
>
> "Henry Craven" <IUnknown@d.com> wrote in message
> news:OontfVcmDHA.2272@tk2msftngp13.phx.gbl...
> > Complaining about Port scans is like complaining that people in the
> > traffic outside your office are looking at it to see if you've left
> > doors or windows open. ...and even a passing Police unit will do that.
> > ( eg: My ISP regularly does port scans of all clients to see if users on
> > the "Home" account are running mail servers in
> > contravention of their ULA ).
> >
> > I don't know of a single place where Port Scanning per se is illegal.
> > You should port scan yourself regularly just to see if you ( or some
> > malware ) has opened your network to possible intrusion.
> >
> > It certainly pays to be aware of what is happening, ...but I'd not
> > stress about it provided you've protected yourself to Current Best
> > Practice.
> >
> > --
> > Henry Craven
> > ---------------
> > 42
> >
> >
> > "Marcia" <mporter@martechgroup.net> wrote in message
> > news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> > > Hi! I've been intruded! Sounds personal, but...I like my space to be
> > my
> > > space. An IP address did a port scan, actually about 7 of them. I
> > used the
> > > whois and found them, contacted the ISP who is supposedly doing an
> > > investigation.
> > >
> > > I've found this site,
> > http://www.columbia.edu/acis/security/aprocedure.html,
> > > is it a good one to follow? The ISP told me they couldn't tell me
> > anything,
> > > that I'd have to subpeona their records. Who wants to go through all
> > that?
> > > I just want to know who it is and why they're doing it? What rights
> > do we,
> > > the non-intruder have?
> > >
> > > Any advice?
> > >
> > > Obviously, I need to block the particular IP in ISA, but beyond
> > that...
> > >
> > > Marcia Porter
> > >
> > >
> >
> >
>
>

Marcia
Fri Oct 24 22:35:19 CDT 2003

Thanks for the encouraging reply.

Marcia

"Rick in the Midwest" <Rick.NOSPAM@NOSPAM.rdfts.com> wrote in message
news:ubovMspmDHA.2500@TK2MSFTNGP10.phx.gbl...
> I have the BlockAttacker.vbs running on my SBS, if someone does an
Intrusion
> detection then it automatically creates a packet filter to block the
> offending IP. But I ALWAYS report the offense to the ISP that owns the IP,
> just like this article shows. Does it do any good, don't know but I feel
> that I have atleast done something. Henry's comment is valid but I think
it
> is more than looking through windows. It is more like someone walking down
> the neighborhood, checking people's house if their front and back door is
> unlocked or any windows that can be opened. If you saw someone going down
> the street doing that to every house, I would call the cops and in my
town,
> they will come out and investigate the complaint. Most ISP when I complain
> do reply that they will look into it. And if you look at most ISP's, port
> scanning is usually against their Acceptable Use Policy by their
> subscribers. But to report nothing, I think is irresponsible.
> So I think you are on the right track. :-)
>
> Rick in the Midwest
>
> "Marcia" <mporter@martechgroup.net> wrote in message
> news:eIwtqPdmDHA.1072@TK2MSFTNGP09.phx.gbl...
> > It wasn't our ISP doing the port scan. I do regular scans myself and
> > believe that I'm protected well. But, it is very suspicious that the
same
> > IP (not known to us) is scanning us--attempting to invade our privacy.
> >
> > OK....I'll not sweat over it. I didn't view it is complaining, rather I
> was
> > seeking advise. Sorry for bothering you.
> >
> > Marcia
> >
> >
> > "Henry Craven" <IUnknown@d.com> wrote in message
> > news:OontfVcmDHA.2272@tk2msftngp13.phx.gbl...
> > > Complaining about Port scans is like complaining that people in the
> > > traffic outside your office are looking at it to see if you've left
> > > doors or windows open. ...and even a passing Police unit will do that.
> > > ( eg: My ISP regularly does port scans of all clients to see if users
on
> > > the "Home" account are running mail servers in
> > > contravention of their ULA ).
> > >
> > > I don't know of a single place where Port Scanning per se is illegal.
> > > You should port scan yourself regularly just to see if you ( or some
> > > malware ) has opened your network to possible intrusion.
> > >
> > > It certainly pays to be aware of what is happening, ...but I'd not
> > > stress about it provided you've protected yourself to Current Best
> > > Practice.
> > >
> > > --
> > > Henry Craven
> > > ---------------
> > > 42
> > >
> > >
> > > "Marcia" <mporter@martechgroup.net> wrote in message
> > > news:eMkhYtamDHA.2528@TK2MSFTNGP12.phx.gbl...
> > > > Hi! I've been intruded! Sounds personal, but...I like my space to
be
> > > my
> > > > space. An IP address did a port scan, actually about 7 of them. I
> > > used the
> > > > whois and found them, contacted the ISP who is supposedly doing an
> > > > investigation.
> > > >
> > > > I've found this site,
> > > http://www.columbia.edu/acis/security/aprocedure.html,
> > > > is it a good one to follow? The ISP told me they couldn't tell me
> > > anything,
> > > > that I'd have to subpeona their records. Who wants to go through
all
> > > that?
> > > > I just want to know who it is and why they're doing it? What rights
> > > do we,
> > > > the non-intruder have?
> > > >
> > > > Any advice?
> > > >
> > > > Obviously, I need to block the particular IP in ISA, but beyond
> > > that...
> > > >
> > > > Marcia Porter
> > > >
> > > >
> > >
> > >
> >
> >
>
>