Identify and Report Abuse and Would Be Hackers - The IP Address

[ravish]

From years of experience in the IT security industry, most attacks I have seen through corporate firewalls attempting to hack into the company’s information are rarely directed from an actual individual. Most hacking attempts are written into scripts called Trojans and Bots which are slyly installed on the victims PC. These scripts unwittingly to the owner of the PC launch there attacks as background tasks and scan the internet for any other machine which is unprotected executing the contents of the hackers script on another poor victim. The majorities of these scripts are very basic and tend to attack TCP ports such as port 23 Telnet port. If the initial connection attempt is successful, the script will then run the next portion of the attack, which may attempt to run a brute force password dictionary attack. In the event that the password is guessed, another process may launch to directly notify the writer of the script that a device has succeeded to be unlocked this will leave the door unlocked for the hacker to return in person to delve further into the depths of the network and potentially the sensitive information from the organization.

If Web Programmers falls foul of this type of attack, it will be very difficult to track down the hacking attempt to the author of the script unless the script reveals information about the author such as an IP address which may be used to send information back to the author.

If you are lucky enough to be armed with this information there are several ways to identify the end hosts. The IP address will identify the individual even if the address is dynamic or has been NAT since service providers keep a log of user names associated with the IP address and a timestamp stating when these were assigned. Firstly you will need to go to the WHOIS database, there are many sites you can find just by tapping WHOIS into Google, and enter the IP address of the attack. This should reveal the ISP of the hacker and an email address to report the abuse. Most respectable ISPs such as BT will take action by either notifying the abuser of breaches to the T&CS or just by terminating the connection altogether.

The moral of the story is however that the passwords and usernames you use on your network or web server must not be easy to guess and that virus checkers are up to date and firewall ports locked down, especially inbound ports such as telnet, rdp, ssh and any other port which may allow the machine to be remotely administered.