[olug] Attacked by Romanian Script Kiddies

[Daniel Linder]

>> How long has this been happening because grandfathers computer just got
>> hit
>> by something and I was wondering if that had to any thing to with the
>> Romanian Script Kiddies.
>>
>> Kbw

Don't think that the 'Net was quiet up until a few days ago -- chances are
that if the computer was not up-to-date on patches nor firewalled from the
raw Internet, it was compromised only days after it was installed.

<digression>
Years ago when I was working for an ISP, we had a NOC with a projection
display of messages/alerts coming in from the various systems deployed. 
It looked great and could give quite a bit of good information. 
Unfortunatly, early on we told it to display any connection that the
firewalls rejected (condensed into a single source IP address per line). 
The higher the number of blocks from one IP address, the higher the line
went on the display and changed in color.
After a few weeks of watching the top 2/3 of the display show nothing but
red "connection rejected from X.X.X.X" lines, we decided to drop that from
the display so we could see usefull information.
Upper managment was still in the "dog and pony" show mode and liked that
up there to show how well we were protecting the customers servers.  We
ended up making two filters for the display: one for usefull information,
and another that showed everything including the rejected messages.
</digression>

Being the closest thing we had to a security person, I tried to take one
"busy" IP address a day and submit it to the appropriate ARIN/RIPE/etc
group for removal.  At that time, probably 75% of these that I submitted
were in the Asia Pacific region and mostly registerd to a Chinese ISP.  I
really doubt my e-mails were paid attention to especially considering all
the reports of "Internet Warfare Training" that many countries are
promoting now.

Dan

- - - -
"Wait for that wisest of all counselors, time." -- Pericles
"I do not fear computers, I fear the lack of them." -- Isaac Asimov
"Soon we will be able to harness the rotational energy from Orwell's grave
to solve all world energy problems." -- /. user GigsVT (208848)
GPG fingerprint:6FFD DB94 7B96 0FD8 EADF  2EE0 B2B0 CC47 4FDE 9B68