i just spent a week in a class called 'Ethical Hacking and Countermeasures". They provided us with a disclosure statement saying we wouldn't do any hacking then proceeded to walk us through hacking boxes, SQL injections, all kinds of fun stuff. They even provided all the tools, networks and websites to hack.
First thing they told us is hack into foreign boxes first. once you have hacked into a box in Romania (or where ever) then hack into a box in a another country. After a efw different stops around the globe, then head back to the USA, UK or where ever your target maybe. Foreign ISPs aren't likely to cooperate with US authorities. So after a coutnry or two your trail is sufficiently hidden. Yves Arsenault wrote: > Hey there! > > (Question way at the box.... context follows) > > I had quite a time these last couple of days. > > Yesterday morning, I discovered that one of my employer's linux servers was > down... tried a few things to get some services up and running... but, > misteriously I could no longer log in. (an old Linux Mandrake 10 server...) > > So, I decided to reboot. > > After rebooting, I noticed that a couple of errors presented themselves.... > > An error stating that a file couldn't be found... I was unshure what this > file was... and I later found out. > > After that error, the "logger" service crashed. Weird. > > Anyways, after trying several things to log in without success... . I > rebooted the box again using Knoppix on CD to boot up... > > I then proceeded to hack my password file. I changed the password to blank > (as soon as I logged in, I changed it). > I then created the files that were missing.... these files were used by the > logger service to write to log files.. when I tried checking my logs... they > were all blank. > I was puzzled. > > I then booted up, logged in and started checking the server out... I quickly > noticed that MANY files had simply vanished.... > Apache that was running on this box was GONE! As was some of Webmin and > other stuff.... > > I suspected from the start that maybe this box had some unwelcomed > visitor.... > > This morning... I checked the logs again.... > > And there was some evidence. > > In my auth.log file... I saw a user (who previously didn't exist on the box) > log in from an external IP. (From Romania to be precise) > > A user was created on this box..... > > Anyways... this box doesn't have much on it.... a couple of small sites I'm > gonna move over and a few emails. > > So.. it seems this person hacked this box, disabled my logging services to > hide his trail and had fun deleting stuff... > > Now... my question: > Since I have this user's IP address how do I or can I report this? > > Anyone had an experience like this?? > > Thanks CFers.... > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| ColdFusion MX7 and Flex 2 Build sales & marketing dashboard RIAâs for your business. Upgrade now http://www.adobe.com/products/coldfusion/flex2 Archive: http://www.houseoffusion.com/groups/CF-Community/message.cfm/messageid:229407 Subscription: http://www.houseoffusion.com/groups/CF-Community/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.5
