hackers are busy tonight

[VioletLake]

I was the target of 4 simultaneous attacks tonight while reading on DU, one coming from a government agency.

[Avalux]

1. Really?

Please, don't forego the details. Simultaneous no less?

[VioletLake]

8. Yes

I can tell you that 2 came from California, 1 from Texas, and the other from D.C.

[HuskerDem]

2. COOL! I got hit twice yesterday but no feds.........

You must be very very naughty!

[lildreamer316]

3. Can I ask a stupid question?

My hubby is the internet genius; he's at work. How can I tell if I'm being hacked? Sorry for the ignorance;)

[ogradda]

9. ill sit with you and wait for the answer

i want to know too :)

[VioletLake]

11. when I had dialup

I didn't have to worry about it, but I switched to DSL which requires a firewall for protection.

[mcscajun]

38. ALL PCs should have Firewalls...

...not just those with broadband connections.

True, the bastards out there prefer the broadband connections (DSL, Cable) but they also hit the dialups while they're on.

ZoneAlarm is FREE to individuals while companies pay for it, it's top rated, powerful and has an easy user interface. You can pay for premium, too.

Norton Internet Security is not free, but includes Anti-Virus protection and other protection.

BlackICE is not free, less powerful than the two above, but has a very neat Paranoid function. :)

Your choice...but we'll all be safer out here on 'the Internets' (see BushCo)if everybody has a firewall, anti-virus protection, stuff like Spybot S&D, Ad-Aware, and maybe even PestPatrol...and y'all keep it UPDated! :)

[skylarmae]

4. how do you know - ? - I'm new at this..

Any helpful hints would be appreciated.

[Liberal Veteran]

7. Black Ice may tell you....

....but not if you are behind NAT.

[skylarmae]

5. dupe, sorry!

[Berserker]

13. Let me guess

You are using Norton right? And if you are it is doing it's job trying to scare you. If a Hacker wanted in your computer do you really think a off the shelf recource hog program like Norton would stop him? Norton is a joke all it does is scare the unknowing computer user into thinking he or she is getting attacked by sub 7 Trojan attacks. Now if you are stopping all those "Hacker" attacks then buying another years worth of fantastic protection from Norton is worth it right? NOT. There are several programs that are free and will do a better job and not drive you nuts with fake alerts.

[VioletLake]

15. Nice try

but no cigar. ;)

It's not Norton.

[Tandalayo_Scheisskopf]

6. Which gubmint agency?

Do you have IP addresses and a description of what you consider attacks?

[VioletLake]

10. I have IP addresses

and I traced the events. They were recorded by my firewall as blocked attempts to access the computer.

[VioletLake]

14. I'm not sure it's a good idea

for me to name the agency.

:scared:

[DBoon]

16. But can you name the firewall?

Is it ZoneAlarm? Sygate?

Or do you have a firewall applicance (instead of a software firewall)?

How were they trying to hack you? A port scan? Trying to login with telnet/ssh/etc.? Were they using some sort of exploit attempt? Trying passwords?

Are you sure it wasn't just a government computer infected with a worm?

[n2mark]

19. Could this be why my Mac is freezing frequently today?

[VioletLake]

20. McAfee

I don't know enough to answer your other questions. Here's a basic description for one of the events:

A computer at odci.odci.gov has attempted an unsolicited connection to TCP port 4734 on your computer.

[RPM]

24. what is ODCI???

anyone?

[VioletLake]

26. I think...

Office of the Director of Central Intelligence

[DBoon]

31. Hackers will spoof IP addresses

If I were a hacker, I would think it really cool to pretend I was from the CIA.

[VioletLake]

33. I know...

not making assumptions.

[FuzzySlippers]

36. Wow. You must be a really dangerous person.

CIA no less. I'm impressed!

[VioletLake]

37. Dangerous? lol

Perhaps Porter Goss has the hots for me.

[DBoon]

30. Hmm.

http://www.sys-security.com/html/papers/trojan_list.html has a list of trojan horse programs, as does http://www.commodon.com/threat/threat-allports.htm (which also includes lots of legit services). My first thought was some malicious program was trying to contact your computer. Port 4734 isn't listed in either place. And port 4734 isn't a common service someone would try to hack (say if it were 5631 I would say they are trying to find PCAnywhere).

I assume port 4734 is the port on YOUR computer they are trying to get to, not the port they are coming FROM.

[VioletLake]

32. Thanks for checking,

and thanks for the info. As I said, I'm new to the wonderful world of firewalls.

[snot]

18. I'm not sure I see why not name.

The hackers already know who they are. You're not libeling anyone; you're just reporting what your computer told you, without warranting that your computer is correct.

If anything bad actually happened, it would have been best from an evidentiary point of view and otherwise if you had immediately told your friends who your computer indicated the hackers were.

By the way, I hope my paranoia is completely unwarranted . . . but I suspect there are some Dems. in this forum (and elseshere) pulling together evidence and analysis who should be backing the info up, making copies, AND securing it with trustworthy third parties on a regular basis. Not only as a failsafe; but as a deterrent--if the Reps. know that's what we're doing, there's less temptation for them to try to eliminate stuff that's backed up elsewhere anyway.

[mvd]

12. I'm behind a router, so I miss the action

Still, I bought McAfee Internet Security (which includes a software firewall) to block unwanted outbound connections - and for extra insurance.

A couple days ago, McAfee's firewall blocked what looked like a Real Audio probe. But what probably happened is it just closed the connection before the router did.

[Deja Q]

17. Wow. Other DUers have reported this sort of thing... I'm

behind a router, but its log shows nothing of consequence. Just DU, a lot of DU advert links, and UT2004 servers as gaming is something of a hobby for me these days; some gamers are cool... not to mention better than me. :D

[Berserker]

22. So what is this program?

is it a secret?

[Deja Q]

23. The router, you mean?

It's the gateway to the internet but also allows me to hook up multiple computers. So it's really a gateway router. It's got built-in firewall capabilities too. Generally NAT that hides me from the internet...

Now I could buy an external router and pipe things through, but the consumer ones I'd seen are pointless. That's where software firewalls come in handy. SuSE Linux comes with its own...

[RPM]

21. could someone write a technical letter on how to protect from this

I was just smart enough to set up my linksys wireless access point router / am i protected?

Not that they want to read 3 years of lawschool outlines anyway....

[Berserker]

27. The IP addy's you find

when you look them up are useless. Do you think a hacker would use his real IP addy? Proxy's are used. Alot of people use proxy's to surf the web.

[lildreamer316]

25. Using AVG..

not a blip. How do I tell with this program? Hubby swears by it.

[Berserker]

28. AVG is

a very good Anti-Virus program and not a fire wall like Sygate.

[VioletLake]

29. Now that they know where I am

they have to decide whether to kill me or just bribe me.

;)

[Buddyblazon]

34. I use Ricochet...

city-wide wireless. I've never had any messages like that. Am I more...less...or protected the same? BTW, I use Norton.

[VioletLake]

35. I don't know...

Does your firewall keep a log of inbound events? I found out because I check the log a few times a day.