Forgot your password?
typodupeerror
Security The Internet

Getting Law Enforcement Action for a Large-Scale Hack? 721

Posted by Cliff
from the oh-my!-who-do-you-call dept.
HeelToe asks: "Two nights ago, I sat down to do a few chores with finance websites and check my mail. To check my mail, I use an ssh connection and read it via mutt. I had already hit Slashdot for my semi-hourly dose of content, but then noticed my ssh client complaining about a difference between its cached copy of the server key and the server key presented, so I started investigation. After figuring out what was going on, I contacted the tech support line for my service provider (Charter Communications) to no avail, as well as the FBI and NIPC, again, both to no avail. There are all these laws and all this hype about enforcing these computer crime laws - what must an end user do to get some enforcement done? Read on for more, much more..." Update: 06/21 19:13 GMT by C :As it turns out, the issue wasn't a hack at Charter but a particularly nasty form of Spyware. Stll, the question is valid, and some of the suggestions already given, have been real informative. Keep 'em coming!

"So I determined that I was connecting to xxx.p5115.tdko.com instead of xxx. I started looking at dns settings. Of course, under Windows, the default is to accept the default dns domain specified by a DHCP server for the PC's ethernet connection. There are settings to disable this, but I hadn't thought about it until now. It turns out, Charter Communications' DHCP servers were infiltrated and were providing p5115.tdko.com as the 'Connection-specific DNS suffix', causing all non-hardened Windows (whatever that means in a Windows context) machines to get lookups from a hijacked subdomain DNS server which simply responded to every query with a set of 3 addresses (66.220.17.45, 66.220.17.46, 66.220.17.47).

On these IPs were some phantom services. There were proxying web servers (presumably collecting cookies and username/password combos), as well as an ssh server where the perpetrators were most likely hoping people would simply say 'yes' to the key differences and enter in their username/password.

Has anyone else seen this type of attack before? Pretty sneaky. I bet it would slip by most people that don't use anything but a web browser. This makes me want to step up my plans to put an OpenBSD firewall in place and allow it as little trust of the outside world as possible, providing more trusted DNS/DHCP services to the hosts on my network. It would be nicer to be able to boot the thing self-contained-and-configured off read-only media and have no writable access to anything from the operating system to totally prevent break-in/tampering.

With respect to the law enforcement issues. I first called Charter, and after 10 minutes on hold was told to submit a report to their abuse account. I asked the tech support rep if they really wanted me submitting the incident report through a hijacked proxying web server. I hadn't yet reconfigured my Windows systems because I wanted to collect as much information as possible while the attack was still live. The long and short from the tech support rep was they'd look at it, but couldn't do anything with respect to responding to me about it unless I submitted that report.

I moved on to calling the FBI. The after hours person had no idea what evidence collection procedures I should follow, nor if their office would even be interested in investigation. I was told to call back during business hours. I did a little searching and found the National Infrastructure Protection Center. I gave them a ring and was asked to fill out an incident report. I was told it would be reviewed in the NOC quickly and a decision made about further investigation. The rep answering the phone said to collect any and all information I could think of regarding the attack. I got a response later this morning that their NOC personnel had evaluated the report and decided not to investigate further.

I called the FBI back this morning, only to be told they generally didn't investigate these types of crimes for individuals, but usually only for companies that had lost at least a couple thousand dollars. To inflate my ego a bit, I asked if I could count my time cleaning up/investigating as a loss of this magnitude and was told no, that it would have to be a financial loss like is associated with internet credit card fraud. Given how Kevin Mitnick was convicted and sentenced on 'evidence' that included employee time for investigation and cleanup, why is this any different for me?

With respect to getting some action on any future attacks - what should I do? Who should I call? I'm not a h/\x0r, and I have reasonable investigation skills, but aren't there professionals doing this to uphold the law? What's the point of all those federal laws anyway? Monitoring of third party communications, without the consent of either party; unauthorized access to Charter's systems - the list can go on a lot further depending on the activity happening at those proxying servers. Are these laws just tools to oppress unpopular computer criminals but just plain not enforced most of the time?

I found this situation and particular method of attack interesting... hopefully this was fun to read. If you have suggestions for what I should do in the future to handle attacks, I'd love to hear about it!"

This discussion has been archived. No new comments can be posted.

Getting Law Enforcement Action for a Large-Scale Hack?

Comments Filter:
  • by aridhol (112307) * <ka_lac@hotmail.com> on Friday June 20, 2003 @01:42PM (#6255515) Homepage Journal
    If you can't get the tech support to help, try escalating and turboing [macwhiz.com] the problem. Eventually, you'll talk to someone at the ISP who can or will do something. If not, it's time to get a new provider.

    It sucks that the law-enforcement agencies won't help private individuals; however, since it's a company that's being hacked, they should be able to put their resources on it.

    • by Otter (3800) on Friday June 20, 2003 @01:58PM (#6255715) Journal
      (Wow, 32 comments and no one has told him it's his fault for using Windows?!?)

      It sucks that the law-enforcement agencies won't help private individuals; however, since it's a company that's being hacked, they should be able to put their resources on it.

      The problem here seems to be this: the company has been hacked and it's the customer researching the problem and trying to get help. The FBI isn't particularly interested in hearing some guy talk about a compromise of someone else's server -- hopefully Charter is dealing with them and the agents shouldn't be keeping you informed of the status of an investigation to which you're basically a bystander.

      Sorry, HeelToe, you're being a good guy and did the best you could. Now, it's between you and the ISP.

      • by dszd0g (127522) on Friday June 20, 2003 @02:47PM (#6256283) Homepage
        But he isn't a bystander. The attacker is attempting to steal his passwords (and credit card numbers for those who don't notice and sending it unencrypted). I would consider myself under attack in such a situation.

        That said I am not surprised by Charter's response. I had @Home for almost two years with out technical issue (one double billing, which they resolved quickly), until they went under and I was switched to Charter's service. I spent over 40 hours on tech support with them trying to get them to finally find the missing entry in their database that was causing my service to be interrupted (I was down for 18 days). From my experience, I doubt one could find a more incompetent ISP.
      • it's all about cc: (Score:5, Insightful)

        by SolemnDragon (593956) <solemndragon@ g m a i l.com> on Friday June 20, 2003 @03:15PM (#6256603) Homepage Journal
        Write a letter.
        Send it to charter. List at the end the OTHER people to ewhom you are sending it, and you'll need to send them all snail mail, with the two (yes, two- one to the folks you spoke to, one addressed to the CEO, which will be read by a secretary and passed on to someone whose job it is to keep these things quiet) to Charter certified mail, return receipt requested. Those others will go to:

        Your US congressional reps- both houses, whether you voted for them or not; (i'm assuming you're in the US, if not go for the nearest equivalent of these)

        The Better Business Bureau;

        the state attorney general's office

        the FBI office that you contacted;

        The FCC;

        Anyone and Everyone whom you think might be interested, NOT counting the media. Why not? Because you want to be able to prove that you gave them a chance to correct the problem before you take it further. You are certainly allowed to suggest that it might be possible, but mention first that you need a written response from them telling what they plan to do about this (tell them what you want this to be), and mention that you will seek the assistance of a lawyer if this clear threat to you as their customer is not immediately remedied.

        Keep a copy of the letter. Offer to send supporting evidence AS SOON AS they have officially begun their remedial actions and you have received initial results. (or you may wish to send it sooner, at least the info that you feel comfortable having random secretaries seeing.)

        IANAL, but I have good reason to recommend this method. Incidentally, it works for a LOT of customer issues, and you have to be sure to send out copies of follow-up letters to the same set of people. Make sure to document hours spent working on it, and all the people whom you've spoken with and when. Media is for after their failure to remedy the matter after 1 letter, just add it to the CC list. You might try writing the second letters as two- one to the company, one to the attorney general or congressional folks, and the other to the company, and include copies of both in the envelope to the company. Their failure to help is against entirely different laws. Use the words "acted in bad faith."

        be persistent. It helps.

      • by TheCarp (96830) *
        Hmmm seeing your comment I am inspired...

        Play hardball... if the ISP is refusing to admit that their machines are hacked, then they must be doing this on purpose.

        I would report to the FBI that the ISP is redirecting all traffic and running man in the middle attacks on you and their other customers and you have discovered it...

        If it works, then that at least gets the ball rolling on the investigation and when they find out that the ISP is a hapless victem, then they will have the full attention of the ISP
    • by tigris (192178) on Friday June 20, 2003 @02:10PM (#6255869)
      I'm truly amazed that Charter and the FBI blew you off like this.

      You've already tried going through channels so the next step is embarrassing them into doing something about it - notifying news media outlets and posting to slashdot are probably all you can do though. If Charter has any specific usenet groups like @Home used to have, I'd post this info there as well.

      Best thing would be to get this on TV as then they can't ignore it. Charter is based in St. Louis and I'm sure one of the consumer affairs reporters at one of the TV stations in town would be interested in finding out that the major ISP in town is letting their users' passwords and other info get leeched.

      • Don't be amazed.
        It's just the way they work; unless its internally generated, whether a charter, the FBI, or any other investigatory agency, they just don't want to see it; they have already got a job, things to do, and they don't want you adding to the load.
        If you REALLY PUSH, they will usually put you in contact with someone who at least has a clue what you are talking about, but the first thing THEY will do, if you are a private individual, is see if you are the criminal; you are guilty until proven innocent, if you actually get them to take you seriously.
        They also will have no interest whatsoever in any evidence you have gathered; they know that it won't be investigated for most likely months, so there is really no point to it.
        If you encounter any behavior other than this, you should really keep it to yourself; otherwise the competent individual you encountered will most likely get fired.
        I know of what I speak; I ran into some blatantly immoral(important) non-legal(not so important) activity in the past and determined to get it taken care of no matter what the cost in time or effort.
        and the costs were very high.
      • by mitheral (10588) on Friday June 20, 2003 @02:44PM (#6256248)
        I'm sure one of the consumer affairs reporters at one of the TV stations in town would be interested in finding out that the major ISP in town is letting their users' passwords and other info get leeched.

        They probably wouldn't touch the story. DNS is too technical, heck I'd have to explain this story to some of the support people I've worked with and then a few of them still wouldn't get it. Joe six pack doesn't have a chance, especially since they'd have to achive understanding in the few minutes the medium allows.
      • Here are the local TV stations for St Louis. It probably a big "who cares?" to them. They seem to like stories about lost puppies and sick kittens more than real news.

        http://www.ksdk.com (NBC #1 in ratings)
        http://www.kmov.com (CBS #2 in ratings)
        http://www.fox2ktvi.com (Fox #3 in ratings, good investigative reporters)
        (ABC affiliate gave up on local news)

        Tack on Charters accounting scandals for more ammo.
      • by InfoVore (98438) on Friday June 20, 2003 @04:30PM (#6257371) Homepage
        I'm truly amazed that Charter and the FBI blew you off like this.

        Don't be. Serious threats get blown-off all the time by law enforcement and business. Sad, but true

        You need to read Clifford Stoll's The Cuckoo's Egg [amazon.com]. It is an amazing account of how he helped track down the Hanover Hacker (a paid Soviet spy).

        The FBI blew him off too, at first. He discovered a hacker was moving through the UC Berkley computer systems at will and using it to crack other systems. He discovered this when he was investigating a 75 cent discrepancy in the departmental billing for computer time. The FBI told him: "don't call us unless it is at least $1 million in damages". Eventually he convinced one agent of the seriousness of the problem (HH was using Berkley and other systems to try to crack DoD systems). Over the course of 3 years, Stoll was instrumental in helping the FBI/CIA and others crack one of the biggest international computer spy rings ever. Stoll was a grad student in astronomy at the time. Great book. Oh and he threw in a really good chocolate chip cookie recipe too.

        Get the book, you won't regret it.

        I.V.

    • by Anonymous Coward on Friday June 20, 2003 @02:28PM (#6256080)

      This "turbo" link gives advice better than most, but it's still not right. I have read so many times on slashdot posters' advice to work your way up the chain of command in a corporation. That is inefficient and won't get you results.

      The turbo article says, "phone the CEO's office". That's better, but a phone call is too easy to blow off and it easily gets lost in the shuffle.

      From experience within corporations at the highest levels, here is what works best. When you get blown off by lower level tech support, immediately write a letter to the highest people in the corporate food chain, its Board members or CEO. What typically happens is the letter will be passed down the line to the High Level Person who can handle it (some VP, for example) with instructions scrawled on the letter using a pen by the CEO which says something like, "Look into this, handle it, and let me know what happened."

      This is real life, people. Now you've got VPs at the highest level running around trying to solve your problem, who are required to report back quickly to a quixotic boss who has the power to fire them. This process is a model of efficiency - you quickly wrote a letter; the CEO very quickly scanned it, acknowledged the problem and quickly prescribed that a solution be found - and now the engines of the corporation are at work scrambling to solve your problem.

      Doing it in writing makes it easier for the CEO to pass the responsibility on quickly. All he has to do is take a few seconds to read your letter, and a few seconds to delegate the solving of your problem. He doesn't even have to try to re-articulate what your problem is through phone calls and garbled telephone tag -- you've done this for him already.

      So, this turbo approach gets it only half right. Yes, they're right - working your way up the ladder doesn't work, only down the ladder works. But, you've got to do it in writing, and quickly. That's the way to get fast results.

      • How to make noise (Score:5, Insightful)

        by fm6 (162816) on Friday June 20, 2003 @03:20PM (#6256666) Homepage Journal
        Doing it in writing makes it easier for the CEO to pass the responsibility on quickly. All he has to do is take a few seconds to read your letter, and a few seconds to delegate the solving of your problem. He doesn't even have to try to re-articulate what your problem is through phone calls and garbled telephone tag -- you've done this for him already.
        This is absolutely correct. I've done this a couple times myself. I have no idea whether the CEO him/herself actually read my letter. Probably not. But both times I got back letters from high-ranking company officials. And not boilerplate noise, either -- carefully written letters that directly addressed the issues I raised.

        The problem with "working up the ladder" is that you're dealing with folks who are just cogs in the machine. Either they're hemmed in by procedures, or they afraid to stick they necks out. Probably both.

        Of course, it's still likely that whoever you get in contact with will just blow you off. That's especially true if the company has legal exposure. (As an ISP in this situation certainly would!) But at least you'll know that people with actual decision-making powers are aware of the problem.

  • by ites (600337) on Friday June 20, 2003 @01:45PM (#6255545) Journal
    Which will do two things:

    1. you will get realtime help. OK, there are better ways but this is a _big_ audience you have here.

    2. post a link to the offending server, and the /. effect will wipe it out.

  • Money == attention (Score:5, Insightful)

    by Whammy666 (589169) on Friday June 20, 2003 @01:46PM (#6255550) Homepage
    It has been my experience that unless there is some large monetary losses involved, then you're going to have a hard time getting law enforcement to do much of anything. Generally, for simple break-ins, they expect you to handle it yourself (typically contacting the ISP of the hacker).
  • by Glyndwr (217857) on Friday June 20, 2003 @01:47PM (#6255563) Homepage Journal
    I bet an attack of this nature turns up an absolute shedload of valuable, confidential information, and I bet there are plenty of pissant ISPs in the world with poorly configured DNS servers too. How often has this kind of attack been found? I'm suddenly real glad I run my own DNS server behind my firewall.

    "No financial losses" my ass. Lets see what Visa's customers have to say about that when the logins for half a million credit card e-banking systems get compromised. Hmm, almost makes me wish I could detect a similar attack so we could see what the UK police would do. "Intarweb, sir? Nah, not on our patch, you seee...."
  • by Master Bait (115103) on Friday June 20, 2003 @01:47PM (#6255572) Homepage Journal
    ...called the FBI back this morning, only to be told they generally didn't investigate these types of crimes for individuals, but usually only for companies that had lost at least a couple thousand dollars.

    I really don't know what to say, except what I put in the subject line. The subject was lifted from the famous line in Blade Runner, "If you're not cop, you're little people." These days, money incurrs rights and protection granted by the government. Odd how things have turned out, eh?

    • by realdpk (116490) on Friday June 20, 2003 @01:53PM (#6255648) Homepage Journal
      Well, sure, but it's not like the FBI has unlimited resources either. I don't think it's necessarily right to expect them to investigate every little SSH key popup you get, or SSL cert change, etc.

      If someone really did hijack Comcast's DNS servers, Comcast ought to be the ones calling, in any case. If you're worried that someone else's DNS servers will be compromised, host your own locally.
    • by bourne (539955) on Friday June 20, 2003 @02:44PM (#6256254)

      I really don't know what to say, except what I put in the subject line.

      You're overreaching a bit.

      The end-user isn't an official representative of the victim. Obviously, law enforcement isn't going to deal with him. Firstly, for (the feds) to get involved, they need at least $5000 damage, which he couldn't speak to. They're not going to waste their time unless there is a willingness to prosecute, which - guess what - also requires an offical representative to commit to. Finally, if they do get involved, their next step is to ask for logs and other evidence - which, at best, the end-user only has symptoms of. Again, they need to deal with the duly authorized representative of the ISP to get anywhere.

      From the sound of it, they actually went out of their way to try and help him reach the minimums to be considered a valid case himself. That's actually pretty amazing by itself.

    • In general the reason being: it's not a federal issue until it hits >$5,000 in damages. Until then you are supposed to deal with your local organizations (there is a reason for your local government, you know. Does one go directly to the CEA to get more toiletpaper in the batchroom?).

      In this case specifically a resonable analogy would be, a technically competent end-user in a corporate environment doesn't contact the FBI their IT dept does. The user here doesn't have control over the DHCP/DNS servers, doesn't manage them in anyway. What do you expect from a federal organization in this situation... 20 feds flown down to look at an end-users system that hadn't receive any monetary losses yet?

      A more defined notification authority would be nice, but you can't expect every single end user to call the FBI. As an end-user contact you local officials you are paying taxes for them, if you are the owners of the compromised systems and you incurred financial loss then you can bump it up to a federal level (remember local/state organizations can sometimes even provide better service than the FBI, and then there are some that are stupid)
  • Who did you talk to? (Score:3, Informative)

    by arcsine (541576) on Friday June 20, 2003 @01:48PM (#6255578)
    I'm not sure if you came off the right way. You may have wanted to ask to talk to a manager at an ISP and explain to them that it wasn't *your* problem, but *their* problem.

    Most of the tech support people are used to handling stupid people with simple problems, and probably didn't believe, or realize how bad the actual problem was.
  • Domain suffix fun.. (Score:5, Interesting)

    by wfberg (24378) on Friday June 20, 2003 @01:49PM (#6255588)
    The domain suffix on windows is fun. It uses the domain name in your hostname as a domain suffix to search as well. One day, I'd set up my windows box as mybox.mydomain.com. Then my ISPs DNS servers stopped working. So when I went to cnn.com, it went to cnn.com.mydomain.com - and I got my very own homepage, even though the address bar in the browser said cnn.com (since *.mydomain.com resolves to mydomain's webserver's IP address..)

    I also have my webserver set up so that if you surf to a hostname that doesn't exist, it serves up the google I'm Feeling Lucky page for the hostname.. "Collecting ancient art? Why, I happen to have a website on that, just go to collecting.ancient.art.mydomain.com."
    • The address doesn't work.

      I just get a bunch of stuff about buying domains.
    • by akeru (15942)
      ahh yes, DNS domains . . .
      well, it's not just Windows that does that it is, in fact, part of address resolution that the first thing that gets checked is .. and then . You can get around it by manually adding the '.' to the end of the domain. Try http://www.cnn.com./ and watch it go to the correct place. (Assuming cnn.com. doesn't redirect you to to cnn.com, which would be looked up according to the usual rules)
  • by Anonymous Coward on Friday June 20, 2003 @01:49PM (#6255591)
    You called Chater tech support?

    It's a wonder they didn't tell you to reboot your modem, reboot your PC and verify that the network card is listed in Device Manager.

    That's about all I've ever gotten out of them.
  • by TopShelf (92521) on Friday June 20, 2003 @01:49PM (#6255593) Homepage Journal
    To inflate my ego a bit, I asked if I could count my time cleaning up/investigating as a loss of this magnitude and was told no, that it would have to be a financial loss like is associated with internet credit card fraud. Given how Kevin Mitnick was convicted and sentenced on 'evidence' that included employee time for investigation and cleanup, why is this any different for me?

    So many reasons, it's hard to count! But here's a couple for starters:

    1) Your Mitnick example was how evidence was used in court to determine guilt and sentencing. That is a different animal than investigatory guidelines as to which cases should be pursued.
    2) The Mitnick thing was years ago, and activity is so much higher now that they might have set the bar higher in terms of what cases to pursue.
  • by OwnerOfWhinyCat (654476) * on Friday June 20, 2003 @01:50PM (#6255613)
    Every admin who has been reflexively typing 'yes' to the

    The RSA host key for yoursite.com has changed, use new key?

    prompt is now shuddering to think how many passwords s/he might have handed the "Man in the Middle."

    Good Job.
    • Of course, that only affects those who use passwords for SSH. I generally prefer RSA user authentication. One of the reasons is laziness - I only have to enter my key's password once, and it authenticates to SSH servers for me. And, of course, there's security. Because I don't enter my password over the wire, there's no way for it to be intercepted.
      • Because I don't enter my password over the wire, there's no way for it to be intercepted.

        What you say is technically true, but ssh1 users are still vulnerable to man in the middle attacks even if RSA user authentication is used.

        The attack relies on an incredibly non-obvious flaw in the ssh1 protocol which was fixed in the ssh2 protocol. While an attacker cannot get your passwords using this attack, he can interpose between the client and server and intercept all traffic for that session. The error mes

      • Of course, that only affects those who use passwords for SSH.

        No, a successful man-in-the-middle attack will affect anyone using SSH, whether they use passwords, RSA keys, or anything else.

        Because I don't enter my password over the wire, there's no way for it to be intercepted.

        Not your login password, no. But anything else you enter or view can be. Su to root? Now they know your root password. Read your mail? They did too.

  • by c0d3h4x0r (604141) on Friday June 20, 2003 @01:50PM (#6255616) Homepage Journal
    Lookup the IP registrations, find the owners' locale, and then contact that local police department. Tell them a federal crime (felony) is being perpetrated on a grand scale, and that you need to speak with someone with extensive computer/internet/technical knowledge to report all the details.
  • F*ck the police (Score:5, Insightful)

    by LS (57954) on Friday June 20, 2003 @01:50PM (#6255617) Homepage
    The computer police too. I've been mugged, robbed, and assulted multiple times in my life, and the police were never interested in helping. My car was just broken into, and I had $4000 in computer equipment stolen out of it. I called to file a report and have them come down and dust for prints, and they said that they can't send anyone down.

    Of course, I've been stopped and harrassed by cops on a number of occasions. My brother gave me a small cut in a fight that required stitches, and they investigated my parents for child abuse. I've been accused of possessing marijuana for having a tomato stem in the cup holder of my car. I have to drive through a police checkpoint every day on the way back from work on highway 15 in San Diego. After I hit a spare tire that flew off the back of a car in front of me, the police officer wanted to write me a ticket because he was upset that he had to drive out a take a report.

    I'm a law abiding citizen without a mark on my record, and I can still say: fuck the police

    LS
    • Re:F*ck the police (Score:5, Insightful)

      by Dr_LHA (30754) on Friday June 20, 2003 @02:14PM (#6255908) Homepage
      Agreed entirely. You're story is one I've heard a thousand times, and one I've experienced myself. I was once when I was 16 years old knocked of my bicycle by a guy in van. The police got involved as I was pretty seriously injured (an almost ran over by a bus as part of the incident). Turns out the guy has no driving license, insurance and has not paid his car tax. He shouldn't have been driving the van in the first place.

      I was told in no uncertain terms that the guy would not be procescuted in any way.

      Just like you I've also been hassled by te police on many occasions for no good reason, been forced to show ID for such crimes as "walking home after 3am" etc. I know that police have a hard job to do, but really they need to remember that their motto is "To Protect and Serve" not "To Hassle and Intimidate".
      • Re:F*ck the police (Score:3, Informative)

        by borgasm (547139)
        You know, you don't need to present your ID to a police officer...They can't even prevent you from walking away from them if you aren't being charged with a crime...

        Read up on some ACLU stuff [aclu.org]...their site is pretty interesting. I think they have a little card you can carry in your wallet which lists your Civil Rights. I find it very informative.
    • by The Tyro (247333) on Friday June 20, 2003 @03:33PM (#6256811)
      Folks, this isn't flamebait, it's the truth. Moderators, do your worst.

      I love all the "I hate the X&!#@ Cops!!" trolls that inhabit this place; youthful rage directed at "the man"... with no concept of what it would be like to live without them.

      Here's my challenge to all those who hate the police so much: If you think you can do their job so much better than they can, go help them out. I'm serious... this is a put-up-or-shut-up challenge. I want you to spend some time in the belly of the beast.

      When I was a teen, I didn't like cops... but a funny thing happened to me on the way to my current job, I became a police officer, and it's got to be one of the nastiest jobs in the world. As a doc, I deal with drunks/pimps/bangers/dealers all the time, but thankfully they are usually cuffed and/or exhausted by the time they get to me (and some of them STILL fight... ER workers get assaulted all the time by these types. Fortuntately, the pharmacy is mighter than the sword). I deal with them, but I have a full contigent of burly guys +/- drugs to help me out... taking them on mano-a-mano on the street is a very different scenario. I take care of the bad people, but I also take care of the cops that get hurt fighting them. BE THANKFUL cops are out there... you don't even want to know the kind of sociopaths cops deal with everyday, for pretty low pay. You want to live in a world without cops? Go ahead, but be prepared to do your own dirty work. Think you've got what it takes? You'd better be right, because you're betting you life and the lives of your family on it.

      Yes, I can hear the "boo hoo! poor cop! go eat more donuts!" trolls now... save it. You trolls can scoff all you want. Feel free to live in your "no cops" world... sounds great on the surface... but getting your ass kicked by some gangbangers when you're walking home from the LAN party some night might change your tune.

      If you've got a beef with the "racist, motherf*cking police" and want to change things, then quit complaining and start working. Learn something about the police... volunteer some of your time (it's called community service; look into it). Go to a reserve police academy and get sworn, do some ride-alongs, or donate some of your 3l337 technical skills to their investigative unit (maybe they need computer forensics help).

      Try to make things better instead of indulging in typical slashdot cop-bashing... in addition to the satisfaction of helping out your community, you might be surprised by what you learn.

      What have you got to lose? Do it.
      • by Bob Uhl (30977) <{eadmund42} {at} {gmail.com}> on Friday June 20, 2003 @04:21PM (#6257301) Homepage
        I love the idiot `support the boys in blue' knee-jerk trolls which inhabit just about every place: submissive folly which refuses to recognise the very real problems in the system.

        Not a bit of your post addresses the original issues: ineffective law enforcement. The OP never said that there should not be police, IIRC: rather, he gave instances where they didn't serve a useful function, either by commission or omission.

        Certainly, law enforcement is by its nature an unpleasant profession. Certainly, there is a need for law enforcement. The original poster, methinks, would agree. If the cops stopped wasting their time on foolishness (e.g. drug, alcohol, weapons and traffic enforcement) and instead focused on real problems (e.g. rape, murder, theft and fraud), I don't believe people would particularly hate them. It's when the police are the willing enforcer-thugs of an authoritarian state that we lose our respect for them--and quite rightly so.

        As for your suggestion to volunteer: I refuse to supply my labour in order to free up time for a cop to issue a single other drug or speeding citation. I refuse to supply my labour in order to free up time for a liquor-law sting operation. I refuse to subsidise injustice.

  • by Jon Abbott (723) on Friday June 20, 2003 @01:51PM (#6255621) Homepage
    The book Cuckoo's Egg [amazon.com] by Cliff Stoll deals with this issue specifically... Someone kept hacking the author's computers at Lawrence Berkeley National Labs (coincidentally, that makes twice [slashdot.org] in two days that I've mentioned a National Lab on slashdot), and he has to convince the authorities that it is truly worthy of investigation... The FBI points him to the CIA, the CIA points him to the FBI, so a lot of the story deals with the social engineering required to get the authorities to actually listen. It's really a great read, and you can find used copies on Amazon for a penny.
  • What can you do? (Score:3, Insightful)

    by EZmagz (538905) on Friday June 20, 2003 @01:51PM (#6255622) Homepage
    There are all these laws and all this hype about enforcing these computer crime laws - what must an end user do to get some enforcement done?

    Honestly, unless you're a big corporation (or at least a company with some legal weight), there isn't much you can do. Sounds like you persued some of the right avenues to go through, but from what I've seen, read, and heard, individual civilian complaints don't bring a lot of action. If you were the FBI and had very limited staff resources, and you were presented with the task of either:

    helping a sole individual who had his box cracked, or

    a company like eBay, who hypothetically just had their credit card db broken into and copied,

    which would you go for?

    Maybe I just have a pessimestic attitude towards our beautiful US government. It seems that the average joe doesn't have a lot of recourse againt stuff like this though. Hopefully our fellow /.'ers will provide stores proving me wrong. That might instill a bit of faith in my weary bones.

  • by huckamania (533052) on Friday June 20, 2003 @01:51PM (#6255626) Journal
    They are there to protect businesses and the government itself.

    This is a disturbing trend in the United States of Lawyers and short of a revolution there is not much that can be done to reverse it. Just look at the article from yesterday where Oral Hatch wants to exclude copyright owners from anti-hacking laws so they can destroy a personal computer. It's sad and scary.

    What the USL needs is a new Bill of Rights that protects people from corporations.
  • The Irony.... (Score:5, Insightful)

    by Picass0 (147474) on Friday June 20, 2003 @01:51PM (#6255628) Homepage Journal
    .... what is funny here is how the Fed spends soooo much energy collecting powers over the internet that it has no idea how to use.

    I think sometimes that the internet might be too big for them in it's present form. Better to break it and build something new! Something where Disney can get a signoff.
  • RISKS (Score:5, Informative)

    by kzinti (9651) on Friday June 20, 2003 @01:52PM (#6255634) Homepage Journal
    I can't help you with getting the attention of law enforcement or the service provider, but when all is said and done, I bet Peter Neuman at the ACM RISKS Digest [ncl.ac.uk] would love to publish your story. The RISKS readers would be interested in the original hijacking, and just as interested in the lackadaisical response by those who could do something about it. The risks posed by both problems are the forum's reason for being.
  • by Nemus (639101) <astarchman@hotmail.com> on Friday June 20, 2003 @01:53PM (#6255649) Journal
    Apprently this problem is protected by a SEP shield(Somebody Else's Problem). Simply put, it doesn;t affect these people directly, so they could give a wingnut less.

    As much pomp and posturing as some of these organizations do, in my experience, the FBI guy you talked to was right: unless its a big company that has the cash to sue the government for not enforcing the laws, or at least raise a stink about it, these organizations will do nothing.

    The reason for this, as I see it, is that most of the legal side of this stuff is handled at a federal level. So if only say, 100 people or so are affected, they're simply not going to waste their time on it. The only solution I could see to this problem is that, once the general populace becomes better educated to whats out there and what all this "fancy internet stuff" means, there is the possibility that smaller, more municipal "cyber crime" organizations may spring up, to deal with complaints coming from people in their municipality. Until then, its a jungle out there, and its every man for himself.

  • This is standard (Score:5, Informative)

    by alienw (585907) <alienw DOT slashdot AT gmail DOT com> on Friday June 20, 2003 @01:53PM (#6255652)
    This is a very standard type of attack and a standard FBI response. FBI damage trigger is $5,000 IIRC. If the ISP calls the FBI, they can get the ball rolling. You can't, and frankly it's none of your business since it's the ISP server that got hacked. I wouldn't do anything beyond calling the ISP. You can't claim financial losses, because you didn't lose any money directly as a result of this hack.
  • by Alan (347) <arcterexNO@SPAMufies.org> on Friday June 20, 2003 @01:54PM (#6255664) Homepage
    I say this only partially in jest, but maybe try contacting the dept of homeland defense, or GWB himself or something. Call it terrorism, they'll be shut down faster than you can say "foo".

    Seriously though, with the increase in the gov't involvment and crackdown on cyber terrorism (or they say there is) isn't this a prime candidate?

    That said, it's scary that the ISP doesn't seem to give a fark about this. If I was in charge of their security I'd be fixing this as quickly as possible, not letting my company's customers continue to use a compromised service. Wouldn't it be considered negligence to allow your customers to continue using a server you know to be compromised (ie: not changing the DHCP server back, or simply shutting down all access)? Personally I'd much rather loose my net access for a bit while this is cleaned up than my ISP knowingly let me proxy through sniffers and password grabbers.....
  • by Hollinger (16202) <michael@@@hollinger...net> on Friday June 20, 2003 @01:55PM (#6255673) Homepage Journal
    Go to http://www1.ifccfbi.gov/index.asp and file a complaint. They'll follow up.
  • by astrashe (7452) * on Friday June 20, 2003 @01:57PM (#6255705) Journal
    When I ran a small ISP, our experience was the same. The law enforcement people didn't do anything for us.

    It was strange, because the FBI had actually sent a couple of agents to our office to introduce themselves, pass out business cards, and the like. But when we had trouble, we called them up and those guys basically said, "there's not much we can do."

    When the agents introduced themselves, they gave us a questionaire to fill out, and there was a question about encryption -- had we noticed anyone using it?

    The questionaire (which I didn't complete), and the lack of response when we actually needed help, sort of soured me on the beaureau. The agents were nice guys, and I had the feeling that they were sincere when they were talking to us, but the organization itself didn't seem to be too helpful.

    I don't really have a problem with them paying more attention to hacks on major e-commerce sites or banks than on my little ISP (which has long since been sold). The reality is that there's so much cracking going on, and it's so hard to track it down, that chasing small incidents isn't really practical. If a big ecommerce site gets cracked, a lot of people get hurt, the situation is really different.

    The lesson that I learned is that you're basically alone when you get attacked. No one cares, and no one will help. Your ISP won't do anything, law enforcement won't do anything, and your customers will be incredibly angry with you. The only way to deal with it is to do whatever you can to secure yourself up front.

  • what to do: (Score:5, Interesting)

    I can see a couple of things here:
    First of all, file the report. Ask the support person if you can fax in the report because you don't want to inform the hacker that (s)he's been spotted and you are reasonably clear that you can't get a secure channel to their web server.

    If they absolutely insist that you go through their web pages, then do so. Give enough information to prove that you understand what's going on, and inform the person on their support line that you'll b expecting someone to call you with a phone number that you can call them back at.

    (This is to prevent impersonation. I'd actually check the number to make sure that it belongs to the company in question) -- remember, the hacker may be seing your on-line communications.

    Basically, the cops are right... about the only people who can force a real police investigation are at the ISP in question. If they can show that a couple hundred (or thousand) people have been affected by this hack then the cops may get involved.

    If you want to be snarky, then you can ask the name of a good local journalist that you can tell your story to.. That might also light a fire somewhere. If nothing else, people in your community need to know that their communications are being logged by someone with clearly malicious intent. Be prepared to spend some time explaining things to the reporter. Someone with the stature to get furr flying is also unlikely to have serious technical computer knowledge. Be ready with a lead-in line to get his attention fast, like:

    I've got an interesting story for you.. It appears that <X ISP's> servers have been badly hacked, and some malicious entity is now snooping on the communications of all their customers. Passwords, credit card numbers and other personal information are all at risk. I've tried contacting the ISP, the FBI and a couple of other entities with no satisfiction. Are
    you interested?
    • Re:what to do: (Score:3, Insightful)

      BTW: I wouldn't be too hard on your ISP on this. They really do need to get this data into their system so that they can deal with it reasonably. Although a verbal report can give them a bit of a heads-up, a written report will give them a better idea of what they're facing and provide less risk of data-loss/corruption as a verbal report goes from person to person (have you ever played the whisper game?). Given the work you've done so far, I'd say it's worthwhile to do a little bit of bending over backward
  • lop.com (Score:5, Insightful)

    by athakur999 (44340) on Friday June 20, 2003 @02:03PM (#6255781) Journal
    Have you tried running Spybot or Adaware lately? If you try going to p5115.tdko.com, you'll find it's a website for lop.com. Which, incidentally, is an infamous purveyer of spyware:

    http://www.spywareinfo.com/articles/lop/

    • Re:lop.com (Score:3, Informative)

      by st0rmshad0w (412661)
      Definately. I don't think this was a man-in-the-middle maneuver (tho I admit I may be very wrong). LOP.com crap has turned up at my workplace repeatedly, usually 1 or 2 calls a week about "pop-up-porn", and they all get traced back to LOP. Their adware now has some tactic to hijack DNS settings I would imagine. Lovely. Can't someone send them an .mp3 so we can get Hatch to nuke them?
  • by JWSmythe (446288) * <jwsmytheNO@SPAMjwsmythe.com> on Friday June 20, 2003 @02:06PM (#6255809) Homepage Journal
    Our biggest problem isn't breakins, it's posting web site passwords on the net.. Hey, it's still someone using an illegal means to access materials (yada, yada, yada).

    We do our own defenses, but I always see the users or proxies attempting crap.. I tried calling a few providers, but they're completely dense when you say "someone on your network is attacking one of my servers." Somehow they manage to get the stupidest people handling their support desk, who can't even comprehend what a server is. If you do manage to get to an abuse department, they'll rarely do much.

    A few years ago, I got tired of fucking with the help-desk people to complain to, so I called the FBI. They took my information, and had an agent call me back.. It took a couple weeks to get the return call, but I did. He was actually well informed, and seemed to know at least the basics of how the Internet worked. He also said that I'd have to prove a monetary loss. The mininum amount was $5,000, if I recall correctly. It isn't enough that someone can abuse the shit out of your system, you have to prove that you were loosing money in the process.. So I have to make the decision, do I set up the system poorly enough so we do loose sales/members over fairly simple attacks, or do I just forget trying to get anyone to help.

    Recently, a friend of mine rewrote a site for selling calling cards on the net.. The company is an established real-world business, they just wanted to expand... So, she spent a few months putting together a kick-ass site, with all the bells and whistles that the owner asked for.. About a month after it went live, someone started hitting it with fraudlent transactions. Even with all her normal precautions (and a few of mine), and using a 3rd party billing company with their own precautions, they still got hammered for about $10,000 worth of fraud.. The FBI was willing to take a report on this one, but never investigated, and never did anything about it.. She (the programmer) had got the IP's of the users, found out who owned the blocks. We actually knew where they physically were and told the FBI. If they were interested, they'd only need to send one agent where we told them, and close the case. They didn't. It's still an open case with no leads. {sigh}

    There were IP's in two different /24's doing the fraud.. They were coming back about once per day and doing the same scam. Each one was a Internet cafe thing, so fairly obviously it's someone sitting on a public machine trying not to get caught. But, they were both at least 1000 miles from where we were, so it was pretty useless for us to catch them. It would have just been so easy for the FBI to send one agent out. $10,000 fraud on one site is nothing. I'd be more than willing to bet that they were hammering a whole bunch of sites with those same transactions.

    We called the cafe owners and told them what was happening. Their suggestion was to call the police, they weren't going to stop anything. {sigh}

    Knowing how bad they are to stop things, I wonder if I'm doing the wrong thing, staying on the legitimate side of things. If we can literally say "They guy sitting in this cafe is running tens of thousands of dollars in fraudelent transactions per day, and stole from us" with proof, and they won't touch it, how much evidence do they really need against someone to do something?

    Ya, we see the big "some hacker caught" stories occasionally, but honestly with all the crime going on (yes, there's lots), it's only rarely that you hear about someone getting caught.

  • by Anonymous Coward on Friday June 20, 2003 @02:11PM (#6255877)
    % whois 66.220.17.46
    Hurricane Electric HURRICANE-3 (NET-66-220-0-0-1)
    66.220.0.0 - 66.220.31.255
    C2 Media Ltd HURRICANE-CE1076-331 (NET-66-220-17-0-1)
    66.220.17.0 - 66.220.17.255

    This is the infamous lop.com customized ad/spyware, see lop.com and wrn.net. The thing with the domain suffix is a trick with 127.0.0.1. This type of software typically installs a search toolbar in IE and they seem to come in a multitude of different versions. It's the worst of breed.

    C2 Media claims that people click through an EULA and know what they're installing. I know all this because my Dad had a "weird extra toolbar and popups to go online gambling". He found the running binairy, I looked through a hexdump of it and there was their EULA alright. But he never saw it. This critterware can even get installed by merely mousing over a banner.

    Don't believe me? Google for "lop.com, adware, toolbar"...
  • my ISP is Charter... (Score:3, Informative)

    by Vaughn Anderson (581869) on Friday June 20, 2003 @02:12PM (#6255890)
    Now what? How do I know when I am at risk? What does the normal schmo do in a situtation like this?

    Should I stop accessing any financial websites that I use?

    This is the one thing that's always made me paranoid, so what if I have a firewall, if my ISP is hijacked, then what do you do? It's not like I have options out here, Charter is it, unless I want to bend over for Sprint's DSL (which they charge you tons of cash to cancel your account among other nefarious things...) or satelite (ugh)

    • by JohnA (131062)
      If you are using a relatively standards-based browser [mozilla.org], and connecting to HTTPS servers, you are fine.

      SSL protects against man-in-the-middle attacks through the utilization of certificate authorities. If someone intercepts your connection, they must present your browser a signed certificate. If they present the one the original site uses, they must have the corresponding private key, which is near impossible. If they present a different certificate, your browser will pop-up a warning dialog informing you
  • by prgrmr (568806) on Friday June 20, 2003 @02:14PM (#6255909) Journal
    With respect to getting some action on any future attacks - what should I do? Who should I call?

    Write your state's attorney general. Include all the information you collected, a more detailed explanation of what you posted here of the incident. Let them know you've contacted the FBI but I would lead them to any conclusions about where that is going. Request that their office look into this from both a pespective on the potential harm from the hack, and the responsibilities of your ISP to respond to, and ultimately, prevent this sort of thing.

    Then, write each of your senators and your congress person. Before you do that, find out which committees they sit on and see how you can tie this in to their oversight responsibilities with regard to the various goverment offices that could be dealing with this. Point to anti-hacking legislation like the Patriot Act and anything anyone suggests, and then point out how the laws are not uniformly enforced. Point out that potential harm and not sheer magnitude of dollars expended ought to be a desiding criteria for launching an investigation, or not.

    If you haven't already, fill out an incident report for your ISP to cover yourself. Those IP addresses belong to someone, and they have a responsibility in this. Whether direct, or indirect, remains to be seen.

    Finally, contact your lawyer. If for no other reason, you will need some legal CYA in your back pocket as insurance, given the stir you've already started by contacted those people that you have. Not that you should have to worry about liability issues, but you never now.

    HTH, good luck with it.
  • Simple.... (Score:3, Funny)

    by PortHaven (242123) on Friday June 20, 2003 @02:15PM (#6255919) Homepage
    If you can't beat em, join'em!

    First off, do the terrifying...submit to CNN.com or ZDNEWS....

    "Entire Charter One Internet Communications Divisions Security Jeopardized....what data was collected? Why was nothing done to stop this...even after a client reported the crime in progress!"

    Than file a lawsuit or insinuate, by paying a lawyer to make a call and claim that his client is considering filing for damages....blah..blah..blah.

    But the truth of the matter, most of our recent laws are there for two reasons.... a) to protect the powerful, b) to keep the massess subdued.

    Almost none of them are designed to punish actual criminals or protect the common citizenry. Face it, our justice system in America is dying...
    • Actually, this might not be such a bad idea.

      With the over-the-top reactions reported in the media, this might be exactly what is needed to force Charter One to deal with their fucked setup.

  • by FreeLinux (555387) on Friday June 20, 2003 @02:15PM (#6255921)
    Here is the info on the addresses you provided.

    Lop.com
    Unit 12
    571 Finchley Road
    Hampstead
    London, NW3 7BN
    UK

    Domain name: LOP.COM

    Administrative Contact:
    Live, Media webmaster@lop.com
    Unit 12
    571 Finchley Road
    Hampstead
    London, NW3 7BN
    UK
    + 44 7817 130 743
    Technical Contact:
    Live, Media webmaster@lop.com
    Unit 12
    571 Finchley Road
    Hampstead
    London, NW3 7BN
    UK
    + 44 7817 130 743

    Registrar of Record: TUCOWS, INC.
    Record last updated on 12-Mar-2003.
    Record expires on 06-Oct-2005.
    Record Created on 07-Oct-1998.

    Domain servers in listed order:
    NS1.LOP.COM 66.220.17.5
    NS2.LOP.COM 66.220.17.5

  • by djbrums (633961) on Friday June 20, 2003 @02:15PM (#6255929)
    I worked as a security officer for many years, working with law enforcement on issues such as this. In reality, what you've run up against is a fundamental problem with computer law. Almost any offense they could charge the perpetrator with is a felony, thus the FBI should handle the case.

    So what does it take to get the FBI to investigate? There are about 4 different things the bad guys could do:

    • Cause $5000 worth of damages. What "damage" means is not standardized. Some district attorneys read the law as meaning $5000 worth of physical damage! In any case, most interprate this to mean $5000 in damages from the hack, but recovery time is not necessarily included. Thus, the question of whether your credit card was used.
    • Breaking into a financial instituation.
    • Cause a public health threat, such as by breaking into a hospital.
    • Attacking the interests of the US, i.e. the gov't.

    The problem is you don't fit into any of these categories for the FBI. Suppose you did come up with the required damages. Then the FBI have to choose whether to pursue your case or another. If someone else is causing more problems, they'll investigate them instead of your case. If you don't have any idea whose doing the hacking, then again they'll probably go after someone who they think is easier to catch. Last, they'll try to decide whether or not they think the case will lead to an easy conviction. If not, again your screwed.

    Basically it's a matter of priorities, and this doesn't sound like a large enough hack to be more than the blip of a Cessena at an international airport full of 747's.

    It sucks, but that's how it is. What would be good is if hacking resulted in a fine, or some other misdemener. Then convictions would be easy, and the bad guys would quickly learn crime doesn't pay in the small case, and the big cases result in the FBI actually going after them.

    • So what does it take to get the FBI to investigate? There are about 4 different things the bad guys could do:

      • Attacking the interests of the US, i.e. the gov't

      To add to the earlier comment [slashdot.org], the situation with Cliff Stoll in the Cuckoo's Egg started out as a few minor hacking incidents, and was eventually traced to a group of German hackers who were stealing U.S. military documents and selling them to the KGB (and this is non-fiction!). Cliff's computers were being used as an intermediate link to other,

  • tdko.com (Score:3, Informative)

    by jmichaelg (148257) on Friday June 20, 2003 @02:28PM (#6256079) Journal
    I pointed my browser at tdko.com [tdko.com] and found a porn shop/spam center. The spam center has the following offerings:
    1. Email Extraction Software
    2. Realtime IP Tracking - Buy 25,000 visitors
    3. Create freedom,wealth,...
    and so on.

    If nothing else, the attack you describe is a way to harvest current email addresses.

  • FBI is busy (Score:4, Informative)

    by Capt_Troy (60831) <tfandango@nOSPAM.yahoo.com> on Friday June 20, 2003 @02:28PM (#6256081) Homepage Journal
    I spoke to an FBI agent about this once. She told me that their computer crimes division is so extreemly busy that they only concerntrate on the cases involving about 250K or more since they don't have the resources to investigate everything. Additionally, she told me that when making a case to the FBI, that including your time and expenses in the initial investigation are valid monitary losses and can be included in the net loss resulting from the hack. However, you need to have suffered serious losses to get your case looked at by the FBI.

    Sorry. But they are busy.

    Troy

  • by arget (447057) on Friday June 20, 2003 @02:30PM (#6256094) Homepage
    The government is worthless in this. They're reactionary, not preventative, and even then will only give you the time of day if there's hard money or data loss involved.

    Charter was woefully unconcerned, and as their customer, I'd raise hell, escalating up their corporate food chain.

    To get at the actual attacker, go the next rung, look at who owns/controls the IPs that you're being redirected to.

    http://ws.arin.net/cgi-bin/whois.pl?queryinput=! %2 0NET-66-220-17-0-1

    CustName: C2 Media Ltd
    Address: P.O. Box 1113
    City: Shalimar
    StateProv: FL
    PostalCode: 32579
    Country: US

    who are in turn a customer of Hurricane Electric

    TechHandle: ZH17-ARIN
    TechName: Hurricane Electric
    TechPhone: +1-510-580-4100
    TechEmail: hostmaster@he.net

    OrgTechHandle: ZH17-ARIN
    OrgTechName: Hurricane Electric
    OrgTechPhone: +1-510-580-4100
    OrgTechEmail: hostmaster@he.net

    Go to Hurricane, and ask them why they're letting this go on. They'll be more concerned. You've indemnified Charter in your service agreement, most likely, and can't sue them. Hurricane has no such protection from you and will, ironically, be more responsive than your own ISP.
  • by eniu!uine (317250) on Friday June 20, 2003 @02:34PM (#6256141)
    Unfortunately I am not as technically savvy as the poster. Is there any way I can duplicate the 'investigation' to see if I get the same results at least so I know whether or not my information is being collected? I use DHCP to get my DNS, so I'm pretty much screwed if the poster is right.

  • Nobody cares (Score:5, Insightful)

    by hafree (307412) on Friday June 20, 2003 @02:41PM (#6256219) Homepage
    Unfotunately, nobody cares when it comes to the consumer. About a year ago a new vulnerability in AuthorizeNet's billing gateway was discovered that would allow someone to submit authorize-only transactions knowing nothing but your AuthorizeNet username, which was often found embedded within the various forms of an online store. One of my e-commerce clients fell victim to this, and had over 600 $0.01 authorize-only transactions submitted in under an hour. Basically what this meant was that someone was using my client's account to verify stolen credit card numbers.

    Going through my logs, I was able to get the IP addresses these submissions came from, the e-mail addresses the results were sent to (not sure why they bothered with that), and all information on every single card submitted. This included the card number, expiration date, and the cardholder's name and address. I contacted AuthorizeNet but they said it wasn't their problem. I called Visa and Mastercard but they just asked for a printout to be faxed to them (600 item spreadsheet 5 pages wide). I contacted the FBI and was referred to the NSA. I contacted the NSA and they said call back Monday since at this point it was about 6pm Friday evening.

    I was appalled to find out that some identifiable hacker with an arsonal of valid cards was about to be given an entire weekend to sell or use them before anyone would even consider looking into it. I couldn't even get the credit card companies to accept the spreadsheet of THEIR customers so they could at least warn them all that their cards had been compromized.

    I finally just gave up and destroyed any evidence of this fraudulent activity having ever taken place. With my luck, not only would the hacker get away, but I'd be the one in hot water for posessing that spreadsheet. It just goes to show you that nobody cares about the consumer.
  • by xrayspx (13127) on Friday June 20, 2003 @02:47PM (#6256291) Homepage
    Google, while not having a wealth of info on tdko.com, did have some useful bits: groups [google.com]
    I'd heard the name tdko before, I was pretty sure, in the context of a Bonza or Gator or something. They'll change your default search page in IE, etc, this sounds like just another dirty trick. I doubt they compromised the DHCP servers themselves, my guess is that some pop-up or spyware app changed your settings locally. If you did try it from multiple systems, well, they're several of YOUR systems, you may have visited to same site or installed the same spyware on each. I think eDonkey F'd with my default search page IIRC.

  • Go to the press (Score:3, Interesting)

    by Get Behind the Mule (61986) on Friday June 20, 2003 @02:58PM (#6256398)
    ... and it doesn't have to be the New York Times, just get any kind of publicity. I'd be very surprised if you can't get your local TV news to run a story about this, if you tell them everything you posted. Of course, the idiots at the TV station will hardly understand a word, nor will they try, but they just love a story about eeeeeevil hacker pirate people and an unresponsive FBI. They'll run a story with pictures of computers in darkened rooms, with something that looks like the Matrix on the screen, and scary minor-key music in the background.

    And some poor spokesman for Charter will have to go on the news and say some crap like "This incident will be thoroughly investigated" or "We take the security of our customers very seriously" or some similar horseshit. Either that, or the TV news dorks will say, with ominous overtones in their voice, "Charter Communications did not return our calls".

    Then Charter will either have to do something about it, or they will suffer damage to their image and ultimately to their business. The latter won't help you much, but if it turns out that way, then you know for sure that you've got to stop doing business with them. And you've given them a little bit of hurt that they certainly deserve.
  • by gosand (234100) on Friday June 20, 2003 @03:06PM (#6256496)
    Mention these three words in passing when talking to tech support at your ISP: Small Claims Court

    I hate our damn system where everything has to be taken to court, but it sounds like you are out of options. Get somone from the ISP on the phone, and make sure to ask them for their first and last name. Then mention that you haven't gotten any kind of reasonable response to your issue, and how you wouldn't want it to have to degenerate to a small claims court case. Ask for their manager, and I am sure they will get them for you.

    If you make them aware of the issue, and they refuse to respond to it, they are negligent. For crying out loud, you are trying to HELP them. Be sure to point that out, politely, of course. Make them realize that they want to resolve the situation.

  • by Tsu Dho Nimh (663417) <abacaxi@NosPAM.hotmail.com> on Friday June 20, 2003 @03:09PM (#6256532)
    Make sure you can SHOW the problem to a non-technical person. If you can show the problem, contact the ISP with your best concerned citizen attitude, as if you are doing them a BIG favor by giving them some time to get ready to be interviewed on TV.

    You start with a call to the highest rated local TV station and ask to speak to the "assignment desk or assignment editor" (this is the person who sends out reporters to stories). Explain to this person that a local ISP has been hacked and that customer data, including passwords and financial data, is at risk and the ISP doesn't appear to care. Repeat until you find a TV station who takes the bait. Then take one or both of the courses of action below.

    ONE: Call the ISP and ask to speak to the CEO. Tell them that their servers have been hacked, that their tech support was not interested in the potential for theft/abuse of customers personal data, and that you have reported it to the local media and will be running a demo of what is going on for the reporters. Ask them to be sure to have someone on hand for a phone interview with the TV reporters so they can explain why the hacking happened and what they have done to fix the situation. Get the name and number of the person the TV reporter should call.

    TWO: Call the ISP and ask to speak to their legal staff. (repeat story you tell to CEO) Ask them who is the right person for the ISP customers to send damage claims to, and also ask them to have someone on hand for the reporters to interview to explain what laws have been violated and how the ISP intends to get the laws enforced.

  • by gandy909 (222251) <[moc.liamg] [ta] [909ydnag]> on Friday June 20, 2003 @03:12PM (#6256567) Homepage Journal
    I have 2 things that happened where the 'feds' were involved, and I can say from experience that this is exactly the response you will get from the feds for trying to do the right thing.

    I have a dialup inet connection at home. Sux, but that's my only viable option at the moment. I stuck a 6.1 or 6.2 Redhat box on the modem and set it up as a firewall/default gateway for the other 3 (Windows) pc's in the house. The kids have to play online games, etc, ya know. I stupidly left the ftp server running for some reason. Worked flawlessly for 2 years. One day I came home and the box had crapped out in the midst of booting with a strange error. Finally got it up and things didn't even look right. Yup, I had finally had my first experience at being rootkit'd. Fortunately they had used a screwed up rootkit and it didn't like something about my system or the OS and it crashed on reboot.
    I freaked out and called the FBI right away in case they wanted the box to 'collect forensic evidence' or something. The conversation went like this, and the money figure is the one he used:
    "Hello, FBI"
    "Hi, I got my computer system hacked into. What do we do now?"
    "Uh, did you lose at least $50,000.00?"
    "No..."
    "Sorry, we could care less then. Goodbye"

    My other story, and I was more upset on it, happened when I worked at the courthouse when the 'dad's'(or mom's) paid the support there so the court could track the payments, then we would deposit it and write our own check to the 'mom's' (or dad's) and mail them out. A person we sent a check to lived in an apartment, but had moved and hadn't given us his/her new address. Someone else was now living in the apartment where we sent the check. To top it off, the post office had mis-delivered the check to a different apartment in the complex. (I know, it is confusing) Anyway, the person who got the check didn't know that the person it was made out to had moved. This person, knowing it was a check for a substantial amount of money, went to the address on the envelope and told the person who (now) lived there that they would only hand over the check for a certain percentage of the amount!!! This person said she would think about it and immediately called us. At this point we have the perfect 'sting' waiting to happen, and all the authorities have to do is be present when the blackmailer returns to settle the deal! So I called the FBI and they said they didn't care, and I should call the postal inspectors office. So I did. This guy said if there wasn't 'thousands and thousands' of dollars at stake he wasn't interested in the least.
    So here we have a real crime happening and no one cares, but when some kid goes out and knocks over a few mailboxes they throw the book at em. Those two events alone were more than enough to tell me to NEVER trust the federal gov't nor rely on them to do the right thing where individuals citizens are involved. and this was all before that moron Ashcroft got in charge. (who is unfortunatelly from my state, and boy were we glad to get rid if him, or so we thought!)
  • by Dolemite_the_Wiz (618862) on Friday June 20, 2003 @03:25PM (#6256727) Journal
    1) Book Mark this site. [cert.org] This is the first and best place to go when hacked and is a great source of education in general for victims of hacking.

    2) You're right about the FBI. They are very limited in their scope of assistance. The only other victims they would take immediate action with are attacks on other State, local or US governmental sites (ie. State Funded Universities, Governmental offices, etc.)

    3) Scan your logs on a regular basis.

    4) Check this link out. [conxion.com] This is the NSA'a recommendations on how to hammer down Cisco Routers, Windows 2K, XP, and NT4 Operating systems. These should be used as a guide as following all the steps in this manual would turn your machine(s) into bastion servers.

    5) Be Prepared for the ISP not talking to or Working with you on this issue. Prodigy, Qwest, and Sprint used to be and in some cases are REALLY bad at this.

    Dolemite
    ______________________
  • by RobertB-DC (622190) * on Friday June 20, 2003 @03:29PM (#6256767) Homepage Journal
    File it under P for "Paranoia", but a worst-case scenario is that you stumbled onto the FBI's own hack job.

    There could be a whole bundle of subpoenas giving them permission to monitor all communication on Charter's server... or Charter could have simply pointed an FBI agent toward the server room door and given him/her the key. Either way, you have no way of knowing that Big Brother is watching you.

    Hopefully, if it's the feds doing the hacking, they're looking for something or someone in particular. Where a hacker might dig through all the transmissions that include 16-digit numbers, the feds may be looking for all requests that include a particular email address. Let's just hope that it's not *your* email address.

    Or maybe they've got the digital signature of a prosecutable image -- if it comes across, they check out who it went to and who it came from. You'd better hope you hit the "back" button in time! Of course, you have the 4th amendment to prevent anything they discover from being used against you in court... but that doesn't keep them from using what they find out "off the record" to get "on the record" evidence they can use.

    I'm not terribly concerned about the feds (or other gov't agencies) using such a hack to compile a dossier on every Netizen, simply because 1) the signal/noise ratio is too low and 2) the government's built-in inefficiency is the best guarantor of our continued freedom.
  • by kalanar (469957) on Friday June 20, 2003 @03:37PM (#6256853)
    Here's how you remove it:

    LOP Removal [onlinepcfix.com]

    Excerpt:

    Lop masquerades as an mp3 search engine. It is capable of:

    Hijacking your starting page
    Adding the Lop Toolbar to Internet Explorer
    Adding the Lop Toolbar to Windows Explorer
    Causing frequent Windows Explorer & Internet Explorer crashes
    Popup advertisements
    Adding Lop links to your Bookmarks (Favorites)
    Installing software on your PC without your consent
    Tracking your site visits and reporting them back to Lop (for advertising purposes)

    Now where's my check for the 5 minutes that it took to google for this? Your question of "Why doesn't these agencies handle these kinds of problems?" is ironically answered by your real issue. The FBI is not your local computer repair shop.

    I would run a program like Ad-Aware to remove any other spyware that you have installed. And next time that you're "hAx0r3d" go to google and search for "hostnamethatisHax0ringme.com spyware"
  • by scovetta (632629) on Friday June 20, 2003 @04:12PM (#6257216) Homepage
    just trade an MP3 and wait for the RIAA to contact the FBI for you!
  • Tech Support (Score:4, Informative)

    by EtherBoo (636012) on Friday June 20, 2003 @04:20PM (#6257295) Homepage Journal
    This may seem redundant, and it may seem a bit trollish, but seeing it from the TSR (Technical Support Representative) perspective, we really don't care. I mean, think of it like this, you do have a point, and whats happening should be taken care of, but the guy who answers the phone, is going to think you're just paranoid. If he talks to a supervisor, the supervisor is going to tell you that we are currently fine, and there are no hacks going on, unless of course we have been notified, in which case, we say something like, "Sorry for the inconvience, blah blah blah. We are working with our NOC to resolve the isssue, blah blah blah." As sorry as I am to say it, it's not worth it to use to care. We don't get paid enough, and as employees, we are just treated like garbage, at least at the place I work. Basically, the only thing you can do is send an email to Abuse, or just sit and wait, realizing that there isn't anything we can do. Tech support is really just for the end user that doesn't know any better. Anyone that knows anything is going to have a much harder time with support. Sorry.

    Hope you didn't give them you're /. user id and pass.

  • by EaglesNest (524150) on Friday June 20, 2003 @04:22PM (#6257310)
    The FBI is going to ignore anything unless you allege that you lost $5,000. In the real world, unless you see some fraud on your credit card after theives stole your number off your computer, they probably aren't going to care. Also, if someone uses your computer to attack and damage other computers (or even deface) that might get their attention. Here's the main collection of federal laws that apply to computer crime.

    http://www.cybercrime.gov/cclaws.html

    And here's the primary criminal law that applies:

    18 USC 1030. Fraud and related activity in connection with computers

    (a) Whoever--
    (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y.[(y)] of section 11 of the Atomic Energy Act of 1954 [42 USCS Â 2014(y)], with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it;
    (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains--
    (A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);
    (B) information from any department or agency of the United States; or
    (C) information from any protected computer if the conduct involved an interstate or foreign communication;
    (3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States;
    (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $ 5,000 in any 1-year period;
    (5) (A) (i) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
    (ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or
    (iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage; and
    (B) by conduct described in clause (i), (ii), or (iii) of subparagraph (A), caused (or, in the case of an attempted offense, would, if completed, have caused)--
    (i) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $ 5,000 in value;
  • by MortisUmbra (569191) on Friday June 20, 2003 @04:34PM (#6257414)
    The law isn't to protect you and me, it's to protect the people who pay the lawmakers....corporations. I gaurantee you if someone hacked into your PC, stole your credit card, and charged $1,000 to it the FBI wouldn't do sh!t. Factor in as much money as you want for your time in tracking it down. They wouldn't care, because you are not onpayroll at a corporation, so the damage is minimal. Money talks, same as always, and corporations have more of it than an individual. Now if you were a multi-millionaire and actively donated to political funds. I bet it would be different.
  • by nurb432 (527695) on Friday June 20, 2003 @04:51PM (#6257579) Homepage Journal
    While you may think im joking i am serious.

    None of this stuff is to protect the citizens. unless you are a large corporation or an elected official you are out of luck.

    Im surprised they even talked to you at all personally. Even small companies have a hard time getting any help, they are too 'trivial' to bother with.

    Not saying i agree, its just reality.. they DONT CARE about 'us'.

  • Basically... (Score:5, Insightful)

    by theolein (316044) on Friday June 20, 2003 @05:02PM (#6257671) Journal
    It means what we already knew: That you as a single person are of no value to your government. This is the real world in which corporations can get tax breaks, get away with multi million dollar fraud, sic the feds onto you for sharing an mp3, sue you for your life's savings and the world in which you are powerless. It's exagerated but this is why communism was so popular in the early 20th century. The commies promised to put the rich fuckers up against the wall and shoot them. (They did this of course, but thereafter they were the one's treating you like shit)

    The next time you think big business and globalisation is fine and that those pesky anti-war demonstrators should get locked away, think of this again. ...and perhaps you should check your hosts file in c:\windows\system32\drivers\etc as well ;)

You will lose an important disk file.

Working...