Trap & Trace

[Kurt]

I have gotten many more death threats than I deserve (some my disagree). A recent incident where I was initially trying to help out a disabled vet from my home state turned ugly …well internet ugly.

The guy I was trying to help turned out to be a nutjob and decided that egging his tormentors on was a better alternative than actually doing something about it and mentioned to them that I was out to get them. Then when I dropped him for being an idiot.

Then anonymous e-mail threats have happend to me (luckily not under my real name) and with that weird attacks on my network that have done nothing so far.

I just set up one of my computers to monitor the activity and possibly be broken into in order to get evidence and maybe bust these fuckers.

Whomever they are they have taken over other peoples PC’s on the net and are initiating the attacks from them. So far their are about 20 “zombie” computers attacking my network at various times, most in the US, but some from Mexico, Canada, The Netherlands and Japan.

As soon as I get what I need I need to try to find a tech savvy LEO (hey I used a Jefe and Spamhog acronym!) To turn over the information .

Any added advice would be apreciated if you guys have any suggestions.

Btw, I really doubt anyone will act on the death threats. A common occurance on the net when people feel anonymous. If I find out Jefe was taken out in a knife-fight, then I will start to worry.

[Kurt]

It appears my attacks have not been by who I thought. They are being done by a KaZaA user controling other computers on KaZaA file share and making them find free stuff for him to download.

What is being done is this:

The guy find a weak computer on a high speed connection while downloading stuff on his computer on KaZaA. He uses a script that nstalls either the NetBus or SubSever trojan that allows for remote control of the computer. He monitors their KaZaA connections to look for more victims and for more files. Apparently he has enough of an army of people who didn’t apply or know about applying simple security patches that he can now port scan for open port 2432 which I assume is the new one that they use to check in a webbrowser to see what files you have.

Needless to say law enforcement is not needed. What was needed was a randomly generated 65MB text file that scrolls random obscenities acrross the offending zombies screen (and the hackers screen). At best this provides notice to the real owner of the PC that someone is doing something weird and they better get it checked and at worst (for them) it serves as a “ping of death” and crashes their PC (maybe the controllers PC as well depending on what kinda of setup they have.)

I was getting 60 connection requests an hour, now since I woke up this AM I have gotten only two in the last 7 hours.

So it was not the random death threat people. I must have over-estimated their IQ’s for a bit.

[spamhog]

Kurt, most PD’s now have a “cyber crimes” unit or at least a “wire head” assigned to support detectives working internet related cases. The FBI had a whole unit set up to catch child molesters who were chatting up teenagers in order to make a case, prove they were violating parole etc. Then many Narc units and Org crime sections also have the same in order to find evidence on computers seized during a raid about off shore accounts and money laundering. Problem is a lot of these units are now “reorganized” to hunt down terrorists.

My tech info is a bit dated, but we used to use “pen registerers” quite frequently and with great success. It basically traces all calls incoming and out going to a certain number, easier to get than a title 3 tap. Our unit “wire head” used to rig it into his office computer so we could have a print out come time to show Hizzoner for warrants etc.

Also give me an email and I’ll give you some additional info on some training you might be interested in concerning doing your own “trap and trace”.

Spamhog

[Kurt]

@spamhog wrote:

Kurt, most PD’s now have a “cyber crimes” unit or at least a “wire head” assigned to support detectives working internet related cases. The FBI had a whole unit set up to catch child molesters who were chatting up teenagers in order to make a case, prove they were violating parole etc. Then many Narc units and Org crime sections also have the same in order to find evidence on computers seized during a raid about off shore accounts and money laundering. Problem is a lot of these units are now “reorganized” to hunt down terrorists.

My tech info is a bit dated, but we used to use “pen registerers” quite frequently and with great success. It basically traces all calls incoming and out going to a certain number, easier to get than a title 3 tap. Our unit “wire head” used to rig it into his office computer so we could have a print out come time to show Hizzoner for warrants etc.

Also give me an email and I’ll give you some additional info on some training you might be interested in concerning doing your own “trap and trace”.

Spamhog

I would be very interested.

[Author]

Posts