RE: Company being War Dialed

From: Curt Purdy (purdyat_private)
Date: Sun Apr 20 2003 - 07:41:57 PDT

  • Next message: Kevin Hodle: "RE: port 139 syn-fin scans"

    If they are that noisy, then they are probably clueless and likely are
    running consecutive numbers.  Given that and the average time/call, you
    should be able to inform you local provider of a given number to trace in
    "about an hour".  If they cannot do that, I would look for an alternative
    provider.
    
    Curt Purdy CISSP, MCSE+I, CNE, CCDA
    Information Security Engineer
    DP Solutions
    cpurdyat_private
    
    ----------------------------------------
    
    If you spend more on coffee than on IT security, you will be hacked.
    What's more, you deserve to be hacked.
    -- White House cybersecurity adviser Richard Clarke
    
    
    -----Original Message-----
    From: Fred Kreitzberg [mailto:paranoid_with_causeat_private]
    Sent: Thursday, April 17, 2003 6:13 PM
    To: incidentsat_private
    Subject: Company being War Dialed
    
    
    The war dialing started last night and has continued throught the day.  They
    are being very noisy, staying on the line with a steady beep, beep, beep
    long enough to leave a voice message.  The calling has occcured on two
    different prefixes so I am concerned my company is being targeted.
    
    Our local service provider's security and fraud team has not been able to
    identify a single source of the calls.
    
    We have recently done our own War-dail and feel we know all our modems are
    secured correctly.
    
    Any thoughts on additional steps I should be taking?
    
    thanks
    Phred
    --
    __________________________________________________________
    Sign-up for your own FREE Personalized E-mail at Mail.com
    http://www.mail.com/?sr=signup
    
    
    ----------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
    world's premier event for IT and network security experts.  The two-day
    Training features 6 hand-on courses on May 12-13 taught by professionals.
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor
    sales pitches.  Deadline for the best rates is April 25.  Register today to
    ensure your place. http://www.securityfocus.com/BlackHat-incidents
    ----------------------------------------------------------------------------
    
    
    
    ----------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the 
    world's premier event for IT and network security experts.  The two-day 
    Training features 6 hand-on courses on May 12-13 taught by professionals.  
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor 
    sales pitches.  Deadline for the best rates is April 25.  Register today to 
    ensure your place. http://www.securityfocus.com/BlackHat-incidents 
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Mon Apr 21 2003 - 10:33:46 PDT