3

Upon searching with google for information related to a problem I had with a particular ip attempting to gain access to a server which I own, I came across a question containing relevant information which was recently deleted from security.stackexchange.com and was able to read it from google's cache.

The question had the following title: "BadBlood Malware port open on ssh attacker, is it possible to fight back?". This user apparently had a very similar experience with an attacker from the same subnet as the one I'd been dealing with and the same ports open on the side of the abuser.

I suppose my question at this point is merely: Why was this question deleted?

Does it have to do with disclosing specific information about the alleged attacker such as ip address, or perhaps more along the lines of asking questions about launching counter-attacks.

I have no interest in any further rendezvous with said subnet but I am still curious about this port 6006 business and how it may relate to a trojan known as "BadBlood". If anyone knows about this or about the reason(s) for which this question was deleted I would be ever so grateful as this situation appears rather strangely to me and is part of a subject that is not well within my domain of understanding.

Thanks in advance.

3
  • Are you sure the OP didn't delete the question? That sometimes happens when all the responses are saying that the OP is trying to do something unwise.
    – Neil Smithline
    Nov 8, 2015 at 19:01
  • I agree that the OP appears to have been intent on illegal action (i.e. using unauthorized access to someone else's computer) but I am not convinced that would be a good reason to delete the post. Aren't posts like that excellent teaching opportunities? Don't we security practitioners have a responsibility to provide feedback on appropriate means of protecting systems and warn non-practitioners where the boundaries of acceptable behavior lie? [BTW, the entire problem is solved by a properly configured firewall.]
    – JaimeCastells
    Nov 13, 2015 at 22:25
  • I run OpenBSD on that server, which is also what I use as a router. It's a fairly low-powered machine ( a 2.0Ghz Pentium 4 ) and it happened that the attacking being done was causing a pretty high load average (high-6's on a single core processor), normal averages on the machine are <0.1 . My solution was to move the port from 22 to a much higher number. One of the characteristics of the attack was a constantly respawning "passwd" process, I wish I could remember the whole string - it had "login" in it somewhere.. I'd like to know of other ways of handling that besides port knocking...
    – John Euell
    Nov 15, 2015 at 3:09

2 Answers 2

Reset to default
6

Fighting back (in terms of hacking the hackers) isn't in the spirit of ethical hacking or information security.

It's a potentially very dangerous thing to be doing.

Publishing the IPs and claiming attacks originating from them is potentially libellous as well.

Most importantly you could be attacking innocent bystanders whose machines have been compromised in order to mask the attackers' origin.

The correct approach, in my opinion, is to report the attacks via abuse channels for the owners of those IPs and to services like Alien Vault which track these kinds of things.

0

I had the same BadBlood Bot attack my Server just today..

In my opinion 'fighting back' does not necessarily involve illegal methods, thus the question should not have been deleted. About what should security.stackexchange.com be, if not about security?

1
  • Fighting back by enabling a firewall is is good stuff. Fighting back by exploiting access vulnerabilities on someone else's server (which is what the question asked about) is not only ineffective, it is definitely illegal.
    – JaimeCastells
    Nov 13, 2015 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .