Need help with a script kiddie

[Rastar]

Hey all I know this is a Linux forum but this is what is going on.

My Wife's 16 year old son is here and has downloaded msn messenger for windows me. All the sudden some screwball kid 13 years old starts talking about how he can hack in and screw up my son's computer (mine).

Well this goes on for awhile and it looks like he is either running a bot or some kind of script. Just the same old messages retreading. It does control this ends msn and can cause him to log out etc.

First off I installed Mcafee firewall and ran that the next thing to make sure is that on her machine there were no ports open. (Linksys forwarder says no).

How can I figure out from his email address an ip address and then who do I report him too?

Thanks
Ras

[Feztaa]

[quote author=Rastar link=board=5;threadid=3738;start=0#37725 date=1023840762]How can I figure out from his email address an ip address and then who do I report him too?[/quote]

You can't figure out his email address from his ip address. You can find out what ISP owns that IP range, and then complain to his ISP; or you can just install A Real OS (tm) with some Real Firewalling (tm) capabilities, and never worry about him again...

[tolstoy]

I hate to jump on the don't run M$ bandwagon, but that may be the way to go. Get rid of MSN messenger. A lot of holes have been popping up in it lately. I also second the motion to report the trouble to his isp, if you can get his ip somehow. If you have his IP address, find out what ISP owns the block, as Fetzaa already said, and then send nastygram to abuse@what_ever_isp.com.

[Rastar]

[quote author=Feztaa link=board=5;threadid=3738;start=0#37730 date=1023844842]
[quote author=Rastar link=board=5;threadid=3738;start=0#37725 date=1023840762]How can I figure out from his email address an ip address and then who do I report him too?[/quote]

You can't figure out his email address from his ip address. You can find out what ISP owns that IP range, and then complain to his ISP; or you can just install A Real OS (tm) with some Real Firewalling (tm) capabilities, and never worry about him again...
[/quote]

I have his email something_something@hotmail.com but since it is hotmail I think I am SOL?

I have RH 7.3 on my machine but my wife's machine is running M$ (I cant convince her to switch) ;D

So if I have his email can they trace it back to an IP block?

Ras

[Feztaa]

[quote author=Rastar link=board=5;threadid=3738;start=0#37751 date=1023849714]I have his email something_something@hotmail.com but since it is hotmail I think I am SOL?[/quote]

This email address is useless to you. Forget about it and don't worry about it ever again.

What you need to do is find out this guy's IP address, and from that you can find out what ISP he is on, and then get him booted off the ISP.

I have RH 7.3 on my machine but my wife's machine is running M$ (I cant convince her to switch) ;D

So then what you need to do is set up the Real OS as a gateway for the Toy OS, so that you can block attacks without worrying too much about the Toy OS.

So if I have his email can they trace it back to an IP block?

No. Email means nothing. Email is a very high level concept, IP is a very low one. Email has no bearing on IP whatsoever. Anybody at any IP could have any email address.

The worst thing that you can possibly do with that email is complain to hotmail, so they'll close his email... but then he'll just open another one. Minor inconvenience.

[BurntAsh]

find out the lil shits ip address and pXr.c em also submit his email address to a bunch of gay porn things.

[tolstoy]

So then what you need to do is set up the Real OS as a gateway for the Toy OS, so that you can block attacks without worrying too much about the Toy OS.

I'm not so sure a gateway or firewall would block this type of activity if your ruleset allows outgoing MSN traffic. Don't most of the IM exploits bypass firewalls so long as IM client-to-server traffic is permitted to leave the LAN?

[ph34r]

Put your Linux box between the 'net and the Win32 machine, and run snort. Eventually, you will get his IP address. Once that is done, report him to his ISP or just leave the Linux box as the gateway/firewall and drop his whole subnet range automatically.

[Feztaa]

[quote author=tolstoy link=board=5;threadid=3738;start=0#37792 date=1023881621]

So then what you need to do is set up the Real OS as a gateway for the Toy OS, so that you can block attacks without worrying too much about the Toy OS.

I'm not so sure a gateway or firewall would block this type of activity if your ruleset allows outgoing MSN traffic. Don't most of the IM exploits bypass firewalls so long as IM client-to-server traffic is permitted to leave the LAN?[/quote]

Sure, it would bypass the firewall if IM stuff, which is why you would set up a rule that just drops everything from his ip.

[Rastar]

Okay so Mcaffee returned this report

Blocked port scan attack the ip associated with this attack was 63.251.119.14 port 20480 with the local port of 17924.

Mind you this is a windows machine which SHOULD not have any ports open at my linksys router but... Obviously he got as far as the firewall.

A traceroute returns unknown host
so does a whois

How do I find out who this is? Which program should I run to figure it out.

Ras