Wednesday, February 28, 2007
I figured out what this number is. I got an electronically placed and recorded call from Comcast.
When you put this number in Google however you get a ton of nasty hacker information.
Tuesday, February 20, 2007
OrgName: Defender Technologies Group, LLC
Address: 44470 Chilum Place, Building 1
Address: Suite 1197
NetRange: 188.8.131.52 - 184.108.40.206
This is the latest blatant abusing network:
inetnum: 220.127.116.11 - 18.104.22.168
descr: Inhoster hosting company
descr: OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine
Saturday, February 17, 2007
Time of hack attempt: 2/17/07 21:42:33
In addition this IP was in the middle of this looking at another site:
Friday, February 16, 2007
This is the typical message I get from other people when I try to use Network Solutions Message Guard to send them emails:
I do not have time to go do all of these steps to read the email. It takes over 5 minutes to complete this. I am the only one here in my department and this is very time consuming. Can you please just send me a regular email.
Until this is fixed, this is not a viable solution for every day use between two parties that are not both using the same service. I thought the idea was that the person only has to go through the steps one time...
I also asked Voltage Security how they guarantee that someone at their location is not able to decrypt and read the email - what policies and auditing do they have in place - and as of yet no response.
Monday, February 12, 2007
There appears to be a hacker at arrival communications on this IP 22.214.171.124 targeting one of our real estate web sites.
They hit our contact request form about 70 times in one day.
Shortly thereafter the publishing of the site was altered, but we were able to easily republish.
OrgName: Arrival Communication, Inc
Address: 5100 California Ave Suite 104
NetRange: 126.96.36.199 - 188.8.131.52
The latest is that I just had to re-authenticate to send a message and I'm not sure why. Is this an on-going thing where you have to re-authenticate on a weekly basis?
The other thing to note is that I bought the service from Network Solutions and it is authenticating on the Voltage Security system.
Wednesday, February 07, 2007
The engineers are "scratching their heads" wondering why the attack was performed.
I can think of a few reasons.
1. Reverse load testing. Hackers are trying to calculate what it will take to bring down the Internet. Bringing down the Internet could cause a myriad of disruptions that might be beneficial to a myriad of sneaky, slimy people.
2. Bringing down the Internet at a particular time when a certain crime is being committed may prevent certain communications which may then alert the authorities or warning systems to the crime underway.
3. Someone wants attention.
4. Some really flawed programming.
Tuesday, February 06, 2007
As supsected a few people were skeptical of the email and didn't want to open it until I called them since it doesn't look like your typical email.
I also had a few people have problems with it including:
#1 my boss couldn't open it on his cell phone - didn't work at all. Also he didn't want to "sign up for an account" even though I explained that's not what it is.
#2 Someone on AOL couldn't open it at all.
#3 One of my customers using Electric Mail and also I think another provider could not open the message. She tried a few different times today...going to have to call tomorrow and see if we can figure this out.
#4 Couldn't respond to tickets to my data center which is a pretty big hosting company. They have an automated system and the message came as an attachment which was then not included in their automated messaging system.
#5 I was told after asking if I could use it on a web server to send messages that it only works in Outlook - after I told them I was using Outlook already so obviously I know that. So you can't sign up for this and then send secure messages in an automated fashion to potential clients, for instance, or email receipts from an e-commerce web site or links to file downloads, etc.
A few things to resolve here...it's not quite as simple as normal email and obviously doesn't work for all scenarios.
Monday, February 05, 2007
Per our records, PHP is far and away the most attacked language - and we don't even host it.
These are the URLS various hackers have been scanning our boxes for in the past few months:
And here are the IPs that have been up to this mischeif along with number of hits:
Friday, February 02, 2007
I have one account set up to forward to the other.
I sent from account A to account B.
Then account B forwarded the IBE message to create a key back to account A.
I was able to create the private key on my computer by creating a login - using a different email address than the one the email was sent to. (I was in account A - the one that sent the message).
When I went back to the email in my webmail based email account B I had the key on my machine and was able to read it even though the email address I entered when I created the key for was not the email address the mail was sent to...
Also about 5 minutes later I was forwarded the test message from account B back to account A and was able to read it without doing anything else.
Seems a bit odd. Not sure the implications of this on secure email. I will have to think this one through a bit more.