Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Networking Networking
Search Search
Search for:
Tech Support Guy > > >

Blocking a hacker for good


(!)

dez_666's Avatar
dez_666 dez_666 is offline
Computer Specs
Senior Member with 842 posts.
THREAD STARTER
 
Join Date: May 2007
Location: Sacramento, California
Experience: Advanced
23-Jun-2007, 03:10 PM #1
Blocking a hacker for good
I am running a server on my PC and i am getting repeated attemps to brute force the login for it ._.
However, the IP changes every time, so I assume they have an ISP that gives them a new IP every time they relase/renew or reconnect..
How do I find the MAC address (Or something else that would be a permanent identifier) so I can block them with my router?
dez_666's Avatar
dez_666 dez_666 is offline
Computer Specs
Senior Member with 842 posts.
THREAD STARTER
 
Join Date: May 2007
Location: Sacramento, California
Experience: Advanced
23-Jun-2007, 05:06 PM #2
Anyone ;_; have any solutions?
redcivic's Avatar
redcivic redcivic is offline redcivic has a Profile Picture
Computer Specs
Member with 418 posts.
 
Join Date: Oct 2003
Location: San Antonio
Experience: Advanced
23-Jun-2007, 05:08 PM #3
How are you determining that someone is trying to get in? Logs?
dez_666's Avatar
dez_666 dez_666 is offline
Computer Specs
Senior Member with 842 posts.
THREAD STARTER
 
Join Date: May 2007
Location: Sacramento, California
Experience: Advanced
23-Jun-2007, 05:11 PM #4
Yep! thats how

heres a sample

Code:
6/23/2007 1:00:24 PM 61.183.11.3:46569> Disconnected
6/23/2007 1:00:25 PM 61.183.11.3:47193> Failed to authenticate as Administrator (adora)
6/23/2007 1:00:26 PM 61.183.11.3:47193> Failed to authenticate as Administrator (adore)
6/23/2007 1:00:27 PM 61.183.11.3:47193> Failed to authenticate as Administrator (adoree)
6/23/2007 1:00:27 PM 61.183.11.3:47193> Disconnected
6/23/2007 1:00:28 PM 61.183.11.3:47588> Failed to authenticate as Administrator (adoree)
6/23/2007 1:00:31 PM 61.183.11.3:47588> Failed to authenticate as Administrator (adorne)
6/23/2007 1:00:32 PM 61.183.11.3:47588> Failed to authenticate as Administrator (adrea)
6/23/2007 1:00:32 PM 61.183.11.3:47588> Disconnected
My server is supposed to have auto-IP banning based on the number of bad logins from an IP, but it doesnt seem to work ._. ive tested it myself by putting in bad logins..
But anyways is there a way to find out the mac addy of people trying to do this?
redcivic's Avatar
redcivic redcivic is offline redcivic has a Profile Picture
Computer Specs
Member with 418 posts.
 
Join Date: Oct 2003
Location: San Antonio
Experience: Advanced
23-Jun-2007, 06:22 PM #5
Is that log from your server or from your router?
dez_666's Avatar
dez_666 dez_666 is offline
Computer Specs
Senior Member with 842 posts.
THREAD STARTER
 
Join Date: May 2007
Location: Sacramento, California
Experience: Advanced
23-Jun-2007, 08:07 PM #6
My server. My router doesnt log those kinds of things..i dont believe..
JohnWill's Avatar
Computer Specs
Retired Moderator with 106,412 posts.
 
Join Date: Oct 2002
Location: South Eastern PA, USA
23-Jun-2007, 08:11 PM #7
I suspect they're using a proxy server or many of them. You probably will have no luck in locking them out by IP address.
dez_666's Avatar
dez_666 dez_666 is offline
Computer Specs
Senior Member with 842 posts.
THREAD STARTER
 
Join Date: May 2007
Location: Sacramento, California
Experience: Advanced
23-Jun-2007, 08:14 PM #8
Hmm. :| I thought about the proxy server thing, but I traced one IP back to "serverkompetenz.de"..But that might be a proxy server that was a while ago before I thought they might be proxy'ing. But whoever is doing this seems pretty determined..Can anyone suggest free FTP server software? =]
briealeida's Avatar
briealeida briealeida is offline briealeida has a Profile Picture
Computer Specs
Member with 650 posts.
 
Join Date: Jun 2007
Location: US and A
Experience: Ninja
24-Jun-2007, 11:01 AM #9
About the MAC thing, I thought that was a really good-to-go way to block someone, too until I was using Knoppix STD the other day and it has a MAC changer utility. I found this site that lists ways to change your MAC in a bunch of different OSs, for what it's worth:

http://www.tech-faq.com/change-mac-address.shtml
JohnWill's Avatar
Computer Specs
Retired Moderator with 106,412 posts.
 
Join Date: Oct 2002
Location: South Eastern PA, USA
24-Jun-2007, 11:05 AM #10
FileZilla is a good FTP and free package.
Tormn's Avatar
Tormn Tormn is offline
Account Disabled with 3 posts.
 
Join Date: Oct 2007
Experience: 1337 duh!
13-Oct-2007, 05:44 AM #11
Why did you stop hosting your website?

Last edited by Cookiegal; 13-Oct-2007 at 08:12 AM..
Cookiegal's Avatar
Administrator & Malware Removal Specialist with 97,945 posts.
 
Join Date: Aug 2003
13-Oct-2007, 08:13 AM #12
Quote:
Originally Posted by Tormn
Why did you stop hosting your website?
I've edited your post. You need to read the rules before posting again. Rudeness and namecalling are not acceptable.
royalprince's Avatar
royalprince royalprince is offline
Computer Specs
Member with 76 posts.
 
Join Date: Oct 2007
Location: India
Experience: Advanced
13-Oct-2007, 08:43 AM #13
Do one thing........

Run the netstat -a command and send us the details of it....

This will show up a list of ports that are open for access

In case the hacker/s use a specific port we can simply block the application attached to it..
WOOT[UnDeAd]'s Avatar
WOOT[UnDeAd] WOOT[UnDeAd] is offline
Account Disabled with 3 posts.
 
Join Date: Nov 2007
01-Nov-2007, 12:32 AM #14
oh shiz wes i supposed to stop dezzy? lol im just playin. but i have an idea. try tracking the ip to the ISP then report them to the ISP with the logs and they'll do the rest.
Tormn's Avatar
Tormn Tormn is offline
Account Disabled with 3 posts.
 
Join Date: Oct 2007
Experience: 1337 duh!
14-Apr-2008, 11:54 PM #15
Hai again DeZzy.
Wat j0u doing? Hai WOOT[UnDeAd] XD WTF are the odds?
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑