Computer savvy? Please advise me about a possible hack.

[moobu2]

Time: 2:03 AM
Date: 6/24/2009
Intrusion: HTTP MS IE object element data DoS
Intruder: assets.miaminewtimes.com(68.142.122.70)

I posted extensively on the net about an ongoing legal case, and the other day, had 1 reporter that wanted to contact me personally about it. I declined. Anyway, early this morning, it looks like someone tried to get information from my computer from the above address etc. Is that legal? Should it concern me in any way, or what do you think? Should I just not worry about it? It does bug me.

Edited to add…they attempted this 5 or 6 times over a several hour period.

[Rabrrrrrr]

1. Weird - that's a newspaper in Miami. What program found this information?

Your firewall? A virus scanner?

[moobu2]

2. Norton internet security

Firewall and anti virus thingy..I’m not that knowledgeable about this. One reason I don’t know if I should be concerned.

[Rabrrrrrr]

3. Dang. If that's the paper that the reporter you talked to is from,

then I'd say the fucker did indeed try to get into your system for more info.

[moobu2]

4. I was thinking about calling someone

at the paper whos in charge and complaining, Because they attempted it 5 or 6 times. But then I might just be asking to get further involved, when I have no interest.


It just bugs the crap out of me.

[kentauros]

5. Maybe call the paper and ask to speak to their IT manager.

They should be able to confirm or deny that the hack came directly from the paper's building. Otherwise, it was a hacker going through the paper's computers to get to yours. Which would also be cause for worry to the paper, security-wise.

[RoyGBiv]

6. This is not a "hack"

... as such.

Really, that's way too little information to go on to determine what, exactly, was happening. It could for instance be a spoofed address.

In any case, that looks like an attempted Denial of Service (DoS) attack or more precisely the signature of a data packet directed toward an exploitable element of Internet Explorer that was stopped by your firewall. And it probably wasn't a person, per se. You get this when you visit a website that has code associated with it that attempts the exploit. It's probably some bit of javascript on the Miami New Times(?) website, likely associated with an ad, and they know nothing about it.

Keep checking your logs. If in the unlikely event this was a human, it is most likely part of an automated flurry of attempted exploits. No one who actually know what they're doing just tries that and stops there.

FWIW, if you do happen to have a truly committed attacker after you, please, for your own sake, get something other than Norton. To borrow my favorite metaphor, Norton's security is like a screen door on a submarine.

[moobu2]

7. Thanks Roy

That makes sense and I do feel much better about it now. I wouldn’t have given it a second thought but that reporter from NBC wanted to contact me about my Face Book page posting about a legal case etc…I don’t think that’s so now. Thanks again.

[RoyGBiv]

8. Timing sucks like that ...

More than once I've experienced something weird with my Internet connection that just happened to coincide with other weird things out in the world.

This, in fact, is what motivated me into learning how to read firewall logs and the like.

Also FWIW, if you're using something other than IE 6 or below, that exploit wouldn't have affected you anyway. It's the kind of thing script kiddies or low-tech scammers who "borrow" old exploit code from hacker websites and such do.