NTL are hacking me

mickmc · 04-03-2004, 09:54

I have just been warned by my firewall (Norton) that there was a recent attempt to hack my computer. Having folloed the trace it has taken me to NTLs nottingham site. What is this about?

inetnum: 62.254.0.0 - 62.254.31.255
netname: NTL

descr: NTL Internet

descr: Nottingham site

country: GB

admin-c: NNMC1-RIPE

tech-c: NNMC1-RIPE

status: ASSIGNED PA

mnt-by: AS5089-MNT

changed: hostmaster@ntli.net 20010108

changed: hostmaster@ntli.net 20020815

source: RIPE

Stuartbe · 04-03-2004, 09:57

to nthellworld.co.uk Mickmc

What type of trafic has it blocked ?

It could be belated dhcp or dns acks that have set off the alarm....

Can you post the log please.

iadom · 04-03-2004, 09:57

Hi, and

, Ntl are not hacking you, you need to configure your firewall to allow certain servers trusted access, See Robon Walkers excellent website, a link is near the bottom of the home page.
Edit. B***Y Hell Stu, you are fast,:pp

Neil · 04-03-2004, 09:58

Hi & Welcome to nthw.

ntl are not attacking you at all. It's more than likely an ntl customer with a PC that hasn't been properly protected, & is infected with a virus/trojan that is sending out traffic to random I.Ps.

Not much you can do really except make sure that you have a decent firewall, & make sure your O/S is fully patched up.

mickmc · 04-03-2004, 10:02

Thanks folks but this happened repeatedly yesterday and has again happened twice today. Why would anyone from NTL want to access my computer?

Stuartbe · 04-03-2004, 10:04

Quote:

Originally Posted by mickmc

Thanks folks but this happened repeatedly yesterday and has again happened twice today. Why would anyone from NTL want to access my computer?

You need to post the details m8...... There are thousands if not millions of diferent types of attack's.....

See if you can post the event log or at least give the details of the scan/probe.

Neil · 04-03-2004, 10:07

Quote:

Originally Posted by mickmc

Thanks folks but this happened repeatedly yesterday and has again happened twice today. Why would anyone from NTL want to access my computer?

They wouldn't.

As I said it probably a user whose PC is infected, & they don't even know about it.

mickmc · 04-03-2004, 10:10

Details:

Attempted Intrusion "HTTP_IIS_ISAPI_Extension" against your machine was detected and blocked
Intruder: 62.254.0.12(16370)
Risk Level: High
Protocol: TCP
Attacked IP: mickmc(**.***.**.***).
Attacked Port: http(80)
Click on the address to trace the attacker You can get detailed information about this attack at Symantec Security Response

[Edit]-I've removed your I.P address, Neil.

mickmc · 04-03-2004, 10:11

Dont you all think this is suss

iadom · 04-03-2004, 10:12

Quote:

Originally Posted by mickmc

Thanks folks but this happened repeatedly yesterday and has again happened twice today. Why would anyone from NTL want to access my computer?

What port is the attack hitting. I have one US based IP that has hit my firewall 129 times in the past week mainly port 1026, this is almost certainly a virus infected PC.
Edit . Port 80. looks like Neil is correct, don't worry about it, just think of it as a burglar that has walked past your house and left you alone because you have an alarm fitted.

Stuartbe · 04-03-2004, 10:14

Quote:

Originally Posted by mickmc

Details:

Attempted Intrusion "HTTP_IIS_ISAPI_Extension" against your machine was detected and blocked
Intruder: 62.254.0.12(16370)
Risk Level: High
Protocol: TCP
Attacked IP: mickmc(**.***.**.***).
Attacked Port: http(80)
Click on the address to trace the attacker You can get detailed information about this attack at Symantec Security Response

Are you running a web server ? If not then this is nothing to worry about.

Its an expliot for IIS servers - http://www.microsoft.com/technet/sec...n/MS01-033.asp

If your firewall has blocked it then you dont have a problem...

The request apears to have orinated from an NTL proxy.. Someone may be using the proxy to relay the scan.

Stuart · 04-03-2004, 10:23

Quote:

Originally Posted by mickmc

Dont you all think this is suss

As Neil said, it's probably just a customer with an infected PC. He or she may not even be aware that they are doing it. These things happen nowadays. At one point, my firewall was getting hit 100 times a day by virus infected PCs.

If you are concerned, send a copy of your logs to abuse@ntlworld.com. They can track the user down, and warn him or her.

Stuartbe · 04-03-2004, 10:25

How are they going to track down the user when the reported IP is a proxy server ?

mickmc · 04-03-2004, 10:31

Well thanks for all the reassurance folks. You have all been great.

Stuart · 04-03-2004, 10:39

Quote:

Originally Posted by stuartbe

How are they going to track down the user when the reported IP is a proxy server ?

You posted while I was typing that..

Anyway, surely it depends if the proxy is logged?