2

So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts that had been written to target a specific data set on our servers.

Has anyone had success in actually tracking down and getting authorities or ISPs to do anything about this kind of thing? If so, please post your suggestions.

Basically I have these IP addresses of the computers that were accessing our servers, they are owned by, surprisingly, a very very large Software company in Washington state. So maybe a rogue worker there or maybe somebody just on their network. I've tried to contact this company, but haven't gotten very far there. Maybe they'll get back to me.

What is the best course of action? Contact the local police where the source IPs are from? Somehow I doubt that will be very effective. But I'm open to advice. What about the FBI, I mean this might be small potatoes for them, but it does involve a large US corp. Anyone try this route?

EDIT: Please assume for sake of argument, that they Hacked into our servers. Let's not get into the whole discussion of "Well you had the data out there, so they didn't steal it", that really misses the point. You can even imagine it was a denial of service attack. You have their IP addresses, they are from a US corp. What do you do??

Improve this question
10
  • Also, I understand that we could have made it harder for people to access our data, so lets not even go there. We do have controls to detect and slow down their access, then we drop their IPs. But basic point is, how to get anyone to do anything about hackers? We have their IP addresses, they are in the US. Lets at least get someone to scare the c**p out of them and tell them to stop.
    – kirk
    Commented Oct 20, 2011 at 14:30
  • 5
    Are you able to provide any clearer information? Honestly, based on what you're actually providing, this sounds like a massive overreaction. You keep your "intellectual property" in a web-accessible location on a public server, really? This sounds less like theft than someone figuring out say, the naming convention of your image files and grabbing them all.
    – Su'
    Commented Oct 20, 2011 at 16:29
  • 4
    I don't know about the USA, but in my county downloading public data is not a crime, even if it's massive amounts of data. An action that's legal for a crawler like Google it's legal for everybody.
    – Osvaldo
    Commented Oct 20, 2011 at 16:53
  • 1
    Sounds like the security breach that you have on your hands here is the fact that these files are publicly accessible in the first place. It's hard to call it "theft" with a straight face if I leave my wallet on a street corner with a sticky note on it that says, "full of money, do not take."
    – Shane Madden
    Commented Oct 20, 2011 at 18:22
  • 3
    Erm...no. If you were hacked, then say you were hacked. That is a very different thing from "someone downloaded a bunch of stuff and I don't like it." We're here to answer the question asked, not what we assume the question is from incomplete or vague information. Nobody was dismissing the question, just pointing out that your reaction seemed out of scale to the issue as given and then asking for further context.
    – Su'
    Commented Oct 21, 2011 at 20:10

3 Answers 3

Reset to default
5

As always: I am not a lawyer.

If you're in the United States this would fall under the FBI's jurisdiction unless you can verify the attack originated within the same state as you and your server is also in the same state.

If the website under attack involved a large corporation you might have some luck in getting the FBI to investigate. Especially if the content being targeted had significant value (i.e. anything that a foreign government might want, anything that can hurt the country in some way, etc). However, if the content is just valuable in terms of monetary value, or does not meet any of the above criteria, you'll be hard pressed to get the FBI's attention due to terrorism and cyber warfare being much higher priorities and monopolizing FBI resources.

Practically speaking, the best you can do is continue to monitor the activity and enact countermeasures to thwart it. If possible, gather as much information about the attacks as you can. If the attacks appear to be part of a larger gambit (other large US companies are being attacked in a identical fashion) then you can assist any investigation into the matter by the appropriate authorities.

(I used to work for a company that had its server hacked to send out spam. We were able to positively identify who did it but the FBI said since 9/11 incidents like that just aren't even on the radar for them.)

Improve this answer
1
  • Thanks, that is helpful. What bugs me is that with the IP addresses of the perpetrators, probably someone with the right kind of access could figure out in 10 minutes where the computer is that initiated the attacks, but actually getting someone to do that or do anything about it seems close to impossible.
    – kirk
    Commented Oct 20, 2011 at 16:30
1

Remove the content in question from public access.

*poof* your problem is solved.

Improve this answer
0

Get a postal address for the large corporation. Try to get a name for some sysadmin person. Send a calm, polite, letter, saying what happened, when it happened, and that you're unhappy. Include short snippets of logs.

OR:

You know what was downloaded. Now you just need to keep web-searching. As soon as it hits a website you can use copyright laws to have the information taken down. Again, if it ends up on some big company's website a short polite email with details could work wonders.

As others have said; it's hard give an answer without any details. What was downloaded? Image files? Databases? Source code?

Improve this answer
1
  • That's a good suggestion (writing the letter etc). In this case we were able to stop them from getting too much data, so web-searching,etc may not be necessary at the moment. I would like to stop them from coming back and trying again though. I did email various people at the corporation, with my weblogs etc, but probably a written letter will help as well.
    – kirk
    Commented Oct 21, 2011 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.