Re: Port 18593 attacks

Sandy said that she notifies the other ISP's who have customers who are=20
doing port scanning and other suspicious activity, but most of the ISPs=20
don't do anything about it.  They don't want to lose a customer or have=20
negative rumors around.  Cox tries to miminize virus infections by=20
shutting down a customer's service if they have a virus, spamming, or is=20
port scanning.  Some of the customers call in wanting to find out why=20
their service isn't working, tech support staff are never informed as to=20
the reason why a person's internet service is shutdown, but the security=20
staff won't reconnect the customer until they have been warned and / or=20
get their computer cleaned up.

I wish that more could be done to help you, but changing the nic or=20
exchanging out the firewall is about the only thing that can be done.=20
Another nic would be the quickest way to get a different ip address.  I=20
have access another frazier wall computer if you want to switch out for=20
a while.

Sometimes removing the HSI provisioning and adding it back again will=20
force a different ip address, but it doesn't always work.  I have talked=20
with several customers who didn't have a firewall and their computer was=20
compromised, sometimes while we were on the phone trying to get the=20
computer connected to the internet, many times the customer is angry=20
with us in tech support because they think that cox should do more to=20
prevent these kinds of attacks.  There is only so much that the techs=20
can do.  I am very limited on what kind of suggestions that I can make.=20
  ~Anne

bbales wrote:
> Anne,
> Sorry I didn't answer your email.  I did do as you suggested and sent a=
=20
> 59KByte message to [email protected]  I got their answer just a few minute=
s ago. =20
> Their answer was basically, "None of the messages originated from cox.n=
et so=20
> we can't help." =20
>=20
> Yes your help was valued.  Thank you.  Sorry I didn't say so earlier, b=
ut I=20
> had several things to try and neglected to report on all of them.  By t=
he=20
> way, nothing has changed.
> bruce
>=20
> On Tuesday 03 August 2004 20:56, you wrote:
>=20
>>Let me remind you....I am telling the group what the Security person at
>>Cox said to do...it isn't my idea...do whatever you want with the
>>information.  I was just trying to help and apparently my help isn't
>>valued.  ~Anne
>>
>>Jonathan Hall wrote:
>>
>>>>Sandy asked if you were able to determine who is port scanning you or
>>>>what isp they are using.  If it is one of cox's customers, then she
>>>>needs to find out and cox will go after them, suspending their servic=
e
>>>
>>>Well he pasted several IPs.  It should be easy for anyone at Cox (or
>>>anywhere at all, for that matter) to determine if they are Cox custome=
rs.
>>>
>>>I looked up just a few here:
>>>
>>>24.167.87.199    cs2416787-199.houston.rr.com
>>>24.167.68.48    cs2416768-48.houston.rr.com
>>>68.113.250.214    c68.113.250.214.ona.wi.charter.com
>>>68.47.163.14    pcp01626435pcs.westk01.tn.comcast.net
>>>
>>>A superficial observation suggests that these four IPs are from Texas,
>>>Texas, Wisconsin, and Tennesee, respectively, and are not customers of
>>>Cox.
>>>
>>>
>>>>send them to [email protected]  Apparently asking people to be nice on t=
he
>>>>internet doesn't work, going after them legally (if enough evidence c=
an
>>>>be gathered and presented in court) is going to be the only way to st=
op
>>>>the deviant computer users.  ~Anne
>>>
>>>That's assuming these ARE deviant computer users.  A more likely
>>>explanation is generally a virus/trojan-infected computer, as I sugges=
ted
>>>in an earlier e-mail.
>>>
>>>-- Jonathan
>>>
>>>-- This is the [email protected] list.  To unsubscribe,
>>>visit http://www.complete.org/cgi-bin/listargate-aclug.cgi
>>
>>-- This is the [email protected] list.  To unsubscribe,
>>visit http://www.complete.org/cgi-bin/listargate-aclug.cgi
>=20
>=20
> -- This is the [email protected] list.  To unsubscribe,
> visit http://www.complete.org/cgi-bin/listargate-aclug.cgi
>=20
>=20
-- This is the [email protected] list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi