RE: Blocking hack attempts from foreign countries...

["Murda Mcloud" <murdamcloud () bigpond com>]

I don't see why it would be inconceivable for NASA(or part thereof) to block
domain space for a country-whether or not that country had a "thriving
economy" or a "huge space program". Certain eastern European countries have
neither of these and I'm sure companies and organizations often find
themselves having to decide whether to take similar action against them just
as people have done against other countries at one time or another.

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Alex Alexiou
Sent: Thursday, September 20, 2007 3:48 AM
To: security-basics () securityfocus com
Subject: RE: Blocking hack attempts from foreign countries...

Actually, he's (mostly) right. Back in 2000, the Jet Propulsion Laboratory
at NASA blocked all Brazilian traffic for several days due to attacks:

http://news.zdnet.co.uk/internet/0,1000000097,2077735,00.htm
http://edition.cnn.com/2000/TECH/computing/03/17/brazil.nasa.hackers/index.h
tml 



-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Jay
Sent: Wednesday, September 19, 2007 12:05 PM
To: fabio.fagundes () gmail com; security-basics () securityfocus com
Subject: Re: Blocking hack attempts from foreign countries...

Yeah, Im sure Nasa blocked all Brazillian domain space. With Brazils
thriving economy and huge space program I would see why Nasa would be of
interest.

Go back to the beach and your umbrella drink and stop spreading rumors.

Jay
----- Original Message -----
From: Fabio Fagundes [mailto:fabio.fagundes () gmail com]
To: security-basics () securityfocus com
Sent: Wed, 19 Sep 2007 10:55:20 -0300
Subject: Re: Blocking hack attempts from foreign countries...

Dan,

A few years ago, all Brazilian IP Address Blocks got blocked by NASA
(nasa.gov).

NASA claimed that they were getting to much hacking attempts and defacements
originating from Brazil.

One should be careful while blocking ip addresses blocks (sometimes full A
and B classes) because they may be blocking legitimate users too.

And you?re right, try to contact the abuse and s/cirt account!!

Regards,
Fabio.
Rio de Janeiro - Brazil

On 9/16/07, p1g <killfactory () gmail com> wrote:
> Dan,
>
> I will contact the abuse or s/cirt account the Net owner(whois).
>
> 90% of the time you will get a response. I normally do not include any 
> trace files or log snippets in the initial email.
>
> They will ask for them if they plan to pursue.
>
> Either way, I personnally think you should do all you can and 
> especially DOCUMENT what you do in response to any successful or some 
> unsuccessful attempts on your network.