RE: Honeypot article

[Tom McLaughlin <tmclaugh () sdf lonestar org>]

> From http://www.geocities.com/shellmaniac/su.c:

/* su.c by xp, modified by logikal@efnet - tested on redhat 5 -> 7 */

Has anyone gone beyond looking at technical clues in investigating and
looked at "social" means of doing it?  Take the nick from IRC in the
above code comment.  Look for their presence online.  We don't know how
that nick is connected to what happened if at all, but it does give us a
starting point.  Find their channels, see who comes and goes, look at
what they talk about.  Wait for a script kiddie to boast or find
possibly where else one could look for the intruder...  Hackers have
decent social networks.  Damn I wish I could remember the link to the
article I read recently mentioning hacker social structure. 

Police don't rely on forensics alone and IRC did help catch Mafia Boy.
Just a thought...  I was a liberal arts major.  :)

Tom

-- 
Mandrake Cooker + Honeypot = http://cookerpot.linsec.ca



On Wed, 2003-01-15 at 17:15, Spikeman wrote:
> added google search bonus. (search string, xeocage123)
>
> http://eridex.org/journal-archive/000035.html
> http://www.geocities.com/shellmaniac/
<snip>
>