Re: Rooted boxen and the law

[Dalvenjah FoxFire <dalvenjah () DAL NET>]

I should've included a disclaimer with that; I don't speak for the FBI or
anyone but myself; the below is what I've gotten from experience. None
of this is guaranteed, take it with a grain of salt, etc. etc. etc. Call
it a "Best Practices" as far as I know. }:>

-dalvenjah

On Tue, Jun 05, 2001 at 09:54:00AM -0700, Dalvenjah FoxFire put this into my mailbox:
> Log what you can, including what software if any you found placed on the box,
> what was done/modified, and where the cracker(s) came in from if you can
> find that (as well as how they got in); keep a record of time spent and
> itemize the costs required to recover. Take this report (it doesn't have
> to be anything fancy, just something that's legible and easy-to-read),
> and send it to your local FBI office. If you can, put any software or
> binaries (or other items) deposited on the machine by a cracker on a CD
> and include that. Keep in mind you want to modify as little as possible
> while you do this; mount the disk read-only if you can and remove it
> from the network. If you really want to get technical, SANS.org or
> someplace probably has more detailed forensics tips.
>
> Basically, do as much computer forensics as you can, include estimates of
> monetary damages (be realistic), and pass along what you can to the feds.
> Chances are you won't get anything back from it personally, but the FBI
> might be able to use your info to link back to some other case they're
> working on, and it'll be that much more evidence against a person
> they're already tracking when it comes time to press charges. If you
> don't have time, oh well, but I'm sure the FBI will appreciate any
> information you can get them.
>
> If you really have time, see if your local field agent(s) want to review
> the machine personally; though chances are they're not going to insist
> that you leave the machine with them for months or anything like that.
>
> You may be able to report the case to the police as well, but unless
> you're heavily interested in pressing charges, chances are it'll just
> be filed and reported up the ladder to the feds anyhow.
>
> -dalvenjah
> -- 
>  Dalvenjah FoxFire (aka Sven Nielsen)  I'd like mornings better if they
>  Founder, the DALnet IRC Network       started later.
>  
>  e-mail: dalvenjah () dal net             WWW: http://www.dal.net/~dalvenjah/
>  whois: SN90                           Try DALnet! http://www.dal.net/

-- 
 Dalvenjah FoxFire (aka Sven Nielsen) "Thy wit is as quick as the greyhound's
 Founder, the DALnet IRC Network       mouth - it catches."
 
 e-mail: dalvenjah () dal net             WWW: http://www.dal.net/~dalvenjah/
 whois: SN90                           Try DALnet! http://www.dal.net/