Halliburton's ear is to the ground?

by **Et in Arcadia ego** » Wed Apr 26, 2006 10:35 am

I must be moving up in the world, I scored my own hit: <a href="http://img283.imageshack.us/my.php?image=attackdetection8ri.jpg"><img src="http://=http://img283.imageshack.us/img283/9651/attackdetection8ri.th"/> All I can get from my aquaintance is that they're looking into it. Edited by: <A HREF=http://p216.ezboard.com/brigorousintuition.showUserPublicProfile?gid=etinarcadiaego@rigorousintuition>et in Arcadia ego</A> at: 4/26/06 8:39 am

by **thoughtographer** » Wed Apr 26, 2006 11:07 am

Interesting. Is that the first one you've had? <blockquote>Quote:<hr>OrgAbuseHandle: IAP2-ARIN OrgAbuseName: IP Abuse POC OrgAbusePhone: +1-281-575-3000 OrgAbuseEmail: ipabuse@halliburton.com<hr></blockquote> Maybe make a "legitimate" abuse claim through the "proper" channels, and see how they handle it? "A crooked stick will cast a crooked shadow."

by **Et in Arcadia ego** » Wed Apr 26, 2006 11:17 am

Yeah, that's the first I've seen personally on my own machine. SAP had an amusing comment when I posted the screenshot: "That would be great- Sickle could be an "off the books enforcer of halliburton IT security" At least we have humor..

by **Et in Arcadia ego** » Wed Apr 26, 2006 11:20 am

<blockquote>Quote:<hr>Maybe make a "legitimate" abuse claim through the "proper" channels, and see how they handle it?<hr></blockquote> Just sent an email.

by **Et in Arcadia ego** » Wed Apr 26, 2006 11:27 am

And the reply came back in less than 5 minutes: To Whom It May Concern: Only a small subset of the 34.x.x.x address space you have referenced in your email is published on the internet; therefore any network traffic such as port scanning or unsolicited email from outside the 34.248.0.0/13 range has been spoofed and is not originating from our network. Halliburton is aware of the impact and is against the sending of unsolicited direct marketing emails and takes every measure possible to verify that we are not the source of any unsolicited emails or unauthorized port scanning. If you are seeing unwarranted network traffic to your computer from a 34.x.x.x address the ip header information has been modified to display an incorrect address and is not originating from our network. We apologize for the inconvenience and understand the frustration involved in these types of annoyances, but currently we are unable to assist any further in locating the origin of the email or network traffic that you are reporting. To learn more here is a link to an anti-spam site <a href="http://spam.abuse.net">spam.abuse.net</a> <<a href="http://spam.abuse.net/>">spam.abuse.net/></a> To learn more about port scanning see <a href="http://www.cs.wright.edu/~pmateti/Courses/499/Probing/">www.cs.wright.edu/~pmatet...9/Probing/</a> To learn more about IP Spoofing see <<a href="http://www.securityfocus.com/infocus/1674>">www.securityfocus.com/infocus/1674></a> <a href="http://www.securityfocus.com/infocus/1674">www.securityfocus.com/infocus/1674</a> UPDATE 4-1-2006: If your email referenced the ip address 34.168.1.34 this address is not active on our network and the packet header has been modified to hide the true identity of the originating source. We have collected a large amount of data pertaining to this traffic and contacted law enforcement officials to pursue the responsible parties. If you wish to take further precautions we recommend blocking traffic outside the 34.248.0.0/13 subnet of the 34.0.0.0/8 network using your firewall or other tools. HALLIBURTON Internet Traffic Task Force Houston, TX 77042-3021 ipabuse@halliburton.com

by **thoughtographer** » Wed Apr 26, 2006 11:41 am

Given the number of complaints I've seen regarding that specific address so far, it doesn't surprise me that they have a canned response prepared for these reports. Someone who's a repeated target should capture the packets and publish the information for public analysis. Or, maybe a honeypot machine could be set up. "A crooked stick will cast a crooked shadow."

by **Et in Arcadia ego** » Wed Apr 26, 2006 12:44 pm

How does one go about capturing the packets? Also, note the date of the update part of the email: 4-1-2006. Apparently, this has been going on for some time before that date.. Edited by: <A HREF=http://p216.ezboard.com/brigorousintuition.showUserPublicProfile?gid=etinarcadiaego@rigorousintuition>et in Arcadia ego</A> at: 4/26/06 10:45 am

by **thoughtographer** » Wed Apr 26, 2006 1:09 pm

<blockquote>Quote:<hr>How does one go about capturing the packets?<hr></blockquote> What platform are you using? For Windows, <a href="http://www.winpcap.org/">WinPcap</a> will get the job done -- <a href="http://www.ethereal.com/">Ethereal</a> is also quite popular. If you're using Linux, a BSD derivative or some other UNIX variant, you probably wouldn't be asking, but the tools are many and varied -- some usually being packaged with the OS. <blockquote>Quote:<hr>Also, note the date of the update part of the email: 4-1-2006. Apparently, this has been going on for some time before that date..<hr></blockquote> Yeah, I did notice that. April Fool's! Someone must have started early. In a way, if this is similar in intention to the "pointing at poindexter" efforts starting in 2002, I'd almost like to see it continue as long as it's just knocking on people's door and not actually intruding and causing damage. If the intent is malicious, then it's reprehensible on many levels, regardless of the source. "A crooked stick will cast a crooked shadow."

by **Et in Arcadia ego** » Wed Apr 26, 2006 1:19 pm

I'm on windoze. Will those apps do their job from behind my firewall, or.. I don't know jack about doing this kind of stuff, tbh.

by **thoughtographer** » Wed Apr 26, 2006 8:11 pm

The short answer is "yes", you can use these from behind your firewall but of course, the specifics of the issue is where the problems come up. Worst case would be that you'd have to redirect the targeted ports to point at the machine running the capture application. I'd be willing to help if you could give me some specifics -- I may be able to walk you through if you need help. The problem is, that you'd need to capture a large amount of packets in order to get a hit, which is why it would be more fruitful to set up a honeypot machine to provoke the attack and capture the attack to study it. The headers and payload (if any) of any packets coming from the suspect IP could then be examined at your leisure, or offered for other users for public examination. I don't linger in the communities who do this type of thing, so I wouldn't really no where to start, but I've been thinking about this sort of thing lately. I would suspect that not many people (present comany account for, of course) consider the parapolitical implications of spurious network activity like this. "A crooked stick will cast a crooked shadow."Edited by: <A HREF=http://p216.ezboard.com/brigorousintuition.showUserPublicProfile?gid=thoughtographer>thoughtographer</A> at: 4/26/06 6:43 pm

Halliburton's ear is to the ground?

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Re: Halliburton's ear is to the ground

Who is online