How the Chicom got my IP address???

How the Chicom got my IP address???
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
How the Chicom got my IP address??? Lito Lipad 06-05-2008
Posted by on June 8, 2008, 11:14 am
If you were  Registered and logged in, you could reply and use other advanced thread options
ibuprofin@painkiller.example.tld (Moe Trin) writes:

> If you don't want people from country $FOO attempting to connect to your
> system, WHY ARE YOU ALLOWING CONNECTIONS FROM THAT BLOCK OF ADDRESSES?
> Do you someday plan on visiting Jilin province (the Chinese "state"
> just North of Korea), and will need to connect to your system from
> there? Until you do, block 222.168.0.0/15. . . . . . .

[...]

Sorry to butt in here...

Moes' advice is good and I've been meaning to do something like that
but I wondered if anyone in this thread has a URL for a site that
shows what address blocks go to what country.

Googling with things like:

ip address by country chart -lookup

Even nixing `lookup' I still get dozens of hits that are really
nothing more than single IP lookup tools.

I know I've seen large charts showing large blocks of IP addresses
assigned to various countries somewhere on line.

Posted by Doug McIntyre on June 8, 2008, 4:49 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
reader@newsguy.com writes:
>ibuprofin@painkiller.example.tld (Moe Trin) writes:

>> If you don't want people from country $FOO attempting to connect to your
>> system, WHY ARE YOU ALLOWING CONNECTIONS FROM THAT BLOCK OF ADDRESSES?
>> Do you someday plan on visiting Jilin province (the Chinese "state"
>> just North of Korea), and will need to connect to your system from
>> there? Until you do, block 222.168.0.0/15. . . . . . .

>[...]

>Sorry to butt in here...

>Moes' advice is good and I've been meaning to do something like that
>but I wondered if anyone in this thread has a URL for a site that
>shows what address blocks go to what country.


Go to the source, www.iana.org.

But, why stop at just blocking foreign countries to wherever you are?
(I'm assuming the US).

Percentage of hacked botnetwork machines ranks the US as #2 or #3 in
the world for hack attempts.

Don't let any connection in that you aren't ready to vet for yourself.



Posted by on June 10, 2008, 10:20 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> reader@newsguy.com writes:
>>ibuprofin@painkiller.example.tld (Moe Trin) writes:
>
>>> If you don't want people from country $FOO attempting to connect to your
>>> system, WHY ARE YOU ALLOWING CONNECTIONS FROM THAT BLOCK OF ADDRESSES?
>>> Do you someday plan on visiting Jilin province (the Chinese "state"
>>> just North of Korea), and will need to connect to your system from
>>> there? Until you do, block 222.168.0.0/15. . . . . . .
>
>>[...]
>
>>Sorry to butt in here...
>
>>Moes' advice is good and I've been meaning to do something like that
>>but I wondered if anyone in this thread has a URL for a site that
>>shows what address blocks go to what country.
>
>
> Go to the source, www.iana.org.

Thanks... I guess you've seen some sort of chart like I described
there somewhere....

After digging around there (admittedly somewhat blindly) I'm not
finding such a chart.

> But, why stop at just blocking foreign countries to wherever you are?
> (I'm assuming the US).
>
> Percentage of hacked botnetwork machines ranks the US as #2 or #3 in
> the world for hack attempts.
>
> Don't let any connection in that you aren't ready to vet for yourself.

Can you run this by me again. This phraseology went right over my
head.

What are you saying there?

Posted by Doug McIntyre on June 10, 2008, 12:01 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
reader@newsguy.com writes:
>> Go to the source, www.iana.org.

>Thanks... I guess you've seen some sort of chart like I described
>there somewhere....

http://www.iana.org/assignments/ipv4-address-space


>> But, why stop at just blocking foreign countries to wherever you are?
>> (I'm assuming the US).
>>
>> Percentage of hacked botnetwork machines ranks the US as #2 or #3 in
>> the world for hack attempts.
>>
>> Don't let any connection in that you aren't ready to vet for yourself.

>Can you run this by me again. This phraseology went right over my
>head.

>What are you saying there?

If you are blocking IP addresses that are in other countries as
hackers, you are only blocking a small part of the problem. Out of #
of hack attempts recorded, US based IP addresses account #2 or #3 for
all attacks on measured honeynets.

If you don't want any hack attempts, block all IPs besides your own.





Posted by on June 11, 2008, 2:15 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> I guess you won't hear from him, I wouldn't if I got such a response ..
>
> Not sure why I bother, but have you ever heard of black- and
> whitelisting? Doug tried to explain you're (probably) trying to use
> blacklisting by denying specific IP's (or block of IP's). That will
> leave a wide range of IP's still being able to connect to your IP and
> isn't therefor "secure" (or wise).
>
> Whitelisting is better, you deny every IP and whitelist the IP('s) (or,
> again, block of IP('s)) you want so they are allowed to connect to you,
> so you won't get hit by those scripts anymore (unless one or several if
> your whitelisted IP('s) got infected).

I may need to apolagize to Doug, and will shortly...
Put first I'll apologize to the group for the line noise

I should have known not to open my mouth when butting into a thread
half way through and possibly not understanding most of it.

My issue (concerning blocking) was not really hack related. I should have
said as much. I get thousands of hits of chinese origin on ports
102[6-9]. Just keeps on coming. I doubt they are hack
attemtps.. more like misconfigured machines.

I was thinking of blocking the Chinese domains since the chances of me
getting a legitimate connection from china are very slim.

Similar ThreadsPosted
Use How to use the SAME Key for another eMail address ? September 22, 2005, 7:31 am
ARP requests for IP address 0.0.0.0 January 19, 2007, 3:27 pm
Packaging for MAC address ? April 9, 2007, 10:00 am
IP address on my volume control November 13, 2004, 9:56 pm
How reliable is locking MAC address for Wi-Fi router? December 2, 2004, 1:00 pm
google groups shows everyone your ip address? January 6, 2006, 6:53 pm
SMAC 2.0 is released! MAC Address Spoofer May 18, 2006, 9:42 pm

The site map in XML format XML site map

Contact Us | Privacy Policy