This is what I have to deal with

Post by **NightStorm** » Wed Sep 13, 2006 7:57 pm

This is my day. A report comes in that we are attacking other sites SSH ports... entertainingly enough, this was supposedly taking place at the same time that Greg was attacking our SSH port... clearly showing the outgoing to not be an attack, but a response to a connection attempt (the outgoing would be the \"Connection Actively refused\"). Anyone with a brain would be able to look at the incoming attack, and piece it together with the outgoing. But not our brainiacs at Ev1 Abuse Team... oh no, they want root access to the server so that they can investigate. But not JUST root access... they want root access, AND they want me to add a bypass into the firewall that allows 353 IP addresses free reign on our server while they \"investigate\".
So, against better judgement, I set the bypass, and send them the root login details. Several hours later, they reply that we have been compromised, as there are files inside the /tmp folder that have the word \"dos\" in their names. Anyone who is actually TRAINED with abuse and spends any time on their own forum would know that these are legitimate files created by mod_evasive to prevent sending a mail flood during any form of httpd attack. But again, we\'re dealing with Brainiacs here... and they gave 24 hours to \"secure our server or face termination of service\".
I replied, quite clearly, what the files were, and even posted them the server logs that link the IPs to the file creations, and google links showing them how they were created, and directed them to their own support forum for further verification.
Their response?
Thanks for securing your server and dealing with this compromise. Ticket closed.

WHAT THE <img src=\'http://www.killanet.net/forum3/public/s ... nsored.gif\' class=\'bbc_emoticon\' alt=\'(cens)\' />??? WHAT BLOODY COMPROMISE???

This is the \"New Everyone\'s Internet\". The merger has taken any professionalism that was left with this company, and kicked it out the door with Mario and Robert Marsh.

I am seriously considering how to proceed with this... topics on their forum? Reopening the ticket again and asking for clarification on what <img src=\'http://www.killanet.net/forum3/public/s ... nsored.gif\' class=\'bbc_emoticon\' alt=\'(cens)\' /> compromise they are talking about, as the only proof they have are files created by an httpd mod used to secure the server?

I\'m fuming... I wasted my afternoon, and my one chance to sleep, on this <img src=\'http://www.killanet.net/forum3/public/s ... nsored.gif\' class=\'bbc_emoticon\' alt=\'(cens)\' />, and they refuse to even say that they ****** it up.

[attachment=2491]attachment[/attachment]

Josh · Post by **Josh** » Wed Sep 13, 2006 8:37 pm

<img src=\'http://www.killanet.net/forum3/public/s ... /blink.gif\' class=\'bbc_emoticon\' alt=\':blink:\' /> They\'re not smart....

Post by **Tami** » Wed Sep 13, 2006 9:01 pm

As I said to you this morning, they are definitely not the brightest group, are they?

Post by **NightStorm** » Thu Sep 14, 2006 10:41 am

Looks like I got some one\'s attention.

I apologize for the way this issue was handled, I will be looking into this in the morning.

Jeff Lowenberg
VP-Operations
__________________
Jeff Lowenberg
VP-Operations
EV1Servers.net/The Planet

Was sent to me, in regards to my post at http://forums.ev1servers.net/showthread.php?t=63545

*Edit* I have received replies.

Thanks for the info....

Obviously we made a mistake. Your server was the recipient of a spoofed attack and was replying to the spoofed ips. The owner of those IP’s The U.S. Treasury Dept. complained. We are revising our procedures to put a few more checks in place to make sure that we don\'t misinterpret what is going on and wrongly accuse you or any of our other valued customers of something that you are not doing.

I apologize for our error and the inconvenience this has caused you. If I can be of further assistance to you now or in the future please let me know.

Jeff Lowenberg
VP-Operations
EV1Servers/The Planet

NightStorm,
First let me apologize for the inconvenience that this issue caused for you. Second let me apologize deeply for our mistake, regarding this. As Jeff said we are working to revise our policy so that we do not make this mistake again. Again please accept my apologies, and know that we are always working to make our policies better for all of our customers.

Regards
Chris Newcomb
Abuse Department Manager
chrisn@ev1servers.net

I have replied to them both, trying to be as kind as possible for someone as tweaked as I am with the entire situation. In closing, this will simply be one more thing to add onto Greg\'s growing list for Brian.

Post by **Tami** » Thu Sep 14, 2006 2:57 pm

Should\'ve told them it\'s amusing that the US Treasury was complaining about us attacking them while we were in the middle of being attacked by the Army, the National Guard, and basically the rest of the Dept. of Defence.

us3rX · Post by **us3rX** » Fri Sep 15, 2006 5:33 am

*starts singing \"blame canada\" song* ^.^ lmao

suprised the VP emailed ya <img src=\'http://www.killanet.net/forum3/public/s ... >/blum.gif\' class=\'bbc_emoticon\' alt=\':P\' /> from reading your posts on the ev1 forum, ev1 needs to work alot on the \"abuse\" stuff >.>

us3rX <img src=\'http://www.killanet.net/forum3/public/s ... /ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' />