Jump to content

No more access to Forum at work due to hacker


popbumper

Recommended Posts

All:

Sitting here at home on my lunch hour (fortunately close to work). Noticed this week I could not get on the Klipsch site, so I spoke to our Sys Admin this AM.

Apparently last Thursday, there was a hacker attack made on our work server through the Klipsch server, so he has blocked the site. I am SOOO disappointed that I cannot get out here during the day anymore, this SUCKS. Figures, after ramping up the crossovers and what not. All because of some dam* hack who gets jollies out of messing with other people's computers....moron.

At any rate, I will still post in the mornings/evenings as I can, and will still get emails for responses to my posts, though I will be blind to who sent them.

Chris

Link to comment
Share on other sites

That sounds fishey to me a hack attempt from the klipsch site. Has klipsch sysadmins admitted to this? Does your sysadmin like you? Does he have logs to backup his claims? Perhaps he is just blocking high traffic non work related sites as I have seen sysadmins do this before.

Can you use a proxy server to get around this?

Link to comment
Share on other sites

Seti:

I asked my admin what happened, and whether he had logs, as I was concerned and needed to inform Klipsch. Here is what I got back from him - keep in mind I am VERY "uninformed" about network language...

HE SAID:

Sorry, that was before the ISA server upgrade I did on Friday, those logs were deleted when the upgrade happened. Just trying to recall from memory it happened at night around 4-5am, either Monday or Tuesday of last week. I think it involved an all-port scan and a known port scan. It came from the forums.klipsch.com IP address (207.67.68.51), I went ahead and blocked all three that resolve to that (.50,.51,.52). Currently on the firewall I have 10 blocks coming from .51 and 140 coming from .50. None from .52

SOOO....what do I do? Does that sound legit or is it doublespeak? Do I need to ask Klipsch? Do I need Klipsch to assure him everything is OK? I REALLY want to "get back on".....

Chris

Link to comment
Share on other sites

----------------

On 2/23/2005 11:17:53 PM popbumper wrote:

Seti:

I asked my admin what happened, and whether he had logs, as I was concerned and needed to inform Klipsch. Here is what I got back from him - keep in mind I am VERY "uninformed" about network language...

HE SAID:

Sorry, that was before the ISA server upgrade I did on Friday, those logs were deleted when the upgrade happened. Just trying to recall from memory it happened at night around 4-5am, either Monday or Tuesday of last week. I think it involved an all-port scan and a known port scan. It came from the forums.klipsch.com IP address (207.67.68.51), I went ahead and blocked all three that resolve to that (.50,.51,.52). Currently on the firewall I have 10 blocks coming from .51 and 140 coming from .50. None from .52

SOOO....what do I do? Does that sound legit or is it doublespeak? Do I need to ask Klipsch? Do I need Klipsch to assure him everything is OK? I REALLY want to "get back on".....

Chris

----------------

Well without the logs so goes the proof and it is his network and he can do with it what he wants. I would try to find a good free proxy server and see if that works. I haven't used one in ages but it could work for you. Getting a network admin to unblock something is unlikedly especially if he is paranoid. I may have done the same thing in his place IF the traffic actually happened like he said but can't do much without proof.. ah well sorry..

Link to comment
Share on other sites

207.67.68.51 resolves to klipschdev.com, probably a development server or test box. sometimes these these are not as carefully maintained as prod stuff and get hacked.

207.67.68.50 resolves to www.klipsch.com, likely their main prod address.

207.67.68.52 oddly resolves to 207-67-68-52.klipsch.com, which is sort of a funny name for a server, it may actually be a router that directs traffic to various servers inside the klipsch domain or something.

this BBS is forums.klipsch.com (note that there's no www. in front), it resolves to the klipschdev.com address mentioned first above: 207.67.68.51.

There's really not much motivation for an admin to manually block an address unless he did find something bad in his logs. Somebody probably figured a way to bounce a scan off klipschdev or this guy is PO'd at you. Possibly his mgmt told him to block the top ten outside non-business addresses, they do things like that sometimes.

Those sites you can hit and then bounce to your real destination are called anonymizers and routinely blocked by corporate proxies and firewalls. Also, they normally have a non-trivial monthly fee for the privilege.

Link to comment
Share on other sites

I AM BACK ON! I had my IT guy work with Klipsch IT and they are checking things out, so I am able to get on the Forum again from work. Glad I can be on here during the day again, just don't expect me to spend a lot of time...9.gif

Chris

Link to comment
Share on other sites

Tom:

I did not expect this either, and am quite relieved - I promised to "behave myself" (since I was told all internet usage is being logged, hint,hint).

DMAN: Work? What's your definition? I am still shopping for one...;>).

Thanks guys!

Chris

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...