Microsoft Windows XP Home Edition - Zenk - Security - Repository

Responding to an Attack
Microsoft Windows XP Home Edition
Security Implementation
Version 1.4b Option 1
Based on the information that you have gathered from your firewall log and you
have determined that you have been attacked, there are a couple of options that
you have in responding to the attack. You will want to notify your Internet
Service Provider (ISP). Provide them with all the details of the attack as you
know them (who, what, where, when, and how). If you don't want to contact your
ISP then you can contact Dshield.org
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
15 (http://www.dshield.org). Dshield.org is
an organization that tracks reports of intrusions. You need to submit them all the
information that you have concerning this attack. You will also need to send
them your log showing that the attack occurred. They will analyze the reports
that you submit and depending on the results that may contact the user's
(attackers) ISP. If none of these seem like options you can go to the NIPC web
site (www.nipc.gov/incident/incident.htm) 16 . NIPC (National Infrastructure
Protection Center) is a division of the FBI. This site provides you with information
on how to handle the attack. They have documents covering how to protect
evidence, and how to help Federal, State, and Local Law Enforcement Agencies
investigate the incident.
There are some general recommendations that you should follow. The first is to
respond quickly. The longer you wait to report an incident the more difficult it can
become to trace the attack. You should not stop any system processes or
tamper with files. You may inadvertently destroy evidence on how the attack
happened or who initiated the attack. You should use your telephone for all
communications. If you have been attacked there is a chance that your e-mail
has been compromised. By using e-mail you could have all your e-mails logged
by the attacker or spread the attack to other computers and users. You will want
to make copies of all the files that an intruder may have altered or left. This will
help investigators determine how, when, and who initiated the attack. You
should never contact the attacker yourself. You do not want to let them know
that you know who they are. You could place yourself and your family in danger
by contacting the intruder.
© SANS Institute 2003, Author retains full rights
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
15 Dshield.org, Euclidian Consulting, http://www.dshield.org
16 National Infrastructure Protection Center, Division of FBI, http://www.nipc.gov/incident/incident.htm
Page 22 of 53
© SANS Institute 2003, As part of the Information Security Reading Room. Author retains full rights.