Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
Accused of Filesharing
-
28-09-2009 6:02pm#1
Comments
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
-
-
-
-
-
Advertisement
-
-
-
-
-
Did a full search and used Handy Recovery - no signs of any music, Lil' Wayne or otherwise!Yeh but you don't know if someone cleverer than you is using your PC remotely so you still need to check.Also I can't see how anyone could spoof your MAC address if they are on the same network as you. I won't go into detail but it would confuse your network and cause connectivity issues at the very least, thats why they are unique. I could spoof your MAC address and there would be no issue as I wouldn't be going through a swtich or router anywhere near you but if I was on the same network routing would get messed up as would any swtich seeing the same MAC address on two ethernet ports- my understanding anyway.
What if my computer had timed out, and then the spoofer connected once he saw it leave the network?You don't connect on a wireless network do you?
I do. There are two computer at my workspace; one is connected by an ethernet cable and one by wireless. The one with the wireless connection was identified.btw I do believe you but I've been in similar situations with email (used to work for a company that sold a forensics logging program) and found some very strange goings on
Heh heh - I can only imagine!
0 -
-
-
-
Also if I had to pick people in an office who might be filesharing via bittorrent I'm afraid I'd pick the IT department workers every time. Joe Soap office worker doesn't have a clue.
Also your IT department blows goats if they actually allow bittorrent in their network, it is designed to use up all available bandwidth. There may be legitimate reasons to use bittorrent but it shouldn't be free reign for an entire office to each download the latest ubuntu image for example.
Can't disagree with that, so lets make up a conspirecy theory to go with it.
Someone in IT is or was downloading stuff using BitTorrent, the **** hits the fan when the letter from the RIAA arrives so they find BitTorrent on your PC and point the finger at you.
It could be that you were always blocked as a normal user from using BitTorrent but the IT guys added there own rules to the firewall just so you they could use it themselves - hmmmmm now who do I know who has done that
0 -
Advertisement
-
Can't disagree with that, so lets make up a conspirecy theory to go with it.
Someone in IT is or was downloading stuff using BitTorrent, the **** hits the fan when the letter from the RIAA arrives so they find BitTorrent on your PC and point the finger at you.
It could be that you were always blocked as a normal user from using BitTorrent but the IT guys added there own rules to the firewall just so you they could use it themselves - hmmmmm now who do I know who has done that
I think you just blew my mind - this could go all the way up to the president! 0 -
-
-
-
-
Cuddlesworth wrote: »Ahh nothing beats nerd arguments. You want to check with two scoops if he did the above?
Sorry not with you on this? What would two scoops do?Cuddlesworth wrote: »Personally I don't think it would work, as any torrent-tracker would see the lack of upload and cut you off.
Wouldn't that be as good as blocking? Again not sure what you mean?
I have an ISA server on my home network to keep my hand in just in case I ever get back to work in IT. I tested blocking MSN and Yahoo Messanger from the these signatures a while back and that seemed to work OK so I suspect the others can be blocked up to a point.
As far as nerd arguments go can we agree that you can block anything UNTILL someone finds away round it . If I found that I could block BitTorrent I would never say that BitTorrent would never work as someone will always find away around it, as long as the app doesn't work from a std install job done, most non technical users will give up. Don't give the average joe a chance to mess your network up and then chase down the few that have the knowhow.
Next line of defence has to be network monitoring, at the most basic level you can get software to parse the network logs that give fancy graphs for managment that show what users are doing. I've just created some reports from my ISA server and I can see what internal IP address has downloaded the most data (me;)) what messenger progs are in use, MSN, Xfire and which are the top ten most visited websites and that my son still spends most of his time online playing NWN etc etc. Nothing I didn't expect in the logs but if there was I could then monitor for specific traffic to see whats going on.
There are so many logs and alerting systems on a basic Windows Domain that its difficult to do anything without it being logged somewhere; not that many seem to know where to look or bother setting up alerts as they can be annoying. As an example if you think someone is downloading loads of pr0n then check the cached DNS lookups on your DNS server to see the domains that are being visited (only allow users to use the companies DNS server) then you can see exactly what sites users are connecting to (mess with their heads by adding your own DNS settings if you must) next do a bit of network monitoring so you can see what internal IP address is connecting to the specific IP addresses you don't want visiting.
I'm just making the point that its the network admins job to lock down the network (sorry users) and then monitor it so in the OP's case the IT dept should have known what was going on before the RIAA letter. I wouldn't be supprised if they got a doing over for allowing this to happen so if they found a scapegoat they aren't going to be providing logs to prove otherwise.
In some cases the IT department will have a setup that logs everything on the Windows domain but not what goes on between the bells and whistles domain firewall and the actual hardware internet connection. This is also a handy spot to leave a network connection to plug in a PC for trouble shooting and testing so the IT guys can then have an unmonitored system connected to the internet, bit of a tempation not to use it
The OP might also like to check company policy and anything he signed about internet use as there is always the chance its out of date and created long ago with no mention of p2p, file sharing or uploading files.
I've been thinking about this..Cuddlesworth wrote:You would have noticed this if you were only working on the machine at the time.
.... and trying to work out the various connection senarios, good mental ARP and DHCP brush up and sorry to get nerdy but I think the hacker would really have to be just tooo darn clever. If he used a DHCP address then he'd get the same IP address as your PC which would leave a msg on your screen saying that there is another computer with the same IP address, so the hacker would have to provide his own IP settings, then if he uses the internet at the same time as the OP my best guess is the internet would slow down and become virtually unuseable.0 -
Advertisement
-
Sorry not with you on this? What would two scoops do?
I was joking saying the odds of him actually manipulating the firewall are slim.Wouldn't that be as good as blocking? Again not sure what you mean?
No it wouldn't. Your assuming you can block every program without a huge amount of time and effort spent finding and researching all the new versions and types of possible connections. The simple and effective solution is to block everything and allow access as they come along, rather then allow everything and desperately monitor and block as you see or know of them.I have an ISA server on my home network to keep my hand in just in case I ever get back to work in IT. I tested blocking MSN and Yahoo Messanger from the these signatures a while back and that seemed to work OK so I suspect the others can be blocked up to a point.
I haven't had the time or opportunity to play with a ISA server yet, its on my list of things to do. Sounds like fun though.As far as nerd arguments go can we agree that you can block anything UNTILL someone finds away round it . If I found that I could block BitTorrent I would never say that BitTorrent would never work as someone will always find away around it, as long as the app doesn't work from a std install job done, most non technical users will give up. Don't give the average joe a chance to mess your network up and then chase down the few that have the knowhow.
Exactly, the far more easy option of the two.Next line of defence has to be network monitoring, at the most basic level you can get software to parse the network logs that give fancy graphs for managment that show what users are doing. I've just created some reports from my ISA server and I can see what internal IP address has downloaded the most data (me;)) what messenger progs are in use, MSN, Xfire and which are the top ten most visited websites and that my son still spends most of his time online playing NWN etc etc. Nothing I didn't expect in the logs but if there was I could then monitor for specific traffic to see whats going on.
Depending on the size of the company that could become quite difficult. At over two thousand people here on machines I know quite well that nobody monitors the network. Its next to impossible. We block all external network access outside of port 80, and internal is limited to needed ports.
[/QUOTE]There are so many logs and alerting systems on a basic Windows Domain that its difficult to do anything without it being logged somewhere; not that many seem to know where to look or bother setting up alerts as they can be annoying. As an example if you think someone is downloading loads of pr0n then check the cached DNS lookups on your DNS server to see the domains that are being visited (only allow users to use the companies DNS server) then you can see exactly what sites users are connecting to (mess with their heads by adding your own DNS settings if you must) next do a bit of network monitoring so you can see what internal IP address is connecting to the specific IP addresses you don't want visiting.[/QUOTE]
Any company worth its solve already uses third party vendor firewalls that do the above anyway and update their own lists. To do it yourself would not be cost effective.I'm just making the point that its the network admins job to lock down the network (sorry users) and then monitor it so in the OP's case the IT dept should have known what was going on before the RIAA letter. I wouldn't be supprised if they got a doing over for allowing this to happen so if they found a scapegoat they aren't going to be providing logs to prove otherwise.
Exactly, which is why I think he is being used as a scapegoat. Question is what did he do to piss them off?.... and trying to work out the various connection senarios, good mental ARP and DHCP brush up and sorry to get nerdy but I think the hacker would really have to be just tooo darn clever. If he used a DHCP address then he'd get the same IP address as your PC which would leave a msg on your screen saying that there is another computer with the same IP address, so the hacker would have to provide his own IP settings, then if he uses the internet at the same time as the OP my best guess is the internet would slow down and become virtually unuseable.
Hack wireless encryption, spoof live mac address, get ip address from lease, change to valid ip from end of lease range, rape company bandwidth. Doesn't seem that difficult, if time on same ip was limited and he wasn't using his second machine at that time xp is unlikely to pick up the fact that for a brief time there were two machines on the same ip.0 -
-
Cuddlesworth wrote: »
Exactly, which is why I think he is being used as a scapegoat. Question is what did he do to piss them off?
Don't think he pissed anyone off but when they were looking for a scapegoat he was the first one they found with a loaded gun, it might not have been fired but not easy for the OP to prove that.
btw I also give the users SSL as well of HTTP perhaps I'm too big harted
0 -
-
-
Advertisement
-
-
-
-
-
I was under the impression the OP has this computer but doesn't use it much, seems like a second computer in the same office and the OP has a different primary computer. I may have got that wrong though.
OK then, can we agree if there was someone spoofing the OP's MAC address then they'd have to be in the same office or at least close enough to notice when the OP was going to use his system to avoid any dupilcate IP address messages?
but discuss... is just as good 0 -
OK then, can we agree if there was someone spoofing the OP's MAC address then they'd have to be in the same office or at least close enough to notice when the OP was going to use his system to avoid any dupilcate IP address messages?
but discuss... is just as good
Definitely. For the spoof to work you'd need good information on when the IP/MAC was available to be used or the user of the computer would notice network disruption and no doubt some nice windows notifications.
So rather then speculate further I'll wait to see if 2scoops ever gets some evidence that the IP assigned to his computer via DHCP was actively running a bittorrent client while it held that lease.0 -
Definitely. For the spoof to work you'd need good information on when the IP/MAC was available to be used or the user of the computer would notice network disruption and no doubt some nice windows notifications.
So rather then speculate further I'll wait to see if 2scoops ever gets some evidence that the IP assigned to his computer via DHCP was actively running a bittorrent client while it held that lease.
I'm really only trying to blow a hole in the whole idea of spoofing a MAC address I know it's possible but last couple of people who I've talked to who were going on about it how easy it was couldn't explain to me how to do it and couldn't even name a well known app that could do it for them.
It is possible but then the chances of having your MAC addressed spoofed and having an unused copy of BitTorrent on your laptop and being in the office at the specified time start to push the odds one way. The MAC address is unproved but the IT department would have known that the OP's PC had the software installed and would have known when his laptop logged on and off the domain. Just having the software installed is all management will think about. I rest my case; sort of 0 -
-
-
-
Advertisement
Advertisement