Prosecuting Hackers

I have proof of identity I want his head.

[woop01]

I run an online community based site and we have found a hacker. This person was recently banned from the site and is really ticked at us for doing it. They sent us an e-mail earlier today and we have the IP from it. The great thing is we then caught them attempting to login to numerous accounts using a shot gun approach to check for common passwords from the same IP.

What can be done? I've already blocked the IP but I want this schmucks head.

[anchordesk]

How have you been damaged?

[woop01]

He logged into the accounts of our subscribers and did damage to their accounts.

This has cost us, at the current time, 14 hours of labor to clean up.

However, most of the damage was to the accounts of our customers which once he gained access to them he proceeded to do whatever he could to damage. This has cost our users an unknown amount of time today in attempting to clean up the 'mess' he has caused.

[digitalv]

The first thing you should do is an ARIN whois on the IP address to find out who owns it. From there you can determine whether it's assigned to an ISP or a company's internal internet access.

If it's a company, call them and let them know what happened - they might be able to figure out who was using the IP address and would quite possibly fire them for unauthorized use of their Internet access. If it was an ISP, they may terminate their user for violating their access policies.

There isn't much you can do legally since there really wasn't any damage done - changing a few settings doesn't constitute damage. Unless credit cards were compromised of course, then you can just call the FBI and let them handle it. But other than that, its best just to let the company or provider know what happened.

Also keep in mind that though unlikely, it's possible that the person at the IP address you have had nothing to do with it and knows nothing about it - these types of attacks are typically done via software or scripts, and there is no way to tell whether the person sitting at that PC was deliberately running a program to test logins or whether they were infected with something that does it without their knowledge.

You should also consider upgrading your login security a little bit ... perhaps ban an IP if their login fails more than 3 times.

[anchordesk]

First off, I honestly feel your anger and frustration. Life is not fair and this is a good example of someone not playing by the rules.

Your claim is that a crime was committed against your property. If you are serious, make a police report. Gather up all your evidence. Take a few days to fully think about the situation. Then if you want to proceed, take your evidence to your local District Attorney. In all likelihood, the DA will blow you off because he/she has neither the time, interest, nor the ability to prosecute. Another lesson that life just is not fair.

That's just one practical starting point. Maybe others can point you in a different direction.

[ControlEngineer]

You probably should consult with an attorney about the possibility of a civil suit. There is the problem of quantifying the damages, and collecting enough to pay the attorney. The expenses could be high because you may need an expert witness (someone completely independent who can verify the information you have about the identity). However, even if all you can collect goes to legal fees and expenses, it could be worth the cost to prevent future occurances. An attorney could also advise you on possible criminal charges.

Good luck. I hope you get his head served up on a platter.

[blaze]

You might have some luck in a small claims court.

[zk21]

It definitely sounds like you have a case here. I agree that the first thing to do is call the police and fill out a report. No matter what, you will need that.

Good luck and nice investigative work!