Ever got tired of skiddies port scanning?

I got seriously tired of skiddies port scanning and then trying to telnet into my box. They had decided that telnet was a hacking tool of epic proportions and it was really begin to get annoying watching my logs scroll by.

Luckily it wasn't automated, it was just a couple of attempts by the same IP each time and then they'd forward it to their mates challenging them to "Hack the really secure box".

Anyway, I decided to have a little fun and coded the following:

require 'socket'
include Socket::Constants
socket = Socket.new( AF_INET, SOCK_STREAM, 0 )
sockaddr = Socket.pack_sockaddr_in( 25, 'localhost' )
socket.bind( sockaddr )
socket.listen( 5 )
client, client_sockaddr = socket.accept
puts "The client said, '#{client.readline.chomp}'"
client.puts "You know, we've been watching you for a few months and I just HAVE to ask... Do you really think you're going to get in? and what the hell do you think you're going to find here... Me and a few of the guys are running sidebets on what you'll try next, it helps us pass the nightshifts.

Oh, and before I forget, our legal department would probably thank me for getting on log that you have been explicitly told that you have no legal right to access this system and showing that you are aware that your continued insistence on doing so constitutes an offence under the 1990 Computer Missuse Act or similar enactments of law in your own jurisdiction. So, let me just throw that out there, get it logged both at our end and with your ISP... it will probably come in handy later."

socket.close

This is a quick and dirty Ruby script that prints the message on the skiddie's screen when they attempt to telnet onto port 25. It then closes the connection.

Now, it's probably not all that secure and I need to make it so that it re-opens the socket once the connection has failed but it works.

Use it if you like!

Regards,

Ruairidh