🚀 go-pugleaf

Dark,

I have found that even using a threshold of *2* "victims" reporting the same attacker to be highly 
effective in identifying those with malice intent, while at the same time filtering out false 
positives.

This policy could easily trigger on your non-malicious scan activity if you became "curious" about 
more than one host within a several day period.  I use port scanning myself but ONLY for back-
tracing purposes...e.g. when sites don't bother to provide DNS SOA and Whois records...then I'll 
scan for 25, 80, 21 to see if I get a banner that identifies the site so I can drop them an email.

However, even using a threshold of 2 victims results in filtering a *lot* of scans that I'm sure ARE 
malicious and/or are indications of a compromised host.  For example, one scan from a host for 515 
(LprNG) or 111 (RPC) is pretty much a giveaway that the host has been rooted.

For this reason, I think we all have to be extremely responsible about scan activity...if we get too 
casual about it, then we'll have to raise the threshold and this will mean that many more 
compromised hosts will go unreported for a longer time.


The other solution is getting more agents reporting the attacks, so it's a lot easier to have 
3,4,5++ victims reporting the same attacker...but I'm workin on that....should have >format-
independent< log uploader done in about a week...this will add the much awaited Zone Alarm support 
(currently  myNetWatchman Agent for Windows  only supports BlackICE) AND all uploads will be real-
time via HTTP (vs. delayed FTP).

lb.
In article <B6F8472D.B0F7%nan-ae@nospam.nospam.porterfield.net.foo>, nan-
ae@nospam.nospam.porterfield.net.foo says...
> Out of curiosity, what do people feel is a reportable margin for protscans?
> 
> I have portscanned without the slightest element of malicious intent, just
> to see what is running on a system.  Does this make me a cracker?  Am I a
> cracker for telneting into an SMTP server (on port 25) and attempting to
> VRFY or RCPT TO an address?
> 
> I am not suggesting that one not LART legitimate attemtps at system
> intrusion, but I am curious as to where people reading this thread draw
> their lines.
> 
> 

-- 
Lawrence Baldwin
Baseline your FastAccess Connection: http://www.mynetwatchman.com/perfwatch/beta.htm
Automatic Port Scan Reporting: http://www.mynetwatchman.com/vision.htm