🚀 go-pugleaf

Paul Newhouse wrote:
> 
> >>In any case, there's a distinct difference between port-scanning
> >>and any sort of life-threatening activity, so this whole discussion
> >>is getting totally irrelevant.

That one presupposes you know what the systems at the other end are, and
what they are doing. 

I appreciate that anyone designing a system such that port scanning
causes life threatening effects has made a big mistake, but that doesn't
mean it will not happen, just look at what Satan did to some versions of
Digital OSF in it's non-intrusive mode.

I remember in the early days of the Internet advising an employer that
the Internet was not a suitable place for locating operational disaster
planning systems for much the same reason (And the fact that whilst IP
may have been designed to make self repairing networks the Internet
wasn't 'planned' enough to take advantage of it in severe cases).

Other people may have been less enlightened or unable to develop
alternatives.

..SNIP...
> > The problems are that: (1) there are serious risks to property;
> 
> > (2) unauthorized scanning has no legitimate purpose;
> 
> Some examples of "authorized" scanning, please.

Authorised scanning - self scanning is covered elsewhere although no one
mentioned scanning betwen consenting system admins - very good way to
learn about network security IMO. 

Most ISP's reserve the right to scan customers (if only to a limited
extent), I don't like the idea but it was probably in the small print or
the T&C, and authorised when you signed the contract.

One ISP has recently scanned for security vulnerabilities in BIND - and
the Singapore government I believe authorised a scan for viruses or
trojans (Although they came under criticism for so doing) believing it
to represented a significant threat to the Singapore economy.

> > and (3) most scanning is neither 'polite' nor 'friendly'.
> 
> It's damn'd rude.

The issue is where does survey end and scan begin, in many cases it is a
question of intent, and scope.

I would argue that querying a DNS server for the version.bind string is
a legitimate DNS query and constitutes fair use of the DNS servers. If
you don't what your DNS server to answer this legitimate DNS query -
tell it not to.

However if I develop a similar interest in say SMTP, now SMTP doesn't
give me a standard query for establishing the type of server, but a
number of different SMTP conversations will reveal enough information to
classify SMTP servers pretty accurately (The author of qmail does
something like this occasionally to measure the market penetration of
his and other products). Some of these 'tricks' could involve checking
the response from an attempt to relay mail. 

Indeed in the surveys I have seen people are working from IP address
space - so they are "knocking" on a lot of closed port 25.

I can quite see why a remote admin might not appreciate that interest in
the version of BIND running is to answer the question 'How quickly do
most users patch BIND?', rather than 'is this server vulnerable?'. 

However I think DNS example is pretty clear cut - I think that the SMTP
example takes us to a grey area, especially where people are hitting
closed ports.

I would argue that the right view is that people have to take
responsibility for the services that their servers offers - painful as
this is. 

Even if a law existed against scanning, and enforcement was practical,
people would still need to take similar precautions against it. Just as
most people have to lock their car despite the fact that car theft is
against the law.

Personally I think port scans are not worth 'outlawing', as they could
also result from other activity with perfectly legitimate intent, and
only the lawyers would make money. Wait for something more concrete to
'hang' them on (or hang on them).

	Simon
-- 
What to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org