🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.firewalls
Article #123

Re: Cuervo, I disagree: ShareSniffer Released

#123
From: Philip J. Koenig
Date: Tue, 27 Feb 2001 04:08
65 lines
4326 bytes
In article <6Lwm6.231$cw3.62050@typhoon2.ba-dsg.net>, eruberts@aol.com (Earl 
Ruberts Jr.) writes...
> 
> "John Navas" <spamfilter@navasgrp.dublin.ca.us> wrote in message
> news:8Qum6.4140$S25.63391@typhoon.sonic.net...
> > [POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]
> >
> > In <toak9tkrc8fnsa1kt4nsiu5udammcg60kh@4ax.com>, Never anonymous Bud
> > <thekat@san.rxyzr.com> wrote:
> >
> > >John Navas <spamfilter@navasgrp.dublin.ca.us> opened the coffin lid and
> croaked...
> > >
> > >>A port "scan" is an attempt to connect (enter).  If you don't understand
> > >>that, then I suggest you refer to the RFC's.
> > >
> > >Bull.  It's ONLY an attempt to see IF there is a service running on that
> port.
> >
> > Bull, yourself -- these are connection attempts.  Got a wealth of logs
> > to prove it.
> >
> > --
> > Best regards,
> > John Navas     <http://navasgrp.home.att.net/>
> >      CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>
> 
> 
> Correct me if I am wrong here,
> 
> One could have fun with log files by writing a "harmless" HTML email in
> which a person could use a meta refresh tag pointed at a domain name or an
> IP address but using a nonstandard port or well known trojan port e.g.
> http://yourdomain.com:8181  this would cause the HTML readers to try to
> connect with that port to retrieve a web page. Factor in a script that makes
> this self replicating (e.g. Love Bug) and watch a network admin go crazy
> thinking people are *trying* to "enter" or "break in" that particular port.
> 
> While this is certainly not legal or authorized activity, it just goes to
> show that an innocent person can be a hapless victim of the "port scanner
> police" :-)
> 
> Earl


You can make that contention about any law anywhere.  That's
why people who are accused of crimes (in this country anyway)
are tried by a "jury of their peers" to be reasonably certain
of their intent, instead of just throwing them in jail because
they did something that "on the surface" appeared to be illegal.

You can make up as many inflammatory examples as you wish, 
but it doesn't change the fact that portscanning is rarely
"innocuous".  I personally may not be an advocate for "laws"
about it -- but neither am I sticking my head in the sand 
trying to claim that most of that activity is perfectly
innocent either.


-- 
Philip J. Koenig         The Electric Kahuna Organization       [anti-spammed]
----------------Computers & Communications for the New Millennium-------------
* To send email, remove numbers and spaces:  pjkunet64 @  ekahuna27 . com    *
*      Vision impaired?  Try taking off the blacklist-colored glasses.       *
* Simple answers are for simple minds.  Try a new way of looking at things.  *
Technical Details
Message-ID: <MPG.1504c82cdb0b7cff98a021@207.126.101.100>
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-post-01!supernews.com!corp.supernews.com!not-for-mail
References: <3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> <OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <Bzmm6.4119$S25.62449@typhoon.sonic.net> <toak9tkrc8fnsa1kt4nsiu5udammcg60kh@4ax.com> <8Qum6.4140$S25.63391@typhoon.sonic.net> <6Lwm6.231$cw3.62050@typhoon2.ba-dsg.net>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-ArrivalTime: 2001-02-26 20:11:18 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-post-01!supernews.com!corp.supernews.com!not-for-mail
From: See_email_@ddress_below.This_one_is.invalid (Philip J. Koenig)
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Cuervo, I disagree: ShareSniffer Released
Date: Mon, 26 Feb 2001 20:08:49 -0800
Organization: The Ekahuna Organization
Message-ID: <MPG.1504c82cdb0b7cff98a021@207.126.101.100>
References: <3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> <OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <Bzmm6.4119$S25.62449@typhoon.sonic.net> <toak9tkrc8fnsa1kt4nsiu5udammcg60kh@4ax.com> <8Qum6.4140$S25.63391@typhoon.sonic.net> <6Lwm6.231$cw3.62050@typhoon2.ba-dsg.net>
X-Newsreader: MicroPlanet Gravity v2.10
X-Complaints-To: newsabuse@supernews.com
Lines: 65