Re: Cuervo, I disagree: ShareSniffer Released

Article View: comp.security.firewalls

Article #202

Back to comp.security.firewalls Previous Next

#202

From: Lawrence Baldwin
Date: Sat, 24 Feb 2001 00:43

33 lines
2727 bytes


rtoledo@gte.net wrote:
-
I'm not even going to touch the jiggling door knobs analogy...I'm sick
of hearing it.

Here's something to think about:

Most ISPs have drafted their AUPS to allow account terminations if you
get caught port scanning.
To avoid account termination, anyone with any sense only scans
*indirectly* from systems that have already been compromised (or from a
throw away account).

Therefore, I really don't even need to argue the intent of the scan
activity as it pertains to the current target...just the fact that
someone is scanning means that they have already compromised the
*source* system...it's THAT act that I take exception to and notify the
responsible party.

I will tell you that nearly 80% of all the scan abuse reports we make
(and we do about 10-20/day) sourced from a indirectly compromised
system.  By being relentless about pursing ALL scan activity (assuming
multiple reporting targets), you can dramatically decrease the amount of
compromised hosts throughout the Internet.

-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

Technical Details

Message-ID: <3A9703C8.B52A6CE3@mynetwatchman.com>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!newsswitch.lcs.mit.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news1.atl.POSTED!not-for-mail

References:

<3A966412.9336DCD8@mynetwatchman.com> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <976pnb$jon$2@news.panix.com> <FeCl6.3919$S25.55117@typhoon.sonic.net> <teud9t44k6igkb6q4dknv3sdjienfg2glb@4ax.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-ArrivalTime: 2001-02-23 16:46:01 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!newsswitch.lcs.mit.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news1.atl.POSTED!not-for-mail
Message-ID: <3A9703C8.B52A6CE3@mynetwatchman.com>
From: Lawrence Baldwin <baldwinlSPAMMENOT@mynetwatchman.com>
X-Mailer: Mozilla 4.7 [en] (WinNT; U)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Cuervo, I disagree: ShareSniffer Released
References: <3A966412.9336DCD8@mynetwatchman.com> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <976pnb$jon$2@news.panix.com> <FeCl6.3919$S25.55117@typhoon.sonic.net> <teud9t44k6igkb6q4dknv3sdjienfg2glb@4ax.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 33
Date: Fri, 23 Feb 2001 19:43:52 -0500
NNTP-Posting-Host: 208.61.48.163
X-Trace: news1.atl 982975432 208.61.48.163 (Fri, 23 Feb 2001 19:43:52 EST)
NNTP-Posting-Date: Fri, 23 Feb 2001 19:43:52 EST

Reply to Parent Message