🚀 go-pugleaf

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

In <yd3dd4tlxa.fsf@UBEblock.psr.com>, wbe @ubeblock.psr.com.invalid
(Winston Edmond) wrote:

>John Navas <spamfilter@navasgrp.dublin.ca.us> writes:
>> Attempting entry without authorization is not innocent.
> ...
>> Port scanning is attempting entry without authorization, not just
>> looking.
>
>First, let's make sure we're all talking about the same thing.  To me,
>"port scanning" means attempting connections to most or all of the likely
>service ports to discover which ones accept connections, not just trying
>to connect to one port.

It's also scanning just one port on multiple computers; e.g., looking
for a specific vulnerability.

>Second, port scanning in and of itself should not be illegal. In
>particular, if I go to a web site and ask it to port scan my system so that
>I can see whether my security setup works, that's certainly "authorized"
>and shouldn't be illegal.

Agreed.  The issue here is unauthorized scanning.

>If I go to that same site and ask it to port
>scan somebody else's computer, is the owner of the Web site that performs
>the port scan guilty?

Yes.  It was a scan without proper authorization.

>Third, "port scanning" (as defined above) doesn't cover the case of probing
>for a single trojan port (e.g., 27374).

As you defined it.

>That, however, is fairly clearly
>an indication of someone trying to break in.

Yep.  It's scanning.

>Lastly, how exactly are you going to define "authorized"?

Permission by the responsible person for the computer in question.

>If I set up an
>SMTP server on port 25, who's "authorized" to connect to it?  Normally the
>answer is pretty much everyone in the world except spammers from explicitly
>blocked IP ranges.  :-)  A port scan or probe will find it "open".  How are
>you going to claim that anyone connecting to it is NOT "authorized" to do
>so?  OTOH, if someone uses that connection to send a file that exploits a
>buffer overflow vulnerability and gains unintended access to the rest of
>your system, that's something a little more clearly distinguishable as
>"unauthorized" activity.

I think it's pretty easy to distinguish legitimate attempts to connect
to "well-known" public services from abusive entry attempts.  In the
case of SMTP, the first level of authorization is the existence of an MX
record.  If there is no MX record for the IP in question, then it's
difficult to justify a connection attempt.

>[please don't send "courtesy copies" of followups; I read the newsgroup]

Where responses may or may not appear -- Usenet is an imperfect
mechanism.  As regularly posted to news.announce.newusers:

          A Primer on How to Work With the Usenet Community
          <http://www.faqs.org/faqs/usenet/primer/part1/>
   ...
      Check your return e-mail address and expect responses.

   When you post an article, make sure that the return e-mail address
   in its From: or Reply-To: headers is correct, since it is
   considered inappropriate to post an article to which people are
   unable to respond by e-mail.  If you are unable to configure your
   software to include a valid return address in your article header,
   you should include your address in a signature at the bottom of
   your message.

   When you post an article, you are engaging in a dialogue, and
   others may choose to continue that dialogue by responding via
   e-mail.  It is not courteous to post if you are unwilling to
   receive e-mail in response.
   ...

( Nonetheless, I respected your wishes since they were so clearly
stated. ;)

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>