🚀 go-pugleaf

Oh yeah...almost forgot...he did all his HTML with foreground/background
colors that result in blank pages in Netscape...so you  may need IE to
read the FAQ below.

Lawrence Baldwin wrote:
> 
> The last thing I want to do is give this guy any press, but figured I'd
> send a heads up:
> 
> http://www.sharesniffer.com/FAQ.html#Q-001
> 


-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

Joe King wrote:
> 

> The up side of it (if there is one) is that it just might start
> publicly pointing the finger at people who refuse to RTFM and take
> reasonable precautions to secure their systems, and others who plain
> just don't give a damn about what is going in or out of their
> system/connection.

I was thinking that too...I suspect Qaz (Summer 2000) helped that.  Our
estimates (Aug 2000) was that nearly 3% of broadband connections have
open shares.  This was based on detecting 2600+ QaZ infected ADSL users
within a single provider that had approx ~100,000 subs.  I had
originally thought it was much  higher, but then remembered that at
least File & Print sharing is NOT on by default.

> As opposed to what... being banged 50 times a day with RPC port
> probes, Sub 7/2 port probes?..LOL

Hey you have the *advantage* of being in a netblock of the best known
broadband providers...enjoy.  I'm suprised though, even our @Home
sensors don't report that kind of volume (usually 5-10 scans/day
each)....I suspect that ShareSniffer could easily bring the scan level
even higher than it was during QaZ...esp. since it's technically not a
worm but a "commercial product".


lb.
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

On Fri, 23 Feb 2001 14:23:21 GMT, Joe King <cluelessnewbie*@home.com> wrote:
>
>The up side of it (if there is one) is that it just might start
>publicly pointing the finger at people who refuse to RTFM and take
>reasonable precautions to secure their systems, and others who plain
>just don't give a damn about what is going in or out of their
>system/connection.

Catch 22. By definition these people are 'clueless', don't RTFM, and
don't know what is going on with their system. I doubt they would ever
know that they are being 'used'. Even if their harddrive fills up with
somebody else's stuff, they'd probably just buy a new one, or whatever.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
--

Oh dear...  I pray that my ISP doesn't start trying to become a security
expert...  The last thing they need to do is start baby-sitting us.  It will
only interfere with those of us who know what's going on, and the majority
of the people will never know anything has EVER happened to them...for them,
I say ignorance is bliss.


"Joe King" <cluelessnewbie*@home.com> wrote in message
news:1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov...
> On Fri, 23 Feb 2001 08:22:26 -0500, Lawrence Baldwin
> <baldwinlSPAMMENOT@mynetwatchman.com> wrote:
>
> >The last thing I want to do is give this guy any press, but figured I'd
> >send a heads up:
> >
> >http://www.sharesniffer.com/FAQ.html#Q-001
> >
> >Advocates utilizing the open shares for extra disk space "...because
> >it's there".
> >
> >My biggest concern is that it utilizes a newsgroup repository to collect
> >and dissemenate IP addresses with known open shares.  Others (including
> >automated worms) could easily leverage this data, facilitating system
> >compromises.
>
> The up side of it (if there is one) is that it just might start
> publicly pointing the finger at people who refuse to RTFM and take
> reasonable precautions to secure their systems, and others who plain
> just don't give a damn about what is going in or out of their
> system/connection.
>
> It might also force some of the broadband cable operators to take a
> more pro-active approach to securing and protecting their subscribers
> with a secure and monitored infrastructure.
>
> >Expect an increase in Netbios scans over the coming days....sigh.
>
> As opposed to what... being banged 50 times a day with RPC port
> probes, Sub 7/2 port probes?..LOL
>
>

On Fri, 23 Feb 2001 14:57:50 GMT, Cuervo Jones <cuervo_jones@altavista.com> 
>wrote:
>Oh dear...  I pray that my ISP doesn't start trying to become a security
>expert...  The last thing they need to do is start baby-sitting us.  It will
>only interfere with those of us who know what's going on, and the majority
>of the people will never know anything has EVER happened to them...for them,
>I say ignorance is bliss.

Unfortunately, people like you are in the vast minority.  Some ISPs may be
compelled to take action based on legal/political/internal pressures.

jms

I see nothing wrong with having my ISP/DSL provider acting to curb malicious
port scanners.  I'd also like the U.S. Congress to consider making port
scanning a criminal act.

"Cuervo Jones" <cuervo_jones@altavista.com> wrote in message
news:OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net...
Oh dear...  I pray that my ISP doesn't start trying to become a security
expert...  The last thing they need to do is start baby-sitting us.  It will
only interfere with those of us who know what's going on, and the majority
of the people will never know anything has EVER happened to them...for them,
I say ignorance is bliss.


"Joe King" <cluelessnewbie*@home.com> wrote in message
news:1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov...
> On Fri, 23 Feb 2001 08:22:26 -0500, Lawrence Baldwin
> <baldwinlSPAMMENOT@mynetwatchman.com> wrote:
>
> >The last thing I want to do is give this guy any press, but figured I'd
> >send a heads up:
> >
> >http://www.sharesniffer.com/FAQ.html#Q-001
> >
> >Advocates utilizing the open shares for extra disk space "...because
> >it's there".
> >
> >My biggest concern is that it utilizes a newsgroup repository to collect
> >and dissemenate IP addresses with known open shares.  Others (including
> >automated worms) could easily leverage this data, facilitating system
> >compromises.
>
> The up side of it (if there is one) is that it just might start
> publicly pointing the finger at people who refuse to RTFM and take
> reasonable precautions to secure their systems, and others who plain
> just don't give a damn about what is going in or out of their
> system/connection.
>
> It might also force some of the broadband cable operators to take a
> more pro-active approach to securing and protecting their subscribers
> with a secure and monitored infrastructure.
>
> >Expect an increase in Netbios scans over the coming days....sigh.
>
> As opposed to what... being banged 50 times a day with RPC port
> probes, Sub 7/2 port probes?..LOL
>
>

Lawrence Baldwin wrote:

> The last thing I want to do is give this guy any press, but figured I'd
> send a heads up:
>
> http://www.sharesniffer.com/FAQ.html#Q-001
>
> Advocates utilizing the open shares for extra disk space "...because
> it's there".
>
> My biggest concern is that it utilizes a newsgroup repository to collect
> and dissemenate IP addresses with known open shares.  Others (including
> automated worms) could easily leverage this data, facilitating system
> compromises.
>
> Expect an increase in Netbios scans over the coming days....sigh.
>
> lb.
> -------------------------
> Lawrence Baldwin
> Protocol Scientist
> 678-624-0924
> http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

Spy --- Counterspy   ;)
Jiujitsu ... and all that  ;)

Suppose that someone takes on the challenge of fighting this      as
follows:

Since the aim of the product is to let the user store his/her data on your
machine,
set up a poisoned honey-pot.  Let them get access. Let them put their file
on
your disk. You can then inspect their files, collect evidence of illegal
entry,
and also poison their data.
I don't think that it  will take long for the scuttlebut  about that to get
around.
I think that will kill the product.

Since most ISPs Acceptable-use-policies AUP cite port scaning as grounds
for termination, users of this thing will likely get warnings and/or
account terminations...I suspect that's how it will really get killed.

Unfotunately, it's the ISPs that are going to feel the blunt of the
impact dealing with all the complaints that will inevitably come.

I like how he glosses of this *minor* detail in his FAQ...stating that
the only problem is that ISP Abuse departments may be "confused" by this
new "innovative" product.  LOL.

lb.

"Rostyslaw J. Lewyckyj" wrote:
> 
> I don't think that it  will take long for the scuttlebut  about that to get
> around.
> I think that will kill the product.

-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

On Fri, 23 Feb 2001 15:35:10 -0000, Justin M. Streiner <streiner@remove-to-mail-meDOTcluebyfour.org> wrote:
>
>Unfortunately, people like you are in the vast minority.  Some ISPs may
>be compelled to take action based on legal/political/internal
>pressures.

The problem with this is that once the word 'secure' becomes part of an
ISPs offering, they assume some degree of liability. My hunch is most
ISPs don't want to touch this with a 10' pole, and will avoid it like
the plague it is.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
--

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

IMHO, ShareSniffer is highly abusive.  (I fired off a complain to
Verio.)


In <3A966412.9336DCD8@mynetwatchman.com>, Lawrence Baldwin
<baldwinlSPAMMENOT@mynetwatchman.com> wrote:

>The last thing I want to do is give this guy any press, but figured I'd
>send a heads up:
>
>http://www.sharesniffer.com/FAQ.html#Q-001
>
>Advocates utilizing the open shares for extra disk space "...because
>it's there".
>
>My biggest concern is that it utilizes a newsgroup repository to collect
>and dissemenate IP addresses with known open shares.  Others (including
>automated worms) could easily leverage this data, facilitating system
>compromises.
>
>
>Expect an increase in Netbios scans over the coming days....sigh.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

In <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov>, Joe King
<cluelessnewbie*@home.com> wrote:

>On Fri, 23 Feb 2001 08:22:26 -0500, Lawrence Baldwin
><baldwinlSPAMMENOT@mynetwatchman.com> wrote:

>>My biggest concern is that it utilizes a newsgroup repository to collect
>>and dissemenate IP addresses with known open shares.  Others (including
>>automated worms) could easily leverage this data, facilitating system
>>compromises.
>
>The up side of it (if there is one) is that it just might start
>publicly pointing the finger at people who refuse to RTFM and take
>reasonable precautions to secure their systems, and others who plain
>just don't give a damn about what is going in or out of their
>system/connection.
>
>It might also force some of the broadband cable operators to take a
>more pro-active approach to securing and protecting their subscribers
>with a secure and monitored infrastructure.

Right.  And the "upside" of burglars is that they motivate landlords to
install security systems in apartments?  Get serious.  Providers aren't
going to pay any attention.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

In <slrn99d0dc.5a2.streiner@lurch.noc.sgi.net>,
streiner@remove-to-mail-meDOTcluebyfour.org (Justin M. Streiner) wrote:

>On Fri, 23 Feb 2001 14:57:50 GMT, Cuervo Jones <cuervo_jones@altavista.com> 
>>wrote:

>>Oh dear...  I pray that my ISP doesn't start trying to become a security
>>expert...  The last thing they need to do is start baby-sitting us.  It will
>>only interfere with those of us who know what's going on, and the majority
>>of the people will never know anything has EVER happened to them...for them,
>>I say ignorance is bliss.

>Unfortunately, people like you are in the vast minority.  Some ISPs may be
>compelled to take action based on legal/political/internal pressures.

I doubt it -- taking action would probably expose them to liability.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>

In article <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov>,
Joe King  <cluelessnewbie*@home.com> wrote:
>
>It might also force some of the broadband cable operators to take a
>more pro-active approach to securing and protecting their subscribers
>with a secure and monitored infrastructure.

Which would be a bad thing, IMHO.  I can understand providers who
scan for open mail relays and other such things which compromise
the entire network (by threatening to have the entire netblock
added to one of the blackhole anti-spam lists), but stuff like
NetBIOS security is not the responsiblity of the ISP.  Security is
a user responsibility, and the ISP really should not get involved
by doing things like port-blocking and the like.  Providing
information about how to turn off Windows File Sharing and such
would be a good thing for a responsible ISP to do, but anything
beyond that is too much.

In article <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net>,
Justin Emalius <justinDOTemaliusATverizonDOTnet> wrote:
>
>I see nothing wrong with having my ISP/DSL provider acting to curb malicious
>port scanners.  I'd also like the U.S. Congress to consider making port
>scanning a criminal act.

I won't touch this other than to say that I believe strongly that it
would be a horribly misguided idea.

I'm all in favor of laws which prohibit unauthorized access and
damage to computer systems, but a simple portscan does not constitute
unauthorized access!  It's the equivalent of asking a machine which
public services it provides and nothing else.  A portscan in and of
itself does not constitute a threat and should not be treated as one.

Agree, don't think providers will touch this...but hopefully things like
this will motivate users to educate themselves.

John Navas wrote:

> Right.  And the "upside" of burglars is that they motivate landlords to
> install security systems in apartments?  Get serious.  Providers aren't
> going to pay any attention.


-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

Agree, solution isn't legislation...it's education.

lb.

Chris Severance wrote:
> 
> On Fri, 23 Feb 2001 15:37:51 GMT, "Justin Emalius"
> <notta.name@notta.server.net> wrote:
> 
> >I see nothing wrong with having my ISP/DSL provider acting to curb malicious
> >port scanners.  I'd also like the U.S. Congress to consider making port
> >scanning a criminal act.
> 
> That would accomplish nothing. If anything, providing open ports
> should be illegal since that can be targeted for punishment. Not that
> they aren't already.

-- 
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

Here's my take on it...   It should only be offered as an optional service
that you have to give them permission to do...just like call blocking with
the phone company...  If they FORCE you to do it, they will severely
irritate a lot of people who need their connection to be fully open.  (Not
too mention the less they have to touch on their end configuration-wise, the
better it is for us...)  Being in the IT industry, I can appreciate both
sides of the coin, and filtering is usually NOT done by the people operating
the software...It's usually done by us IT losers...and of course we NEVER
communicate with them about specific needs they might have ;-)  hehe   It's
an important area of security, but toooooo many people have no clue about
it, and we don't need them sticking their hands in the cookie jar.  (as they
are the ones who usually do)    As far as Congress making it illegal to port
scan, I can't agree with that at all...  I have to port scan all the time
for troubleshooting purposes.  Anyone here ever talk to somebody the first
day they got Black Ice?  OH MY GOD I'M BEING HACKED!!!   (port scanning is
rampant, but just like any tool, it is the user using it that makes it seem
bad)  Scan responsibly people!  hehe

"Justin Emalius" <notta.name@notta.server.net> wrote in message
news:jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net...
> I see nothing wrong with having my ISP/DSL provider acting to curb
malicious
> port scanners.  I'd also like the U.S. Congress to consider making port
> scanning a criminal act.
>

> Catch 22. By definition these people are 'clueless', don't RTFM, and
> don't know what is going on with their system. I doubt they would ever
> know that they are being 'used'. Even if their harddrive fills up with
> somebody else's stuff, they'd probably just buy a new one, or whatever.
>
LOL...  That is SOOOOO like a typical home user...  I could just imagine
that happening, too!   hehe

Frankly, I didn't know there were legitimate reasons for scanning ports.  I
only became familiar with it after I installed a personal firewall a couple
of months ago and found it happening to me.  I'm sure whoever was probing
wasn't doing it for my benefit.  I know simply getting scanned is not the
same as being hacked.  As long as the firewall is up, I don't freak if I see
it happening.  Unfortunately, there are times when I have to temporarily
disable it and have PWS running and forget to enable it when I go out on the
web.

ak out when I see it
"Cuervo Jones" <cuervo_jones@altavista.com> wrote in message
news:VNyl6.3421$L04.381164@newsread2.prod.itd.earthlink.net...
Here's my take on it...   It should only be offered as an optional service
that you have to give them permission to do...just like call blocking with
the phone company...  If they FORCE you to do it, they will severely
irritate a lot of people who need their connection to be fully open.  (Not
too mention the less they have to touch on their end configuration-wise, the
better it is for us...)  Being in the IT industry, I can appreciate both
sides of the coin, and filtering is usually NOT done by the people operating
the software...It's usually done by us IT losers...and of course we NEVER
communicate with them about specific needs they might have ;-)  hehe   It's
an important area of security, but toooooo many people have no clue about
it, and we don't need them sticking their hands in the cookie jar.  (as they
are the ones who usually do)    As far as Congress making it illegal to port
scan, I can't agree with that at all...  I have to port scan all the time
for troubleshooting purposes.  Anyone here ever talk to somebody the first
day they got Black Ice?  OH MY GOD I'M BEING HACKED!!!   (port scanning is
rampant, but just like any tool, it is the user using it that makes it seem
bad)  Scan responsibly people!  hehe

"Justin Emalius" <notta.name@notta.server.net> wrote in message
news:jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net...
> I see nothing wrong with having my ISP/DSL provider acting to curb
malicious
> port scanners.  I'd also like the U.S. Congress to consider making port
> scanning a criminal act.
>

In article <4ald9tgo6bku8v49seqqgjk22064nqdetr@4ax.com>,
Mike  <no@no.dont.invalid> wrote:
>
>Oh, so its the victims fault? Clueless they might be...so what? Do you
>know all there is to know about everything you own? Are you positive the
>vehicle you drive doesn't have a defect that could injure yourself or
>another? Trust is the key word here. How about blaming the software
>developer for the design decision, or lack thereof, for shares being
>automatically exposed to the 'net.

Are you implying that bad drivers should sue car manufacturers for
every accident for failure to make a vehicle that is accident-proof?

Seriously, if you don't know how to drive, you shouldn't be behind
the wheel.  If you don't know enough to run a reasonably secure OS
and configure it properly (and can't find someone else to help you
do so), you shouldn't be running a computer on a public, untrusted
network with any expectation that the OS will not be compromised.

This isn't "blaming the victim" so much as it is common sense.

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

In <976mhu$itt$1@news.panix.com>, snorwood@redballoon.net (Scott
Norwood) wrote:

>In article <4ald9tgo6bku8v49seqqgjk22064nqdetr@4ax.com>,
>Mike  <no@no.dont.invalid> wrote:
>>
>>Oh, so its the victims fault? Clueless they might be...so what? Do you
>>know all there is to know about everything you own? Are you positive the
>>vehicle you drive doesn't have a defect that could injure yourself or
>>another? Trust is the key word here. How about blaming the software
>>developer for the design decision, or lack thereof, for shares being
>>automatically exposed to the 'net.
>
>Are you implying that bad drivers should sue car manufacturers for
>every accident for failure to make a vehicle that is accident-proof?
>
>Seriously, if you don't know how to drive, you shouldn't be behind
>the wheel.  If you don't know enough to run a reasonably secure OS
>and configure it properly (and can't find someone else to help you
>do so), you shouldn't be running a computer on a public, untrusted
>network with any expectation that the OS will not be compromised.
>
>This isn't "blaming the victim" so much as it is common sense.

With all due respect, this is a matter of defective design, not cockpit
error.  When someone gets seriously injured because Firestone tires
separated, you blame Firestone, not the hapless driver that was
unfortunate enough to buy and use them.  The problem here is that
computers being sold to average people are inherently and inexcusably
insecure.  Average people shouldn't have to be security experts to use
computers on the Internet any more than they should have to be
automotive experts to drive a car on the road.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>

ShareSniffer has quite a few neat options but don't forget that
"Legion" and "SMB Scanner" are similar and have been around for quite
awhile. Unless ShareSniffer manages to get some media, I don't think
things will change much. BTW, what the heck does RTFM mean - Retrofit
or something? Thanks in advance...

--

Paul R. Zimmerman
http://zimmermantech.com
paul@zimmermantech.com


"Lawrence Baldwin" <baldwinlSPAMMENOT@mynetwatchman.com> wrote in
message news:3A966412.9336DCD8@mynetwatchman.com...
> The last thing I want to do is give this guy any press, but figured
I'd
> send a heads up:
>
> http://www.sharesniffer.com/FAQ.html#Q-001
>
> Advocates utilizing the open shares for extra disk space "...because
> it's there".
>
> My biggest concern is that it utilizes a newsgroup repository to
collect
> and dissemenate IP addresses with known open shares.  Others
(including
> automated worms) could easily leverage this data, facilitating
system
> compromises.
>
>
> Expect an increase in Netbios scans over the coming days....sigh.
>
>
> lb.
> -------------------------
> Lawrence Baldwin
> Protocol Scientist
> 678-624-0924
> http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

I doubt that the average user will even hear of this, much less take
action.

It would be matter if it finally motivated Microsoft to get serious
about security in Windows, but frankly I don't see much chance of that
either.

I think it's long past time to put the blame where it really belongs.

p.s.  I'm not letting other, equally irresponsible OS suppliers off the
hook -- it's just that they don't have enough market presence to matter.


In <3A96A857.9F864489@mynetwatchman.com>, Lawrence Baldwin
<baldwinlSPAMMENOT@mynetwatchman.com> wrote:

>Agree, don't think providers will touch this...but hopefully things like
>this will motivate users to educate themselves.
>
>John Navas wrote:
>
>> Right.  And the "upside" of burglars is that they motivate landlords to
>> install security systems in apartments?  Get serious.  Providers aren't
>> going to pay any attention.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

In <97656j$d8f$2@news.panix.com>, snorwood@redballoon.net (Scott
Norwood) wrote:

>I'm all in favor of laws which prohibit unauthorized access and
>damage to computer systems, but a simple portscan does not constitute
>unauthorized access!  It's the equivalent of asking a machine which
>public services it provides and nothing else.  A portscan in and of
>itself does not constitute a threat and should not be treated as one.

Port scanning is like sneaking around late at night trying to open front
doors.  Suggesting that's not a threat if the sneak doesn't actually
enter is at best naive IMHO.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>