Home page logo

basics logo Security Basics mailing list archives

Re: FW: Legal? Road Runner proactive scanning.[Scanned]
From: Charles Otstot <charles.otstot () ncmail net>
Date: Tue, 16 Mar 2004 14:01:52 -0500

Jef Feltman wrote:

So if someone comes and knocks on your door at home you shoot them? Do you
consider them a criminal? No, you lock the door and windows.

I think you are missing my position. It seems to me that this really wasn't a technical question, but rather a question of what a reasonable (as normally used in legal definitions) person would consider proper access. Such person need not be technical, in fact, imposing a technical definition ignores the more practical concern of property and privacy rights. Knocking on *a" door may be an innocent act, knocking on *all* my doors and windows (or as others have noted, testing to see whether they are locked) is a deliberately intrusive act. While it certainly doesn't merit shooting, I would, at the least, bar that person from knocking on my door again (absent a very good explanation of why they should not be prohibited from such).

If your host is on the internet I consider it public and knocking on the
door to see if the shop is open, is not a problem. If you do not want people
coming in the door lock it and give a key to those who need it.

I think you might have trouble convincing others that your actions do not pose a problem. Simply having a host on the Internet does not automatically mean that one has the right to see what might be *technically* available on that host as opposed as to what the host's owners intended to be available. To refer to your analogy, the shop owner does not (in general) have the responsibility to lock the door and provide those who need access with a key. Rather, outsiders have the responsibility (both moral and legal) to stay out unless invited in.

Based on your statement no website should not be accessed by anyone other
than an employee. Sending E-Mail would be a violation also, as the port must
be checked to verify it can be opened to receive.
No, I stated that permission does not necessarily have to be explicit, only that ordinary concepts of reasonableness should dictate what is and isn't proper access. I specificaaly used the example of a publicly accessible website to illustrate that reasonableness would say accessing such a site would be considered appropriate. If however, there is a link on the site that says "Employees Only" that is available (from a technical perspective), and a non-employee intentionally clicks on the link to see if he/she can access the page, a reasonable person (IMHO) would consider such access to be improper. As to email, access would be to a specific resource in repsonse to a specific, proper request.

Port scanning is not an attack it is probe.

This is merely semantics. The implied *intention* is the important piece of the puzzle, not whether any harm is actually inflicted by this specific act.

I have scanned many machines
that have tried to attack my machine trying to verify if it is an attack or
the host has been compromised. Unless the attack is currently in progress,
the host is almost always taken over by a hacker or virus. Scanning the host
allows me to find ports open that prove the host has been attacked and taken
over. Then I am able to inform the ISP or user of the problem. And not go
after some innocent user.

I agree more with the poster who stated that this is not appropriate behavior. You have the right to identify who is scanning you, blocking the scan and then informing their ISP. Anything beyond that is the purview of their ISP, the system administrator and/or the proper legal authorities.

If a company runs a service on the internet they must place a lock on the
door to keep out the unwanted. Otherwise it is open to the public. Remember
there are private and public ip addresses. Public means anyone can access
them without freely unless they harm or steal from the host, just like the
store on the corner.

This is simply wrong. The responsibility lies with the person accessing the resource. Personal resoponsibility and (Western) morality dictate that one should not go where one is not invited. Just because you *can* access something doesn't mean it is alright for you to do so. This is precisely where couching one's arguments in technical terms deflects from the more important (and very real) issues of right and wrong.

A port scan has never hurt any machine and never will. Only a poorly
configured host will be hacked. Just as a poorly locked house will be broken

There is no such thing as an unhackable host, just as there is no such thing as a house which cannot be broken into. Remember, the perfect hack (like the perfect crime) has already occurred. The perpetrator was good enough that no one will ever know about it.


Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]