Home page logo
/

basics logo Security Basics mailing list archives

Re: Spam:RE: application for an employment
From: "Webmaster" <webmaster () marco-bianchi com>
Date: Thu, 30 Mar 2006 03:09:16 +0200


Hi Craig,
I fully agree that having a poorly protected web server puts you in a false
position towards your customers (in a hosting context), but could never
justify such an action as port scanning by others.
I take it, however, that this is related to the fact that you are accessing
the system in an unauthorized way - a way which is not the way the owner
intended. Indeed, I don't think it may be compared to <looking> through your
windows - that requires no response on your part, after all. Looks more like
knocking on your neighbor's teeth to see if they're still firmly in place

But suppose I am in doubt as to a server being down, I think there would be
no objections to, say, pinging?
I understand that most analogies are tricky, but could we compare this to
ringing your doorbell (of course, you can disconnect the bell/disallow
response to pinging)?

In other words, is there any more or less accepted 'line in the sand' for
this?

... and thank you, everybody, for putting your skill and experience at the
disposal of so many beginners and/or (very) puzzled people

Marco


----- Original Message -----
From: "Craig Wright" <cwright () bdosyd com au>
To: "Mark Gorman" <mark () lantanapc com>
Cc: <security-basics () securityfocus com>
Sent: Wednesday, March 29, 2006 11:50 PM
Subject: RE: Spam:RE: application for an employment



Hi
You are negligent from a point of view of a contractual agreement with
the insurance company. You still have the right of ownership on the car.
This has not changed.

You are mixing the rights of property and contractual rights. If you are
negligent the insurance company has a right to recision on your policy.
Not the same thing. You still have a right of action against the person
who stole your car EVEN if the keys are in the ignition and it is
running.

Even if the car is running with the keys in, the act of taking the car
is criminal act.

Craig


-----Original Message-----
From: Mark Gorman [mailto:mark () lantanapc com]
Sent: 30 March 2006 8:26
To: Craig Wright
Cc: security-basics () securityfocus com
Subject: RE: Spam:RE: application for an employment

But, at the same time, you don't have the right to leave the keys in
your car in a convenience store parking lot. If it is stolen you are
held liable as well for negligence. I think everyone has a duty to
protect their network. If you don't secure it properly you will be
penetrated. I say go for it. Tell the employer what you found. It's not
like you're telling a fat man to put down the Twinkie. Its more like
you're telling the person at the bar who can barely walk to give you
their keys. It's for their own good and for the good of others.

-Mark
-----Original Message-----
From: Craig Wright [mailto:cwright () bdosyd com au]
Sent: Tuesday, March 28, 2006 4:18 PM
To: Cesc
Cc: gillettdavid () fhda edu; Craddock, Larry;
security-basics () securityfocus com
Subject: Spam:RE: application for an employment


Hi
The rights are those of the property owner. I have a right in law to
leave my doors open. It is not your right to check for me. The liability
does not rest with the property owner to do more than assert their right
of ownership.

In this analogy it is your fault. This is something that many people
have to come to understand. You are the one in the wrong by checking,
door, server whatever. The property owner has a legal right in common
law (what you think of this right is inconsequential) to leave all their
doors open.


I have a house in the city and one in the bush. I get to leave the
country house wide open and not have to worry. In the city I do not do
this not because I lose rights - but as I do not want to go through the
issue of trusting people and thus being disappointed.


Lets forget all the analogies for a moment. It is simple. The property
owner - i.e. the owner of the web server has rights. The right to leave
a server on the Internet to be accessed as a web service is a legal
right. If the owner of the web server fails to secure the server - this
makes NO difference. If you access it to show it is insecure. You are
violating the web server owners property rights.

It is very simple. Access as the owner intended - good. All other access
bad.

If the Uni had allowed access to check the site than this is an allowed
access and does not violate rights of property.

Regards
Craig



-----Original Message-----
From: Cesc [mailto:cesc.santa () gmail com]

Sent: 29 March 2006 2:12
To: Craig Wright
Cc: gillettdavid () fhda edu; Craddock, Larry;
security-basics () securityfocus com
Subject: Re: application for an employment

May i propose a different view?
If you set up a server connected to the public internet with a few
services available ... wouldn't it be a valid analogy to say that you
have several gates to you house, where each is guarded (or should be) by
a bouncer/guard. Me, standing on the public sidewalk, not only have the
right to see and check which and how many gates you have, but also is no
crime to approach the bouncer/guard and talk to him/her. No crime in
talking ... which following the analogy, i would consider as connecting
or sending probe packets.
If the house owner did not educate well enough the bouncers to not give
out information to passers by is not "my" fault.

Just random thoughts ...

Cesc

On 3/28/06, Craig Wright <cwright () bdosyd com au> wrote:

Actually I see this as a Very good analogy.

It also has the legal issues covered.

If you break the window you are liable for "Criminal damage" and this

is a risk you take.

If you do not break the window (using small stones or small clumps of

dirt for example) you are not legally liable - though the owner of the

window may still not be happy.

Than again, sometimes the vase inside the open window gets broken.....

Regards
Craig

-----Original Message-----
From: David Gillett [mailto:gillettdavid () fhda edu]
Sent: 28 March 2006 6:18
To: 'Craddock, Larry'; security-basics () securityfocus com
Subject: RE: application for an employment

  It's more like throwing a stone at a window to see if it's open.
Sometimes the stone bounces off the closed window, sometimes it sails

through the open window, and sometimes it *breaks* the window.
"I only wanted to find out if the window was open or closed" is not

generally considered an excuse to avoid responsibility for the broken

pane....

David Gillett


-----Original Message-----
From: Craddock, Larry [mailto:l_craddock () wfec com]
Sent: Friday, March 24, 2006 11:59 AM
To: security-basics () securityfocus com
Subject: RE: application for an employment

Seems to me port scanning is neither picking a lock or seeing a door

hanging wide open but more like rattling a door to see if it is

unlocked. I don't know about you, but if someone comes by my house

and

rattles the door to check whether or not it's locked I'm going to

assume he has bad intentions whether he does or not and he'll need

to be prepared for my response.



-----Original Message-----
From: L G [mailto:nitziya74 () hotmail com]
Sent: Wednesday, March 22, 2006 6:23 PM
To: security-basics () securityfocus com
Subject: Re: application for an employment

This is a good thread which begs further discussion.

I guess the crudest part of my question is, was Mathias picking a

lock, or did he see a door hanging wide open?
And at what point is someone going through an open door versus

looking

in a window versus admiring someone's architecture from the street?

lg

--------------------------------------------------------------
-------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The

Norwich

University program offers unparalleled Infosec management education

and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree

customizations including Emergency Management, Business Continuity

Planning, Computer Emergency Response Teams, and Digital

Investigations.

http://www.msia.norwich.edu/secfocus
--------------------------------------------------------------
-------------



----------------------------------------------------------------------
--
---
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich

University program offers unparalleled Infosec management education

and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree

customizations including Emergency Management, Business Continuity

Planning, Computer Emergency Response Teams, and Digital
Investigations.


http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------
--
---


Liability limited by a scheme approved under Professional Standards
Legislation in respect of matters arising within those States and
Territories of Australia where such legislation exists.

DISCLAIMER
The information contained in this email and any attachments is
confidential. If you are not the intended recipient, you must not use or
disclose the information. If you have received this email in error,
please inform us promptly by reply email or by telephoning +61 2 9286
5555. Please delete the email and destroy any printed copy.

Any views expressed in this message are those of the individual
sender. You may not rely on this message as advice unless it has been
electronically signed by a Partner of BDO or it is subsequently
confirmed by letter or fax signed by a Partner of BDO.

BDO accepts no liability for any damage caused by this email or its
attachments due to viruses, interference, interception, corruption or
unauthorised access.

----------------------------------------------------------------------
----- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The

Norwich University program offers unparalleled Infosec management

education and the case study affords you unmatched consulting
experience.
Tailor your education to your own professional goals with degree

customizations including Emergency Management, Business Continuity

Planning, Computer Emergency Response Teams, and Digital
Investigations.

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------
-----



Liability limited by a scheme approved under Professional Standards
Legislation in respect of matters arising within those States and
Territories of Australia where such legislation exists.

DISCLAIMER
The information contained in this email and any attachments is
confidential.
If you are not the intended recipient, you must not use or disclose the
information. If you have received this email in error, please inform us
promptly by reply email or by telephoning +61 2 9286 5555. Please delete
the
email and destroy any printed copy.


Any views expressed in this message are those of the individual sender.
You
may not rely on this message as advice unless it has been electronically
signed by a Partner of BDO or it is subsequently confirmed by letter or
fax
signed by a Partner of BDO.

BDO accepts no liability for any damage caused by this email or its
attachments due to viruses, interference, interception, corruption or
unauthorised access.

------------------------------------------------------------------------
---
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting
experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity
Planning,

Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---



Liability limited by a scheme approved under Professional Standards
Legislation in respect of matters arising within those States and
Territories of Australia where such legislation exists.

DISCLAIMER
The information contained in this email and any attachments is confidential.
If you are not the intended recipient, you must not use or disclose the
information. If you have received this email in error, please inform us
promptly by reply email or by telephoning +61 2 9286 5555. Please delete the
email and destroy any printed copy.

Any views expressed in this message are those of the individual sender. You
may not rely on this message as advice unless it has been electronically
signed by a Partner of BDO or it is subsequently confirmed by letter or fax
signed by a Partner of BDO.

BDO accepts no liability for any damage caused by this email or its
attachments due to viruses, interference, interception, corruption or
unauthorised access.

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------



---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault