I agree with Dave on this one. Dude Van, I thought it was illegal in the
states..? Or am I mistaken? Also, think of this from the ISP's view, do they
really want a service port scanning their users? And look at it this way,
said target has a proxy server on it, attacker proxies into the proxy and
scans the target server with that service, since he is now on the targets IP
address, I think you understand what I'm getting at by now. nmap is made to
find exploits, that is what this service is going to wind up being abused
for (in most cases that i know).
On 12/1/06, Dave Moore <dave.j.moore_at_gmail.com> wrote:
>
> On 12/1/06, Mike Huber <michael.huber_at_gmail.com> wrote:
> > first of all, IANAL, but the TOS seem to cover the basics... However, I
> am
> > unsure whether they would hold up under strict legal scrutiny. As far
> as I
> > can tell, they may hold up under US criminal law, but not under civil
> law,
> > as tort law has its own wonderful little eccentricities. The best
> safeguard
> > they seem to have is that they must log the source IP of all scan
> > requests... As far as I know, anyone who takes the time to read the
> nmap
> > man page should be able to craft a scan which won't be detected by the
> > scanned host (can someone be a definitive source on this point?), and
> anyone
> > taking malicious action ought to be taking sufficient precautions to
> avoid
> > detection anyway. None-the-less, my 8-ball sees litigation in their
> future.
>
> All nmap scans are detectable. All port scans are detectable. Just
> depends on how hard you're looking.
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Dec 01 2006
Intro
