- Test - lists.nanog.org

Re: Port scanning legal
by Steven M. Bellovin 20 Dec '00

20 Dec '00

In message <Pine.LNX.4.30.0012190930530.27364-100000(a)labyrinth.local>, "Edward S. Marshall" writes: > >http://www.securityfocus.com/templates/article.html?id=126 > >A quick quote from the article: > > A tiff between two IT contractors that spiraled into federal court > ended last month with a U.S. district court ruling in Georgia that > port scanning a network does not damage it, under a section of the > anti-hacking laws that allows victims of cyber attack to sue an > attacker. > > Last week both sides agreed not to appeal the decision by judge Thomas > Thrash, who found that the value of time spent investigating a port > scan can not be considered damage. "The statute clearly states that > the damage must be an impairment to the integrity and availability of > the network," wrote the judge, who found that a port scan impaired > neither. > >This may have ramifications for both security professionals and abuse desk >personnel; this ruling would seem to make it clear that you cannot claim >time spent investigating abuse issues as damage. The complete finding is >here: > > http://pub.bna.com/eclr/00434.htm > >Any armchair lawyers on the list want to take a crack at this? As always, your mileage may vary. California law specifically states that costs incurred by the victim include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access. So checking out a scan might qualify. As for "access", it's defined as "Access" means to gain entry to, instruct, or communicate with the logical, arithmetical, or memory function resources of a computer, computer system, or computer network Specific crimes include (6) Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section. (7) Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network. Does a port scan "communicate with" the specified part of a computer? FYI, these are from Section 502 of the California Penal Code, at http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&group=00001-01000…

2 1

Re: Port scanning legal
by Marius Strom 19 Dec '00

19 Dec '00

*frantically rewrites AUP's to read as follows:* 5.17 While we provide network connectivity, you must verify the host you are connecting to by using whois(1) to make sure it's not a military or government site. Use information from the whois(1) records to contact by phone the sites in question. Make sure to contact ARIN/RIPE/APNIC before querying their whois servers. Contact us before querying our DNS servers for ARIN/RIPE/APNIC hostname information. Not to step in the middle of a firefight without a waterhouse, but come on guys, this is getting absurd. On Tue, Dec 19, 2000 at 12:26:16PM -0800, Dan Hollis wrote: > > On Tue, 19 Dec 2000, Roeland Meyer wrote: > > I've pinged IP addrs that I later found out were MIL addrs. Nothing > > happened. Duh! > > Cool. Care to portscan a couple .mil /16's and get back to me? > > > There are a LOT of IP addrs that aren't in the DNS. How is one to know? > > Hmm. whois perhaps? > > connecting to whois.arin.net [192.149.252.21:43] ... > HQ 7th Signal Command (NETBLK-ARMY-C) NETBLK-ARMY-C198.49.183.0 - 198.49.192.0 > INFORMATION SYSTEMS COMMAND (NET-NSMCNET) NSMCNET198.49.185.0 - 198.49.185.255 > > Naah, that makes too much sense. Can't have that now can we. > > > I don't know about you, but I flunked telepathy in High School and did > > worse in clarvoyance. > > One might argue its not the only thing you flunked. > > > Could it be, that is why ping and traceroute were invented? > > ping and traceroute are a far cry from nmap. I dont recall ping and > traceroute having a 'decoy host' option, or 'stealth' option for example, > nor any option to scan entire nets and ranges of ports. > > > The argument against port-scanning applies equally well to just about every > > diagnostic tool we use. > > Only by the most convoluted thinking. > > -Dan > -- Marius Strom <marius(a)marius.org> Professional Geek/Unix System Administrator URL: http://www.marius.org http://www.marius.org/marius.pgp 0x55DE53E4 "Never underestimate the bandwidth of a mini-van full of DLT tapes traveling down the highway at 65 miles per hour..." -Andrew Tanenbaum, "Computer Networks"

1 0

RE: Port scanning legal
by Roeland Meyer 19 Dec '00

19 Dec '00

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Tuesday, December 19, 2000 2:23 PM Thanks for re-quoting this ... > In message > <Pine.LNX.4.30.0012190930530.27364-100000(a)labyrinth.local>, "Edward > S. Marshall" writes: > > > >http://www.securityfocus.com/templates/article.html?id=126 > >This may have ramifications for both security professionals > and abuse desk > >personnel; this ruling would seem to make it clear that you > cannot claim > >time spent investigating abuse issues as damage. The > complete finding is > >here: > > > > http://pub.bna.com/eclr/00434.htm > > > >Any armchair lawyers on the list want to take a crack at this? After reading the specifics I could find. It would seem that you could bill for the investigation only AFTER there has been a break-in. Bad analogies aside, a port scan isn't a break-in, by any stretch of the imagination. Therefore, on its own, it's not billable. However, if a break-in has been proven, time spent on the investigation, before-hand, becomes billable. -- IANAL - I Am Not A Lawyer. Before taking action on anything I say, you are encouraged to seek legal advice.

1 0

RE: RFC Outlines
by Sami Juvonen 19 Dec '00

19 Dec '00

> Can anyone refer me to an RFC or similar documentation that outlines > how an RFC should be written? http://www.rfc-editor.org/

1 0

RE: Port scanning legal
by Mathew Butler 19 Dec '00

19 Dec '00

If someone leaves their network open to the scan in the first place, it's their own lack of due diligence. However, someone going through a hole that's been detected is bad juju. -Mat Butler -----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Tuesday, December 19, 2000 11:46 AM To: Shawn McMahon Cc: 'nanog(a)merit.edu' Subject: Re: Port scanning legal On Tue, 19 Dec 2000, Shawn McMahon wrote: > Better lock me up; I can't count the number of times I've nmap-ed > somebody just to find out what OS they were using, either for personal > curiosity, or as part of an argument. Cool. Since you're obviously in the right, how about scanning some U.S. military networks and letting us all know what OS they are using? If you like, I'll start an argument with you so you have the justification you need to portscan. -Dan

1 0

Where are ATM NAPs going?
by Ben Buxton 19 Dec '00

19 Dec '00

I'm interested in peoples thoughts as to what is happening with the future of ATM NAPs. Are people moving away from them or are they still quite popular? Downsides or upsides? I'm trying to gauge whether they are worthy of investing equipment and hassle into for peering... -- Ben Buxton - Random Network Person

9 12

RE: Port scanning legal
by Jade E. Deane 19 Dec '00

19 Dec '00

Could we all please put away our members for a moment? The bottom line is, there are times and places where "port scanning" is required. I would assume the intelligence level of this group warrants no in depth explanation or case study. How about this, differentiating between legitimate "port scans" and preempts to an attack. How, when, and where. Also, correct escalation procedures to security departments and law officials. Jade Jade E. Deane Network Engineer helloNetwork.com Las Vegas, Nevada Office: +1 (702) 938-9267 Cell: +1 (702) 604-4759 Fax: +1 (702) 456-1471 email: jade.deane(a)helloNetwork.com urgent epage: 7026044759(a)page.nextel.com -----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] Sent: Tuesday, December 19, 2000 12:41 PM To: 'Dan Hollis'; Roeland Meyer Cc: Shawn McMahon; 'nanog(a)merit.edu' Subject: RE: Port scanning legal > From: Dan Hollis [mailto:goemon@sasami.anime.net] > Sent: Tuesday, December 19, 2000 12:26 PM > > The argument against port-scanning applies equally well to > just about every > > diagnostic tool we use. > > Only by the most convoluted thinking. Let's see, we *are* talking court cases and lawyers here ... what was that you said about convoluted thinking? When was th last time you argued with an attorney, either in or out of court? When was the last successful time?

1 0

RE: Port scanning legal
by Roeland Meyer 19 Dec '00

19 Dec '00

> From: Dan Hollis [mailto:goemon@sasami.anime.net] > Sent: Tuesday, December 19, 2000 12:26 PM > > The argument against port-scanning applies equally well to > just about every > > diagnostic tool we use. > > Only by the most convoluted thinking. Let's see, we *are* talking court cases and lawyers here ... what was that you said about convoluted thinking? When was th last time you argued with an attorney, either in or out of court? When was the last successful time?

1 0

Re: Where are ATM NAPs going?
by Richard A. Steenbergen 19 Dec '00

19 Dec '00

On Mon, 18 Dec 2000, Leo Bicknell wrote: > > On Mon, Dec 18, 2000 at 09:14:53PM -0500, John Fraizer wrote: > > So, what you're saying is that I should tell all the folks that want to > > peer via ATM at CMH-IX (which supports 10/100/GE at this time) that they > > should get bent or get GigE, right? > > > > THANK YOU! > > I had to go google search for this one, and I presume you mean > http://www.cmh-ix.net/. If so, it's a good thing the operators made the > wise decision to support GigE, otherwise they couldn't possibly expect > to meet demand. :-) In this case, perhaps an 8-port Linksys hub would be more appropriate for their needs. :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

4 4

RE: Qwest yesterday?
by Ralph Forsythe 19 Dec '00

19 Dec '00

Their usual excuse is a fiber cut somewhere, but they didn't even give me that this time! The thing is, my CSU was green so I know the physical circuit integrity was there. I'd think it was a bad route, but it didn't seem to propogate far enough to be that (my Qwest DSL worked fine, and other parts of their network were ok), so I'm leaning towards catastrophic router failure, though I can't imagine why it wouldn't have gone to backup. Surely Qwest has redundancy... ??? - Ralph Forsythe ralph(a)centerone.com At 09:06 AM 12/19/00 -0800, you wrote: >It has been my experience that the last mile in the mile high city is the >worst last mile ever. Qwest and USWest have had multiple outages for our >T1 in Denver, but we never are given a very good RFO. (reason for >outage) the best we have been told is that on separate instances we lost >a load coil, redundant sonnet rings for the city, a repeater and a bad CSU >chassis. Our ISP is concentric, but I think the physical lines in Denver >are the problem. Good luck! > >Ciao! > >Andrew Lewis >KORE >Newport Beach, California >www.kore.com

2 1