Text 22251, 94 rader
Skriven 2006-01-13 07:20:42 av Matt Bedynek (1:106/1)
  Kommentar till text 22244 av Michiel van der Vlist (2:280/5555)
Ärende: Editor's censorship
===========================
Hello Michiel.

13 Jan 06 12:36, you wrote to me:

 MvdV> I nevertheless feel that it is only fair that the accused get to see
 MvdV> the evidence against them that the accusers claim exists.

I certainly would like to see evidence if anyone accused me of something.

Do you know how to find and/or penetrate vulnerabilities in software?

Have you ever done it before?

 MvdV> well, it wasn't me. And I am a bit puzzled by the "one or more of
 MvdV> you". That suggests some kind of conspiracy.

Not at all.  I consider port scanning harmless anyway.  Also consider that 
majority of the port scans I see actually originate overseas.  And out of
those, majority come from the nl.  Is it possible that a host in your netblock
actually scanned his system?  Yes.

 >> Though in my opinion, that is not hacking.

 MvdV> Same here. Shannon however seems to think so and banned access to his
 MvdV> system for the suspects because of it.

You know I disagree with the interpretation of policy that allows one to limit
access.  I do believe if someone is being annoying enough policy should be used
to resolve the issue.  And, if someone is unwilling to accept the risks of
making their system public they should not make it public at all; become a
point instead.

 MvdV> This mildly annoying, but what I find more serious it that after the
 MvdV> incident I also found myself locked out of several US government and
 MvdV> government related sites. I have obviously landed on some blacklist
 MvdV> and I suspect Shannon had something to do with that.

I highly doubt that.  Such decisions are usually made high up in the chain.  In
fact, the government contracts out such responsibilities to companies.  It was
likely decided upon by some paranoid network admin contractor.

 MvdV> In your considered opinion is it possible to perform a port scan
 MvdV> using a faked IP address for the originator?

I believe we discussed this in the past?  But yes.  Although the data returned
in the port scan would not reach back due to the spoofed source address. 
Source address spoofing is commmonly used in ICMP or UDP DOS/DDOS attacks; UDP
is a connectionless protocol.  Most service providers now or should be doing
reverse path filtering.  That means if the interface I connect via has a subnet
of 192.168.0.0/28 assigned to it, it will not permit traffic via that interface
originating outside that range.  Though, there may be places on the internet
that do not.

 MvdV> I probably was port scanned as well, but as I have no way of even
 MvdV> knowing it, I fail to see how I could ever construe it as annoying. A
 MvdV> simple port scan merely bounces off the firewall in my dsl router. I
 MvdV> never know about it. And no that is not a 20.000 Dollar device, these
 MvdV> home routers go for 30 Euro or so.

A linux or freebsd system would make a better router as you could run an IDS as
well.  An IDS can pick up signatures on the wire much like a virus scanner
detects signatures in memory.  In fact, you can pick up vulnerability and port
scanning.  Do be aware, that with such things, false positives are possibile or
even routine.

 MvdV> So we agree on that. Over here computer hacking is a criminal
 MvdV> offence.  An unjust accusation of an attempt to hack is ground for a
 MvdV> slander charge.

 MvdV> That is if Shannon were ever to come here and repeat his accusations
 MvdV> in the presence of witnesses....

I'd would hope people would not be so lawsuit happy.

 >> Hey, I'm not looking to judge anyone, simply offer an
 >> interpretation of the data.  In fairness, any conclusions I
 >> were to make could be totally wrong.

 MvdV> Then what is the point? Do you really believe that if you came to the
 MvdV> conclusion that the evidence was insufficient, Shannon would
 MvdV> apologize, remove the lockouts and back off?

Have you attempted to communicate with him privately to resolve personal
differences rather than continuing to escilate the situation?  Note: I am not
blaming just you.

Matt

e-mail: matt [at] thunderdome.us | icq: 16568532 | yahoo: mbedynek

"to be loved is fortunate, but to be hated is to achieve distinction"

---
 * Origin: ..::[ high speed feeds - http://fido.thunderdome.us/ ]::.. (1:106/1)