On Thu, 23 Dec 1999, Eric wrote:
> That is why I was wondering about certain common computer services. I
> would imagine for those services that are pretty much available to
> everyone that there is some kind of consent normally given. However,
> if those services are abused, such as a ping attack on a computer or
> on a network, that it would pass the line beyound that consent. And
> for things that are not a service such as BackOrifice, only scans made
> by the explicit permission of the owner or other authorized person
> should be made. Anyone else making such scans is clearly doing so without
> the benefit of any permission of the owner of the computer.
Worse-yet, such laws don't address "stupid" protocols and protocol
practices like the computer scanning its "Network Neighborhood", trying
to do SNMP auto-discovery, PC Anywhere looking for available hosts...
Nor does it seem to address times when the computer implies consent, or
the use of a scan to try to link back a scan...
Perhaps what we need is a well-known protocol that defines a network policy,
usage agreement, etc. that responds to a broadcast packet for a subnet, or is
forwarded from a specific port on the subnet's gateway (so CIDR doesn't hurt
anyone's brain). Then we'd be able to point to it and say "If the
attacker didn't read this, they're at fault" If they did and still did
something against the policy, then they're liablously at fault.
Actually, the best place would be in the reverse zone file somewhere.
Thoughts?
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
[EMAIL PROTECTED] which may have no basis whatsoever in fact."
PSB#9280
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
