Arbor Networks DoS defense product

Fri May 17 14:08:47 UTC 2002

On Thu, May 16, 2002 at 02:44:58PM -0700, Dan Hollis <DH> said, in response
to a message on Thu, 16 May 2002 by Dragos Ruiu <DR>:

<DR> Some people are get all hyper and complain.  Which is silly imho.
<DR> If you don't like it, stop your network from responding to it.

<DH> Thats exactly what we plan to do with BGP blackholes and landmines.

<DR> Don't bitch and whine if your equipment is silly and leaks info. It's 
<DR> not the world's problem to compensate for _your_ inferior network 
<DR> architecture or shoddily designed network hardware.

<DH> Then you shouldnt be whining about a BGP blackhole system.

<DR> Portscanning by no means proves "intent". Or should provoke hostile
<DR> reaction.

WRONG. Time to retake Logic 101 and Ethics 101. What other intent than malice
(or, at best, "unhealthy interest in somebody else's network") could
portscanning someone else's network show? If you don't own it, and aren't
involved in an official capacity, chances are high that you should Just Stay
Off. This includes portscans. To do otherwise shows you are probing for
points of attack/entry - I don't see how you can argue otherwise. If I am
missing the obvious altruistic motive for portscanning, please enlighten me.

A portscan is a sign that somebody is probing your defenses, trying to find
out where they might get in. Why should this NOT get a hostile (or at least
defensive) reaction? Looking for any legitimate reason here.

<DH> Blackholing isnt hostile its defensive.

<DR> But then again I'm of the radical opinion that if your host is compromised
<DR> it is your fault for not taking appropriate precautions on inbound
<DR> filters or gateways.

Obviously, the person that actually did the typing to crack a machine is not
responsible for his/her keystrokes. The person that scanned the network to
find weaknesses is surely not culpable for gathering and using such
information. Just like if a bank has 100-year-old security and leave the
vault door open, the person that walks in and picks up a bag of money is not
responsible for stealing - it's the bank's fault for not providing adequate
security.

Yes, network operators have a responsibility to their shareholders, if nobody
else, to secure their networks. But that IN NO WAY takes the responsibility
for illegal action off the shoulders of the person that committed it.

<DH> The blackholing is the response to networks which cant be bothered to 
<DH> clean up their compromised hosts. Youre ranting against the wrong target 
<DH> im afraid. Please go back and read the thread from the beginning.

<DR> I can't help it if your host does funny things when I send them funny 
<DR> packets.... :-)

<DH> Why are you sending funny packets?

Exactly. If you want to send funny packets, send them to your OWN network, or
get a job as a security consultant and do this kind of thing for money. Don't
try to rationalize illegal behaviour by shifting blame to somebody else.

(Note: again, not saying portscanning is illegal. Other activity (break-ins,
etc.) has been discussed in this message.)

-- 
Scott Francis                   darkuncle@ [home:] d a r k u n c l e . n e t
Systems/Network Manager          sfrancis@ [work:]         t o n o s . c o m
GPG public key 0xCB33CCA7              illum oportet crescere me autem minui
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 872 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20020517/6567a937/attachment.sig>