Re: RPAT - Realtime Proxy Abuse Triangulation

From: Kevin Reardon (Kevin.Reardon@oracle.com)
Date: 12/27/02

  • Next message: Roger Thompson: "Re: NIMDA - ceased ? -" 
    Date: Fri, 27 Dec 2002 10:55:29 -0800
From: Kevin Reardon <Kevin.Reardon@oracle.com>
To: Incidents List <incidents@securityfocus.com>

    Is not SNMP used to manage the Internet? I would think that queries on
    public would not be illegal at all. More like a passerby looking at the
      sign on the door. Breaking into the system into the read/write
    community might land you in the clink (or if somebody got rambunctious,
    in Cuba).

    ---K

    Jay D. Dyson wrote:

    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    > On Tue, 24 Dec 2002, Mathias Wegner wrote:
    >
    >
    >>>I would be very nervous about running this, remote SNMP queries of
    >>>someone elses system (say a .gov or .mil proxy) may be considered
    >>>illegal activity in some jurisdictions.
    >>>
    >>Depending on the SNMP daemon, it would/should be as illegal as opening
    >>an ssh investigating the system from the command line. Most SNMP offers
    >>at least some amount of configuration via the read/write community. I
    >>know that when I see SNMP queries on network hardware that I manage, I
    >>consider it hostile activity.
    >>
    >
    > Color me jaded, but if someone has an open proxy and spam is
    > spewed my way via that avenue, it's a pretty fair bet that the system I'm
    > scanning is run by an admin who -- whether through ignorance or sloth --
    > doesn't know or do jack about securing or monitoring his system.
    > Moreover, open is open; whether a relay, proxy or anonymous FTP server.
    > It is impossible to be charged with breaking and entering when there's no
    > breaking involved.
    >
    > With that in mind, I would not waste any time or energy worrying
    > about whether or not my scan would be picked up. Let's face it, a spammer
    > just spewed through the idiot's proxy. Yet we're supposed to believe that
    > this otherwise lazy dope now possesses the Eagle Eye of All Intrusion
    > Detection Systems? Maybe I'm just cynical, but I really doubt it.
    >
    > All that said, I should point out that I am not a lawyer. I
    > prefer to make an honest living.
    >
    > - -Jay
    >
    > ( ( _______
    > )) )) .-"There's always time for a good cup of coffee."-. >====<--.
    > C|~~|C|~~| (>------ Jay D. Dyson - jdyson@treachery.net ------<) | = |-'
    > `--' `--' `How about a 10-day waiting period on YOUR rights?' `------'
    >
    > -----BEGIN PGP SIGNATURE-----
    > Version: GnuPG v1.0.7 (TreacherOS)
    > Comment: See http://www.treachery.net/~jdyson/ for current keys.
    >
    > iD8DBQE+DJooTqL/+mXtpucRAjy+AKCZ9eiSmvKyuSzZuNX9hbXTF9IDRACg4/gN
    > 2Gs+0tVYEQqykUc+/AUgFBg=
    > =/ofa
    > -----END PGP SIGNATURE-----
    >
    >
    > ----------------------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management
    > and tracking system please see: http://aris.securityfocus.com
    >
    >

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Linux and SNMP
      ... I was wondering how can one find out whether a given device responds to SNMP ... queries and if so, how can one query a device from a linux box? ... It seems to me that one has to know something called MIB ... and OID of a given device. ...
      (comp.os.linux.misc)
    • Linux and SNMP
      ... I was wondering how can one find out whether a given device responds to SNMP ... queries and if so, how can one query a device from a linux box? ... It seems to me that one has to know something called MIB ... and OID of a given device. ...
      (alt.os.linux)
    • RE: Configure Lenny client respond to snmp queries
      ... Snmp as the package to install to make these queries. ...
      (Debian-User)
    • Re: Problem with Canon 1023N and Windows 2003 SP2
      ... that queries our printers' SNMP at regular intervals. ...
      (microsoft.public.windows.server.general)
    • Re: SNMP Scans 02/17/02
      ... > I have some generic snmp rules to catch all SNMP scans/probes. ... > Wonder if this is the SANS snmp scanning tool? ... > This list is provided by the SecurityFocus ARIS analyzer service. ... > For more information on this free incident handling, ...
      (Incidents)