Re: probe backs? was Re: [INCIDENTS] Korea

[rquinn () SEC SPRINT NET (Rob Quinn)]

> [...] i often do a few telnets to odd ports (ie banner grabbing) and a quick
> nmap scan.

 I do passive scans against sites hitting me or my customers.

> i doubt i'm the only one who does this (i know i'm not), and i often tell
> people how to do it.

 I wouldn't do anything that would interfere with the victim's ability to
analyze the breakin. It's pretty tough when you know the middle man site
couldn't care less about you or their own security problems.

> is this frowned upon by the larger community?

 Unfortunately there seem to be no rules here except "if you can get away with
it it must be okay" and "we really have no idea what we can get away with". I
think if someone decided to jump on us, conduct that's "accepted by the larger
community" wouldn't mean much.

> so they can dismiss it as administrative probes when they find it in their
> logs.

 "administrative probes". I like that.

--
| Opinions are _mine_, facts                                     Rob Quinn |
| are facts.                                                 (703)689-6582 |
|                                                    rquinn () sec sprint net |
|                                                Sprint Corporate Security |