Re: Yet another thread on the legality of port scanning

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2004-03-17 Charley Hamilton wrote:
> > There is no place to publish open ports, accepted protocols, and
> > authorized users.
>
> Authorized users are told they are authorized users.  If you are not
> an authorized user, what difference does it make what protocols are
> accepted?

Then how do I become an authorized user of www.google.com?

[...]
> The "reasonable man" hypothesis applies to connecting to a system to
> which authorization is in doubt.  Would a reasonable man conclude that
> http://www.cnn.com is an acceptable connection in the absence of
> explicit permission?  I would say yes, he would. Would a reasonable
> man conclude that ftp://www.cnn.com is an acceptable connection in the
> absence of explicit permission? I would argue no, he would not.
> What's the difference?  HTTP is generally accepted to be a public
> connection, in the sense that it is intended as a shared resource, to
> be accessible to all.  FTP is not generally accepted as such,
> regardless of what electronic storefront happens to be offering the
> service.

That's simply not true.

> Similarly, www.foo.com is generally expected to be a public http
> server.  Therefore, making an HTTP connection to that server is
> reasonable.  accounts-payable.foo.com is *not* generally expected to
> be a public http server.  Therefore, it is not reasonable to assume
> that it would be offering public http services.  Any such services
> would reasonably be intended for authorized users only.

No.

Regards
Ansgar Wiechers

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------