Slashdot Mirror
Anti-Censorship Efforts And Port Scanning
scubacuda writes "According to Wired, the University of Toronto's Internet Censorship Explorer permits people test the limits of national and organizational Internet-blocking schemes. Users enter a target URL (and a country), and the software then scans the ports of available servers in that country, looking for open ones to connect on from behind that country's firewall. Many consider port scanning a gray area, as it's often used by various hackers to find vulnerabilies that can be exploited."
"They're obviously using resources that would not normally be available. Using someone else's resources without their knowledge is abhorrent to us."
Of course, the people with the open proxies have provided a public service to the world. His argument would be similar to someone setting up a website, and then complain when someone uses it without their knowledge. Or putting a sign on your front door that says "Open for Business, please come in" and then complaining when people walk in.
If you don't want people using your computer, don't provide public services on it.
Travis
On the other hand, it is taking network resources without asking permission and could conceivably even cause trouble for the network administrator or business or its customers.
However, if the netadmin is competent, there's no problem because there won't be any open ports available to the outside for proxy use anyway. Moreover, it's exactly the incompetent sysadmin who leaves ports open who is responsible for the open relays that are used for the bulk of the spam that clogs our email boxes. If a sysadmin gets grilled for a week or two over his system's attempt to access "forbidden sites", perhaps this will teach him that it's time to lock down his system and if he doesn't know how to, find out NOW.
This makes the program a good idea in any case. Anything that disproportionately hammers stupid sysadmins is a good thing, even if the sysadmin is the owner of a single box with a broadband connect that due to the usual end-user cluelessness, is 0wN3d by every script kiddie on the Net and whose bandwidth is mainly used to spread either trojans or spam.
Tech Public Policy stuff
From the article:
.
"This to me is no different than hacking," said Jon Asdourian, a computer forensics examiner with Stroz-Friedberg. "They're obviously using resources that would not normally be available. Using someone else's resources without their knowledge is abhorrent to us."
Thats just crap - if somebody leaves a proxy-server open to the world, they can hardly complain when *gasp* somebody uses it as a proxy server . .
And as somebody mentioned earlier, port scanning itself is not inherently wrong. Its people putting the information gained from port scanning to ill use that is wrong.
It strikes me that there's some analogy to gun control here - port scanning doesn't root computers, hax0rs root computers . . .
Too right. Why are they scanning for vulnerabilities? Because they know people don't fix them. Well.. tough shit. Fix them, or get hacked. Whats hard about that? There's certainly no grey area there. If you run an unpatched site, you should be held up to public ridicule as surely as if you allow yourself to be used by spammers. Too bad you get to lose your data. But blaming port scanning in general? I don't think so.
Put up or shut up!
Suppose I came to your house, found the door to be unlocked and decided to come in and take your stuff. Or if you object to me taking your stuff, let's say I just look around because I'm simply curious (i.e., the common "hacker who got caught" defense). I'll just rifle through your bank statements, pictures of your girlfriend, etc. No harm, no foul -- right?
Finally, don't tell me it the owner's fault for not locking the door. Yes, they did something stupid. But it hardly justifies the actions that the intruder takes to abuse them.
You go up to something that looks like a store, and try the doors to see if it's open.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Do I understand this correctly? They're port-scanning for proxies *within totalitarian regimes* and then bouncing requests for *restricted material* off of those machines? What the hell happens when the totalitarian regime gets angry? All they see is a machine *in their country* repeated trying to access restricted information. They won't go beat up these "researchers" in Canada, they'll go beat up/arrest/jail/re-educate the poor sysadmin who doesn't know how to configure a proxy properly. That's just f-ing irresponsible on the part of these "researchers".
> If you come to my house and try all the doors to see what's open to the general
> public, you'll probably get shot or at least get to see how well your head is
> capable of decelerating a baseball bat.
Except your home isnt a public place.
Your home is a private place, for you.
So to extend that to computers.
Your PC behind a firewall is a private place.
Did anyone claim it was OK to attempt to break in through a firewall?
No. So please stop arguing that point.
A webserver is indeed a public place.
Its more compared to the general use lodge at the park down the street.
And let me tell you, if you attacked me while i was attempting to see if the doors were open on that public general use lodge, you would clearly be in the wrong for doing so.
When you run a webserver, you are allowing the general public. If you dont want the general public there, take measures, ANY MEASURES AT ALL, to stop them!
Leaving a webserver on a public network with no filters, firewall rules, IP access lists, or authentication, can not in any way be argued as taking measures to prevent access to it. You wouldnt have a leg to stand on.
Its akin to putting a tarp down on the ground, setting out your , no walls or screens or covers or anything, then complaining when people look at that is laying out in the open.
If you dont want that stuff being looked at, dont put it there in public.
Same difference with a webserver.
As for your comment of not polite. Inviting people into your home, then shooting them for tresspassing is what _I_ call impolite. That is basically what you are trying to justify being OK.
You are not comprehending the post you responded too. Let's face it, the internet is a public place, if you want privacy use a VPN or similar tools. This would require some knowledge, yes. Correcting your analogy, scanning ports is like jiggling doorknobs of *public* buildings, or window shopping. If it's supposed to be a private "door", well then, the owner had better make it so.
It also finds things that are meant to be open. So?
By making this knowledge available to those who live in countries whose government censor internet access, they become empowered to bypass whatever censorship that's imposed on them. The government may block public proxy servers or sites that provide listings to them, but they can't stop someone from discovering proxy servers themselves!
For this very use alone some governments probably make sure port scanning is illegal (if it isn't already). In that case, these governments have better also block all sites that offer port scanning services, which would itself function as a proxy to construct services to find proxy servers.
It's like whack-a-mole, big brothers can try to take out one path to circumvent their restrictions, but sooner or later another one will pop up, and another one, and another one...
Yes, we do hate it.
It's OK to circumvent another countries censorship laws, but it's not ok to try to remove a corrupt government that tortures and abuses it's people, or is hostile to neighbouring countries?
No, it's not OK to not respect the UN and its jurisdiction. It takes a big man to say "We know we're right, but the UN says we're wrong, so we'll do what we want anyway because we're the biggest." It takes a bigger man to say "We know we're right, but we'll respect the sanctity of the UN by not going in, because that's the will of the rest of the world."
What makes you so sure that you're the one who's right, when everyone says you're not (where "everyone" = Everyone except USA, UK, Australia and Spain)?
That is really a crock. If a program crashes because of data it receives from the network, it is buggy, and should be fixed. Unless the sender sends data with the intention to interfere with the scanned machine's operation, it is silly to blame the sender for damage. This is a common criteria for laws: certain actions are forbidden only if there are "bad" intentions, as can be demonstrated in a court.
You have every right to block port scanners just as they have every right to scan your ports. It may be your system, but you have it hooked up to a public internet with a public IP address. You do not own either of those, and by using them you are entering a social contract. You can't tell people on the street not to look at you just because you're naked, or think staring is rude. You can only either go home where you have privacy, or put some clothes on.
Everyone is entitled to their own opinion. It's just that yours is stupid.
If you put a machine on the net, you just made all of your ports and services public. The internet is a public medium, not a private one.