Slashdot Mirror
Anti-Censorship Efforts And Port Scanning
scubacuda writes "According to Wired, the University of Toronto's Internet Censorship Explorer permits people test the limits of national and organizational Internet-blocking schemes. Users enter a target URL (and a country), and the software then scans the ports of available servers in that country, looking for open ones to connect on from behind that country's firewall. Many consider port scanning a gray area, as it's often used by various hackers to find vulnerabilies that can be exploited."
So now the countries will just block that site too. How useful.
<high-level position here>
<name of stupid small company here>
Portscanning finds things that are not meant to be open.
For example, IIS web services that MS "trusts" enough to give full system access to.
There is nothing wrong with scanning ports and seeing what services a particular server offers to the general public. It's not like it's circumventing any security measures, it's just using TCP/IP in a manner it was meant to be used in. This is like saying that p2p filesharing clients are in a gray market. There's nothing wrong with a p2p filesharing program, the problem lies with those that abuse it.
Everyone is entitled to their own opinion. It's just that yours is stupid.
People get too excited about port scanning. They also get exciting about network mapping that looks like port scanning (try tracerouting a lot of hosts).
Your ports will get scanned. Get over it. If it upsets you, look for ways to dump the traffic. Yes, it is an oft-used reconnaisance technique for profiling systems prior to attack. But if a portscan allows an attacker to mount a successful attack on the basis of finding open ports or a vulnerable OS, then your security is inadequate. It's your problem.
No, I don't think portscanning is "nice", but really, folks, it isn't going to go away, and you should be thinking more realistically about the defensive measures necessary to protect your systems.
This sounds like the claims made by the RIAA and MPAA and others when they got the DMCA created. "Some of it could be used by some people to do something illegal, therefore we should make it all illegal." Clearly, as this program itself demonstrates, there are legitimate uses for port scanning, so i fail to see why the technique itself should be considred a "grey area."
This Space Intentionally Left Blank
It's about the only action I'm getting these days.
thanks,
HAL
Best Windows Freeware
Really, what's so wrong about it? I mean, having a port open for use is like advertising a service. I think of a computer as a public office building - the kind dentists and lawyers work in - some doors are locked, various ones lead into offices. There is always a receptionist desk.
So, you can go down the hall and find out what offices are open to public business. Some doors are locked, some the secretary says "no, we don't want any new customers" or "you have to go get a t124350892 slip from elsewhere before you see the doctor" or "yes, we're open for business".
The admin is the security guard. If you don't want to be a security guard - lock the front door to the building. Any doors that contain offices that aren't for the public should be locked. Any doors that expect restricted traffic should be selective about who comes in.
Just because OS's are designed cryptically, software is careless, and it requires way more knowledge then it should to hold down a computer doesn't mean port-scanning itself is unethical.
In an ideal system, any server admin should be forced to see right on his main remote window what ports are open and what apps are running on them and what security is in place on each one. This should be on by default for any "dumb server" people plan to use. The problem is that there is that software is designed only for hardcores, and being used by people with a 5 page faq and the man pages. The user doens't see a nice UI showing him whats going on where, all he sees is a blinking white cursor. He knows he's installed a buttload of software, but has no clue what its doing. For efficiency's sake, the software is very cryptic, so he does not know what his machine is doing.
Really - fearing port scanning is security through obscurity. While in time-critical apps like network gaming there is a certain appeal to trusting the users, but in regular serving there should be no doors left open.
The solution to port-scanning isn't banning port-scanning, its making server boxen such that the admin knows what's going on.
According to their website:
NOTE: This wired article is not exactly accurate.
1. The ICE browser does not port scan anyone, it issues a request for a URL to a proxy server and returns the results to the user. There is no scanning of any kind.
The process of scanning occurs when open, publicly accessible proxies are identified by researchers in the Citizen Lab. The only ports checked are 80, 8080, and 3128, no others.
In many cases proxies are identified based on the fact that they are listed on websites that catalog lists of open, publicly accessible proxy servers. In such cases NO scanning is done.
You can read the rest here.
All my firewall events go into a DB, which I query daily. I have a set of reports showing things like average scans per second per host, most popular ports, most popular times of day, etc. If I see something incredibly suspicious I suppose I would try to investigate further -- but most of the time I just have a good time watching people bounce off my firewall.
If you don't want people sending packets to various ports on your box, perhaps you should disconnect it from the Internet.
> If you come to my house and try all the doors to see what's open to the general
> public, you'll probably get shot or at least get to see how well your head is
> capable of decelerating a baseball bat.
Except your home isnt a public place.
Your home is a private place, for you.
So to extend that to computers.
Your PC behind a firewall is a private place.
Did anyone claim it was OK to attempt to break in through a firewall?
No. So please stop arguing that point.
A webserver is indeed a public place.
Its more compared to the general use lodge at the park down the street.
And let me tell you, if you attacked me while i was attempting to see if the doors were open on that public general use lodge, you would clearly be in the wrong for doing so.
When you run a webserver, you are allowing the general public. If you dont want the general public there, take measures, ANY MEASURES AT ALL, to stop them!
Leaving a webserver on a public network with no filters, firewall rules, IP access lists, or authentication, can not in any way be argued as taking measures to prevent access to it. You wouldnt have a leg to stand on.
Its akin to putting a tarp down on the ground, setting out your , no walls or screens or covers or anything, then complaining when people look at that is laying out in the open.
If you dont want that stuff being looked at, dont put it there in public.
Same difference with a webserver.
As for your comment of not polite. Inviting people into your home, then shooting them for tresspassing is what _I_ call impolite. That is basically what you are trying to justify being OK.