Great Circle Associates Firewalls
(April 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: [NTSEC] Re: L0pht Scanning - Beware
From: "George D. Nincehelser" <gdn @ swbell . net>
Date: Wed, 30 Apr 1997 04:05:42 -0500
To: Christopher Curtis <ccurtis @ facm . fit . edu>
Cc: nobody <nobody @ facm . fit . edu>, firewalls @ GreatCircle . COM, ntsecurity @ iss . net
References: <Pine . LNX . 3 . 95 . 970429110757 . 3241A-100000 @ homer>
Reply-to: gdn @ swbell . net

Christopher Curtis wrote:
> Okay, just to add an additional $0.02, if a port is a door and port
> scanning is like rattling doorknobs, let me ask you this: Are your doors
> open or closed?  And why isn't portscanning like knocking on the door?  Is
> it now illegal to knock?  They could be knocking just to see if you're
> home because they may want to break in if you don't answer ...

It's a little more complex than this, I think.

If someone knocks on your front door, that's one thing, but what if they
start checking your back door, side door, garage door, windows, pet
door, etc?  Is it appropriate to attempt access through ports not
normally considered access points?

For another example, lets look at a business.  If you walk up to the
door, try to open it, but find it is locked, no problem....the store is
closed and you walk away.  However, is it appropriate for you to try to
enter via the service entrance in back?  What about a window?  If you
find it is unlocked, is that clearence to go in?

> I think this thread has totally gotten away from normality.  If you don't
> want people in your port, close it.  Firewalls are good for this.  If you
> don't want people knocking on your door, either remove the door or move to
> a different neighborhood (eg, off the internet).
> 
> Or is this too blatantly simple to be real?

Either too simple, or we're just trying to stretch an analogy too far.

George


References:
Indexed By Date Previous: Re: Cisco PIX and Remote Access? (FW-1?)
From: Eric Vyncke <evyncke @ cisco . com>
Next: IP-Tunnelling
From: Sandeep Kumar Talwar <sandeep @ synergy . net>
Indexed By Thread Previous: Re: [NTSEC] Re: L0pht Scanning - Beware
From: Aleph One <aleph1 @ dfw . net>
Next: RE: [NTSEC] Re: L0pht Scanning - Beware
From: "Gomberg, Jeff" <gomberg @ synair . com>

Google
 
Search Internet Search www.greatcircle.com