<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Re: [luau] RE: Request for off line security help</TITLE>
<META content="text/html; charset=iso-8859-1" http-equiv=CONTENT-TYPE>
<META content="MSHTML 5.00.2920.0" name=GENERATOR>
<META content=20011112;21185200 name=CREATED>
<META content="Ben Beeson" name=CHANGEDBY>
<META content=20011112;22380000 name=CHANGED></HEAD>
<BODY>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>First
I need to apologies for jumping the gun on my response.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>Reading your question here, I automatically thought you
had been</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>pinged
by one of our footprint servers by the response you got</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>from
the NOC. I didn't look at your email to Digital Island,
and</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>I
should have, because I would have know that you were not</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>scanned by a server on our footprint
network.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>You
received the our canned response, unfortunately who ever
sent</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>you
that did not fully examine your attachment, if they would</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>have
the would have known, or should have known it wasn't</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>coming
from our footprint network.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>The IP
that you were scanned from is a customer of ours,</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>Qualys.com. They are a security company that
business hire</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>to do
comprehensive security screening.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>I do
not know why they were scanning you. It could be one
of</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>reasons:</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>1. Road runner hired them to do an assessment on
their network.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>2. Someone may have compromised their network and
is doing </SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>scans
from behind their firewall.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001>3. Someone in their company is messing
around.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>I'll
follow up on this, and try to find out what is going on.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>You
were absolutely right to question the response you got</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>from
us. I need to also find out who sent you the reply.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>Sorry
about the confusion.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>Now
for the associates position in HI, I don't know if they</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>hired
someone or not yet. The request was sent internally</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>and
may not have been posted to our website yet, but I will</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>speak
with the head of the department in the morning and</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>see if
he is still accepting resumes. I'll let you all know</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN class=410475208-13112001>as
soon as I find out. </SPAN></FONT></DIV>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=410475208-13112001></SPAN></FONT> </DIV>
<BLOCKQUOTE
style="BORDER-LEFT: #0000ff 2px solid; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px; PADDING-LEFT: 5px">
<DIV align=left class=OutlookMessageHeader dir=ltr><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Ben Beeson
[mailto:beesond001@hawaii.rr.com]<BR><B>Sent:</B> Monday, November 12, 2001
10:38 PM<BR><B>To:</B> Linux & Unix Advocates &
Users<BR><B>Subject:</B> [luau] RE: Request for off line security
help<BR><BR></DIV></FONT><PRE><FONT size=3>Aloha all,</FONT>
<FONT size=3> I didn't mean to stir up quite such a hornets nest!!! Chris, I hope
you or your company are not offended by my question. I did not intend
to imply that something untoward was about, I honestly didn't know what
was up. Because I needed some help and also wished to respect the good
intentions of those involved through the "first, do no harm" principle,
I asked for an off-line look. </FONT>
<FONT size=3> To expand on several of the issues on the list, I'll offer the
following with good intentions and hope that it is well received. </FONT>
<FONT size=3> </FONT>
<FONT size=3> Yes, I get scanned all the time. Most of the scans I get usually fall
into the "ignore" box and I send them off to /dev/null. You know what
I mean, some windows user boots up and his box checks the "network" for
available file and print services. Stuff like that... </FONT>
<FONT size=3> Occasionally, I get a more serious scan or series of scans against my
box. If something about it strikes me as unusual, I usually drop a
note to the owner of the IP address block and ask them to look into it.
Sometimes I get an answer back, but usually I don't. Most of the
answers I get back are very informative. Once in a while I even get an
answer that just makes me think... I always learn something from the
answers I receive though. In any case, the scanning usually stops
after that either because I fixed it, or somebody else fixed it. </FONT>
<FONT size=3> I don't think all portscans are bad, but sometimes it's hard to tell
the good ones from the bad ones (especially if like me, your knowledge
is limited.) For example, I exchanged e-mail with one particular ISP
provider that made a habit of reverse scanning addresses making certain
connections to check for the presence of a particular windows hack that
was troublesome to their business. They further went on to state that
they would help customers rid their systems of the particular infection
they were concerned with if it was found. I thought that was kind of
cool and thought, "gee
---
You are currently subscribed to luau as: thecomputerguy@hawaii.rr.com
To unsubscribe send a blank email to $subst('Email.Unsub')
-- more guys should be so civic minded." I then
changed my firewall to ignore their specific scan. I learned a lot
from that, especially about firewall rules and good will. </FONT>
<FONT size=3> The idea of pushing material likely to be requested to a "nearby"
server in the "network topology" makes sense. I can see where visiting
a web site may attract the interest of a business and cause them to see
how to better serve the customer. After all, business's now have the
technology to know when I am looking at their web site. (As opposed to
whether or not I used the Sunday paper to light the BBQ grill before I
read their ad.) This may cause them to "push" the cache of potential
files to a nearer server to quicken the web's response to a query. </FONT>
<FONT size=3> I have to ask a question though. ((Please realize that this is an
honest question from a guy that drives jets for a living and
***plays*** with Linux in his spare time. This question is not
intended as an insinuation, it's just an expression of what is going
through my mind.)) My question is this, "Is a full portscan necessary
to find out what they need to know about where my box is and what it
may be able to provide to help their business? Would an address lookup
be enough, or does this business really need to know if I run a time
server (for example)?" I don't know the answer. I don't even know all
the issues attached to these questions... (No answer needed from the
list BTW.) Anyway, it has been quite a while since my box got scanned
as much as this one from the same IP address. </FONT>
<FONT size=3> That leads me to the initial question I posted to the list. I didn't
know what the scan was, what it represented, or why it was there. I do
know that it was a pretty big scan compared with others I see, so I
asked the NOC to look into it. They did, and I thought the reply I got
was about as different from any other answer that I had ever received
as it could be. I accept the NOC given reason at face value, but I had
never seen anything quite like this, so I asked the list for someone to
help me with an off-line look to help me figure it out.</FONT>
<FONT size=3> What did I learn? Three things so far: </FONT>
<FONT size=3> - There can be good business reasons for scans beyond system
security. </FONT>
<FONT size=3> - I am reassured that there are some very generous and helpful people
on this mailing list, and I am very grateful for that -- thanks again
to all of you. </FONT>
<FONT size=3> - I also learned that I need to read up on stateful firewalls before
I upgrade my box. There may be a way to "ignore" the good scans...</FONT>
<FONT size=3>Respectfully,</FONT>
<FONT size=3>Ben</FONT>
</PRE></BLOCKQUOTE></BODY></HTML>