New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Real 'good guys' get permission first.
There is a search engine called "Shodan". It's basically the Google equivalent of a port scanner. There is obviously a need and (commercial demand) for scanning ranges, subnets and even the internet as a whole. They don't ask for permission.
There was a research project that spawned a new kind of scanner optimised for speed because they wanted to see what the internet really looks like (don't have a link right now, will edit later).
I myself have occasionally scanned hosts apart of my own in the past, without expressed permission, just because I wanted to see what kind if webserver they were using.
I mean, yea port scanning often is the first indication of interest but people who really want to break into your servers will find a way with our without a port scanner.
https://github.com/robertdavidgraham/masscan
Created by a well known and recognized white hat.
Yes there are fairly benign/altruistic reasons for port scanning.
Seems like the thread will just be about the moral high ground for now.
I don't think either the customer or provider are right or wrong here, maybe the OP needed to be more realistic about this eventuality while the provider could be more explicit in their ToS.
That isn't port scanning, that is a look up on one specific port which is already advertised as public by them running a publicly accessible web site. That isn't comparable to mass scanning systems for open ports.
It's just about where you draw the line, he was looking for one specific port in fact.
Well, one specific port, known to be private (VNC) and mass scanning on different hosts from what I see. This isn't the same as looking up one web server that is publicly accessible.
That isn't necessarily true. What I would believe instead is that if it were for research purposes, they would do it from colocated equipment or dedicated machines, with the full cooperation of the hosting provider.
There are legitimate reasons to do internet-wide scans, such as surveying SSL support, or adoption of new protocol revisions, etc. But those legitimate research projects usually offer ways to opt-out of the scan, and provide documentation on what they are doing.
Even such cases are often illegal or a violation of ISP's acceptable use policy. I think you'd be hard pressed to find a major ISP that does not mention port scanning or 'unauthorized collection of data' in their AUP.
Level 3:
A User may not use the Service to monitor any data, information or communications on any network or system without authorization
Cogent:
"include but are not limited to port scans, flood pings, packet spoofing and forged routing information."
ATT:
"unauthorized monitoring, scanning or probing of network or system"
etc etc.
Gotta love the : "it's not in the TOS/AUP, then I can do it"
Ever heard of common sense?
Nyr, what country are you based in?
From what I can see, Spain?
Spain.
Maybe next time, @Nyr, do it from your home connection. Spain seems to be fine with it
http://seclists.org/nmap-announce/2003/41
And my home ISP is fine too. It's only that I don't have a fast connection, but it's perfectly fine to do from home.
I know that here in Australia it would get me a jail sentence, haha.
What datacenter is? Germany datacenters crazy in blocking IPS
OVH used to charge me VAT, I screamed at them until they refunded everything. It's actually pretty common that EU/UK companies are just like "hurr durr I collect tax from everyone." without actually knowing what their laws are on the facts, or what taxes they should actually be collecting.
Like fuck I'm paying 25% tax for a service.
"Yeah, I committed murder in Russia. But it's not illegal in Somalia, so I shouldn't be charged."
"Yeah, I did a port scan which isn't illegal in Germany (grey area, no jurisprudence AFAIK) nor Spain (clearly legal), so I shouldn't be charged".
If some network administrator feels like he can claim any damages from my activities, he's free to sue me.
That's not how that works. They complain to your network admin, and your service gets suspended or terminated. That is how it works, especially here in the US/Canada where it's actually illegal to touch a network you're not authorized to access.
As per EU laws, no idea where that stands as per unauthorized network access.
I'm sorry to tell you North American law doesn't apply all around the world, so I couldn't care less about it being legal or not in your country.
Someone can claim damages from what I did? Sue me and get an international court order. End of the story.
Well, let's see; What country was the target network in?
As I've said, they don't need to sue you; they can just complain to your network.
All around the world. Some of them could probably try to sue me if they want to, they can go ahead.
They can complain all what they want, but my Spanish ISP and many European ISPs are not going to disconnect me if I want to keep scanning whatever I want in the future (which isn't a thing I usually do, by the way).
some guy scanned ranges of ips from a vps, looking for vnc connections to "gaze at fondly while doing absolutely nothing because its not wrong m8" and got suspended for it?
did anyone respond "LOL" yet?
LOL.
Sorry, I meant suspension.
If you feel like you can claim filemedia owning you a refund or something else, you're probably as free to sue them...
(PS: and maybe create jurisprudence from this ;-))
As I said, I don't care. This thread is worth more than the amount not refunded anyway.