Being Scanned

My Firewall & IDS just went nuts being scanned by "proxyscan1.isomedia.com". I went to this site and was presented with the following:

Quote:

---

Why is proxyscan1.isomedia.com [66.114.137.17] attacking me?

Open SMTP relays and insecure proxy servers are a serious issue on the Internet today. Spammers routinely scan the Internet, searching for open relays and proxies, looking for open servers that allow them to spew their spam. The onslaught of such spam has led some providers to take additional steps to protect their networks from this problem.

Accordingly, ISOMEDIA has begun testing of IP addresses which connect to its inbound SMTP gateways. If your server connects to ours, we reserve the absolute right to perform SMTP relay and open proxy server tests upon the connecting IP address, to ensure that the machine at that IP address cannot be abused for malicious purposes.

These scans are done only on those servers that have sent our subscriber base mail. The only way for these tests to occur is if an IP address connects to our inbound SMTP gateway.

ISOMEDIA currently scans the following TCP ports for services that may allow OTHER persons to access your systems and perform deeds that are detrimental to the ISOMEDIA network, such as spamming, or attacking other Internet users: 23, 25, 80, 81, 85, 1075, 1080 ,1180, 1181, 1182, 1282, 1813, 2280, 2281, 2282, 2283, 3128, 3330, 3331 ,3332, 4044, 4480, 5490, 6588, 7033, 7441, 8000, 8080, 8081, 8085, 8090, 8095, 8100, 8105, 8110, 8888, 22788, and 22799

ISOMEDIA in NO way attempts to circumvent your security or access the contents of your personal computer. We are not interested in its contents, nor what you do while you access the Internet.

If you have further questions or problems, please contact us.

ISOMEDIA Abuse Team

abuse AT isomedia DOT com - 1 888 638 2680 extension 118

---

Now in this 'disclaimer', they state:

Quote:

---

we reserve the absolute right to perform SMTP relay and open proxy server tests upon the connecting IP address, to ensure that the machine at that IP address cannot be abused for malicious purposes.

---

My question is, I am under the understanding that scanning a company's computer systems without permission was/is illegal (or very unprofessional at least). How can they "reserve the absolute right" to scan my machines? I am considering contacting this company, but I want to make sure I have my facts straight.
Anybody got any thoughts on this?

Thanks

Did you at any time ever sign any kind of agreement with this company stating that they had permission to perform vulnerability scans?

Very unprofessional indeed....how is that different from Joe Blow running port scans and pen testing? You would report that to your ISP, wouldn't you.

And on a totally unrelated, yet parallel note...in electronics school, we learned how to build a device that would take the output from a standard police issue radar gun, amplify it, and send it back, effectively melting the detection mechanism.... not that I would EVER condone that type of behavior. :D

Quote:

---

Originally posted here by groovicus
[B]Did you at any time ever sign any kind of agreement with this company stating that they had permission to perform vulnerability scans?

---

Short answer, no. This is first time I have ever heard of this company. No one else in my organization would have signed anything like this either (they would have forwarded it to me).


Cheers:

Quote:

---

Accordingly, ISOMEDIA has begun testing of IP addresses which connect to its inbound SMTP gateways.

---

Did you ever really connect to their SMTP gateway?

If not, then some spammer may be spoofing you?

I agree... very unprofessional. This is boarderline "hack back"?

Djm, I tend to agree that random scanning of machines attached to IP's that have connected to their servers is somewhat intrusive.

Considering you've got people who are spoofing IP's, using Proxy chains, tapping into WiFi networks, and a plethora of other IP related exploits.
This irritates me being that most of these connects to their server are probably the inadvertant action of some unsuspecting victim being spoofed, hijacked, etc. by spammers and crackers.

Obviously, these people at ISOMEDIA feel the best way to deal with this is by scanning the connecting computer's IP for exploits/running services.
All in all, if ISOMEDIA sends you a report detailing what exploits they found with the computer associated with that IP, then maybe it would be a good thing. kinda like a third party network scan who reports details that can help you (the user) better secure his/her system.

Otherwise,without sharing the results, these people could just compile a huge database of domain ranges with the highest amount of exploitable users. Is that kind of information beneficial to anyone outisde of ISOMEDIA? and to what purpose would they use it for, if not to inform the user?

Generally, I disagree with their method as just about *every* third party scan I ever did required my consent.

Quote:

---

Originally posted here by phishphreek80
Did you ever really connect to their SMTP gateway?

If not, then some spammer may be spoofing you?

I agree... very unprofessional. This is boarderline "hack back"?

---

Connect is a relative term, anyone in my company could have sent an email that got routed through this SMTP gateway.

Cheers:

I would be interested in what they have to say.....

From http://www.isomedia.com/about_us/press.shtml#apr_18_03

They are an ISP with a anti-spam tool, so I guess scanning for open relays and blocking them (in their tool) is acceptable to them. They could also just be scanning random blocks of IP addresses and not be some sort of connect to us and you get scanned.

I agree with you DjM. They shouldnt be scanning peoples networks.

Me too, I just blocked them at the firewall.

Quote:

---

Originally posted here by RoadClosed
Me too, I just blocked them at the firewall.

---

I hope more people follow your example, this has me pissed right off. I have forwarded this to our lawyers to get their input. I am not sure there is anything we can do about it, but I'm sure as hell am going to try. :mad:

Cheers:

unprofessional yes, illegal no.

Las I heard port scanning was legal in the U.S.
http://www.securityfocus.com/news/126
I would imagine you would end up with a similar result if you tried to charge/sue some one for port scanning in Canada.

You might be able to get results by voicing your concerns to their up stream provider.

Quote:

---

Originally posted here by cwk9
unprofessional yes, illegal no.

Las I heard port scanning was legal in the U.S.
http://www.securityfocus.com/news/126
I would imagine you would end up with a similar result if you tried to charge/sue some one for port scanning in Canada.

You might be able to get results by voicing your concerns to their up stream provider.

---

I thought that might be the case cwk9, I am going to let the lawyers run with it anyways to see if they can dig up anything. I am also checking with their up stream provider to see if they have a TOS in place that these guys may have violated.

Cheers:

First of all, I think you are doing the right thing by questioning these port scans as they are extremely unprofessional.

Although their actions may seem unprofessional and unappropriate, ISOMEDIA may not be breaching the law. As you all know, port scanning, in the eye of the legal worker, is a very thin line to cross. Although port scanning is not illegal, the ruling can vary depending on how in-depth the port scans are and how frequent they occur.

If you're picking up frequent port scans from ISOMEDIA that seem to be penetrating your defenses more deeply than you feel comfortable, then you may just have a case. If not...

Whatever the situation, make sure that you consult legal aide because ISOMEDIA is walking on an extremely thin line that could easily break.

Good luck!

:D

Personally, if it doesn't hold up in court, I'd simply build me a box with nmap and schedule scans of their IP on the same ports with the same frequency of occurance.

Put a webpage on it with the text: "We reserve the right to scan any system that scans our system" :D

Scanning is not illegal nor should it be. Perhaps it seems intrusive to you but honestly this is how the internet works, and has since its inception, and until recently most people used to not notice or care. When you join the internet, you are in a PUBLIC place. The internet is not secure and there are no gurantees that everyone is going to just leave you alone, you shouldnt get your panties in a wad just because some machine is checking for open services (which is perfectly legitimate and not considered 'penetration testing'). I think its perfectly reasonable what they are doing which is cutting down on all the bullshit people get in their e-mail especially since they explain it to you which 98% of people scanning you will not.

Quote:

---

Connect is a relative term, anyone in my company could have sent an email that got routed through this SMTP gateway.

---

So in other words, any one in your company is free to connect to services on their machines but when they want to verify the legitimacy of your traffic and connect back to you they are in the wrong?

Quote:

---

Me too, I just blocked them at the firewall.

---

Bingo!We have a winner, problem solved without resorting to nastiness. Besides you dont have a legal leg to stand on. :)

-Maestr0

Alot of interesting things have been said in this thread. I am in no way affiliated with the company in question. It seems everyone here has deemed a port scan as something terribly bad. Well, I think this is one case where it isn't so bad. Here is a company who is taking a very offensive stance to protect themselves and make their clients happy. I see nothing wrong with what they are doing. They tell you up front that they don't give a crap about your data/content. Of course, if you do prove they maliciously attacked your systems, then they've made it very easy for a person to take legal action against them by documenting their actions.


I wouldn't attempt to touch these guys from a legal standpoint. Someone has obviously agreed to the practices of this company which has allowed your network to be scanned. Call off the lawyers dude and set out to find the real bad guys.

Maestr0 & swarisd, given your response, I guess then you would have no problem with me or anybody else you don't know dropping by your house any time of the day or night and rattling all your doors and windows to ensure they are locked. I assume you would then come out and shake my hand and thank me ever so much for checking your security.
The point is, I will admit the internet is a public place, but there are still rules in a public place (written or unwritten). If this had been just another script kiddie with nmap, I would have written it off in no time flat, however this is a company which, by its very disclaimer, claims some sort of 'rights' over my systems (your systems as well). I will continue to pursue this matter even though it is not illegal, I still believe its dammed unprofessional.


Cheers:

I agree with a little of both....If the porpose of ISOMEDIAs scans was to find SMTP relays and block them, I'm all for it. There are a ton servers out there with SMTP open, that allow relaying (spoofing e-mails, spam, ect..). They are probable trying to help prevent spam which I am all for. Sure its irritating to be scanned, but if you run a tight ship, you have nothing to worry about. Its called layered security. Let them scan the crap out of your external router and firewall depending on policies, and log at the internal router. If a good policy is in place, little should be getting past the filtering of your external router, and nothing past the firewall. Do you have the right to scan them back and block them, sure, and by all means block them...

Quote:

---

Originally posted here by meloncholy
if you run a tight ship, you have nothing to worry about.

---

I run a tight ship and I am not worried about their scans. What I am set off about is a company claiming they have the:

Quote:

---

absolute right to perform SMTP relay and open proxy server tests upon the connecting IP address, to ensure that the machine at that IP address cannot be abused for malicious purposes.

---

Who gave them this "absolute right" on "my" servers. :confused:

Cheers:

You did by connecting to their mail server and attempting to relay mail through THEIR servers. Don't want them connecting to you, then dont connect to them. This isnt like them rattling your doors to see if they are locked, its more like you coming over to my house claiming to be the cable guy and getting pissed because I call the cable company to verify this.

-Maestr0

Quote:

---

You did by connecting to their mail server and attempting to relay mail through THEIR servers. Don't want them connecting to you, then dont connect to them. This isnt like them rattling your doors to see if they are locked, its more like you coming over to my house claiming to be the cable guy and getting pissed because I call the cable company to verify this.

---

No. I don't think it's like that. It's more like I'm the mailman, delivering mail and then after I've left behind the mail, they come out and search me for contraband. It makes no sense. If they are doing this, they are adding extra internet network traffic because every SMTP server that connects to them to relay messages is getting scanned. And there's enough extra crap running around the Internet that these guys shouldn't be doing it. Wonder what the big ISPs have done about it? I'm sure they wouldn't be quiet about it.

Quote:

---

Originally posted here by Maestr0
You did by connecting to their mail server and attempting to relay mail through THEIR servers.

---

Please.....if they don't want people to use their email service, the answer is simple, don't allow inbound SMTP. We weren't attempting to "relay" through THEIR servers, an email was sent to someone that subscribed to their ISP service, that is what trigger the scan.

Quote:

---

These scans are done only on those servers that have sent our subscriber base mail.

---

Quote:

---

This isnt like them rattling your doors to see if they are locked

---

It's exactly like that.


Cheers:

Quote:

---

It's more like I'm the mailman, delivering mail and then after I've left behind the mail, they come out and search me for contraband.

---

Only if you bring a wheelbarrow of junkmail. :)

Quote:

---

If they are doing this, they are adding extra internet network traffic because every SMTP server that connects to them to relay messages is getting scanned. And there's enough extra crap running around the Internet that these guys shouldn't be doing it

---

Are you serious MsM? Come on, I counted the list of ports. Thirty eight ports. So if we are using a full TCP connect scan your looking at approximately 60-78 bytes per packet, 3 packets per port, about 8.5k of traffic. You have to be shitting me if you think thats more traffic then one spammer can send in 3 seconds (on dial-up :)). Look, I can go as far to say it may be rude, but if I had a Canadian dollar for every time someone scanned an address on the network, I'd have my own plane. If someone on your network connects to an IRC server, and the IRC server performs a proxy check back, are you going to sue them too?

Quote:

---

Please.....if they don't want people to use their email service, the answer is simple, don't allow inbound SMTP.

---

And if you dont want this crap in your logs then dont allow inbound connections from them, I'm sorry I just dont see what the big deal is, I dont think attempting to connect to a service is rattling anything its like looking for an "open" sign, if the port is closed... fine. no further connections are made to that service.

-Maestr0

Quote:

---

Come on, I counted the list of ports. Thirty eight ports. So if we are using a full TCP connect scan your looking at approximately 60-78 bytes per packet, 3 packets per port, about 8.5k of traffic.

---

Fair enough and only if they do one. What if other ISPs started doing this as well? And why 38 ports? Why not just scan for port 25 (since the concern is Spam Relay)? Why are they scanning all those ports? Fair enough they are saying Proxy but last I checked 23 wasn't proxy. So why not include 21 (FTP Bounce) or 22 (ssh hijacking)? or 12345/12346 (trojan)?

Quote:

---

If someone on your network connects to an IRC server, and the IRC server performs a proxy check back, are you going to sue them too?

---

I never suggested suing them. I do however think that it's unnecessary. They are not the Internet police. It was not asked of them to do this. And, what stops them from going further than just a simple TCP Connect() scan? I know they say that they aren't interested in anything that DjM or others have but I have seen some scans cause machines to crash. Will they take responsibility for the potential DoS from that?

It's fine if you think it's ok. I don't. When Spam first appeared in 1994/95 when I was on the Internet, it didn't have HTML in it. It was plain text. They said it doesn't take up much space and all you have to do is delete it. Look where we are today. I still don't agree with them doing this.

Well Maestr0 my friend, I see you have failed to see the point. If I came around rattling your doors and windows in the middle of the night, the very least I would expect is you chasing me down the street with a freaking baseball bat. If you choose to let every Tom, Dick & Harry scan your systems at any time for any reason, that is your call, go for it. By the way the 38 ports they say they scan generated approx. 150 to 175 entries in my firewall log, that leads me to believe they are taking multipal passes at the ports.
I, on the other hand, hire people to do this under my supervision and within my policies and my timetable. I do not need some ISP on a crusade against spam to do it for me.

I will, as stated before, continue to pursue this.


Cheers:

*Shrugs*
This has all been argued before but the practice continues.

-Maestr0

http://archives.neohapsis.com/archiv...3-04/0121.html
http://archives.neohapsis.com/archiv...3-04/0137.html
http://www.dshield.org/pipermail/lis...ary/007088.php
http://lists.jammed.com/crime/2003/05/0075.html

Maestr0,

The first 3 aren't relavent IMHO since it's an ISP scanning Customers. Many ISP AUPs have clauses that say no servers and that they may scan networks to detect those servers. I see regular visits from my ISP looking for only NNTP, SMTP and Web servers (3 ports). I expect that and am aware of that. I can accept it because it's their network I pay to have the privilege of using.

The last link points to someone else who evidentally is having the same issue as DjM since the ports match and the letter is the same. And if you read the last one, you see that most of them didn't agree with the multiple scans issue. If it was one, fine but as was pointed out, implementation wasn't done right.

Well, my views might be old fashioned, but when I put a letter into the "snailbox" I don't expect the postman to come checking on me?

If I sent 5000 letters, I would EXPECT someone to come checking.......assuming that I was not a registered business user?

There really isn't much difference on the net IMHO...........DjM seems pissed off that one letter brings a scan............I really have to agree with him that it is gross over-reaction.

If there are scans for every piece of mail sent these guys, then this is as bad as a worm?

I also consider it to be the grossest bad manners and a demonstration of the crassest unproffesionalism I have encountered recently :(

Haven't they got a few little code monkeys who could write something to trigger such activity on the basis of unacceptable volumes? If a relay is used you don't bother to spoof to protect it?

Whatever happened to the concept of innocent until proven guilty?

I bet the scum do business with anyone who will pay them money...........even if THEIR servers relay to bloody Mars?

And why do they do it?..........to produce a warm feeling of care and attention?..bollocks!

They want "to be seen to be doing something", rather than "achieving"

Sound like a shower of bloody lamers to me :eek:

Cheers

I think everyone here has some very valuable points. I have to stand a little more on the side of Maestr0. My opinion is scans are a way of life on the net and I really feel you have to look at the intent of the person scanning to make a decision as to should I or should I not go after this person. The best thing you can do is block the scans and go on about your business.

Quote:

---

Well, my views might be old fashioned, but when I put a letter into the "snailbox" I don't expect the postman to come checking on me?

---

It all depends on what that letter has in it nowadays. Your point is well taken though.

Quote:

---

There really isn't much difference on the net IMHO...........DjM seems pissed off that one letter brings a scan............I really have to agree with him that it is gross over-reaction.

---

It may very well be that 1 server you don't check that spews mail at you the next day. A server that checks out ok today, may very well be out of compliance tomorrow. Not sure if I can agree totally with this statement, but again, I see your point.

I've learned from this thread that some practices of organizations maybe questionable and we see things a little differently as to how things should work, but a line has to be drawn in the sand so that we all "can just get along".

I bet as soon as the government or some governing entity were to step in and deem scanning to be against the law. The folks who think so lowly of it in this case would have a change of heart. Why? Because the law has now limited your capabilites and the overall nature of the net.

MsMittens, if someone has equipment at their network border that can't handle a simple scan, then shame on them. I'm not referring to the malicious scans that are meant to hose a router.

I just think bringing litigation towards a company while knowing their intention (there goes that word again) is really going overboard. Yes, it (the scans) may be a little unprofessional and yes, the coding could probably be better. Save the court time for things that need to be there.

DjM: as far as you rattling my windows and doors in the middle of the night.....well, I'll give you 10 paces and the buckshot will begin to fly...LOL.

Don't flame me for my opinion, but it's this kind of visibility to topics that tend to make things happen that we don't necessarily want to happen, such as taking away certain rights that we may feel we need as security professionals. We really need to find out if we can in fact tolerate certain things. If the government steps in, then we are all screwed. I bet we can agree on that one :D.

DjM: I say do whatever you have to do and I wish you the best of luck. Thanks for all the enlightenment in this thread. I was beginning to get a little bored with some of the topics.

I don't want to get into the debate over whether this is good or bad, but...

Im assuming this is automated....

It seems to me if they were not careful about how they did this, they are leaving themselves open for a self induced DDoS.

If someone posts this on slashdot, and it makes the main page, and everybody on the main page sends them an email from their local machine smtp server....

They probably have a big enough pipe to handle a lot of traffic, but, the coincidence of all those slashdot emails, and their automated scan back.... that could be BAD.