[Snort-users] Code Red attacks

Erek Adams erek at ...577...
Mon Sep 17 15:23:02 EDT 2001

On Mon, 17 Sep 2001, Jason Withrow wrote:

> What is the legal issue, it is a purely defensive mechanism.

Well...  I'm not a lawyer, but:  You're doing _something_ to someone elses
machine--Uninvited.  That in and of itself can put you in a lot of legal
hotwater, depending on the remote sites security policy.  Now, I'm not arguing
the morality of what you're doing, or what you intend to do, but the act of
accessing someone elses stuff without consent puts you into the same class as
a 'hacker' in a lot of corportate security policy eyes.

Instead, "Do the Right Thing".  :)  Anyone from your local subnets, give them
a call.  Most of the CR{I,II,III} tend to target the local subnets over remote
ones.  A quick use of whois and traceroute will usually give you a fair idea
of where someone is at physically.

Or simpler, block them at the router.  ;-)

Erek Adams

More information about the Snort-users mailing list