Re: The legal / illegal line?

[admin <admin () propergander org uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Barry Fawthrop wrote:
> Hi All
>
> Curious to hear other views, where does the legal and illegal line stand
> in doing a pen test on a third party company?
> Does it start at the IP Address/Port Scanning Stage or after say once
> access is gained?? very vague I know
>
>
> I'm also curious to hear from other external/3rd party pen-test
> consultants, how they have managed to solve the problem
> Where they approach a client who is convinced they have security, and
> yet there is classic signs that they don't?
> You know that if you did a simple pen-test you would have the evidence
> to prove your point all would be mute
>
> But from my current point that would be illegal, even if no access was
> gained. (maybe I'm wrong) ??
>
> Perhaps this is just a problem here where I am or perhaps it exists
> elsewhere also?
>
> I look forward to your input
>
> Barry
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
> ------------------------------------------------------------------------
Hi Barry,

I am new to IT security and new to this list. I could be wrong here but,
as far as I am aware scanning for open ports is not illegal. It is akin
to walking down a residential street knocking on doors or pushing them
to see if they are open. As soon as you enter a system through an open
port, just as in the residential street metaphor, you are then
committing trespass.

The only legal option and this is dependent on the laws of the country
in which the target system is located would be to scan for open ports
and potential exploits, yet make no attempt to enter the system or
leverage those exploits to gain access.

Produce a report for the company explaining how you could take control
of or pull information from their systems using the results of your
legal scan.

Any IT manager/leader/security bod should take your report seriously if
he is worth his/her salt.

Regards
Dave
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF6/l0BStvyIzJtOARAj19AJ4wk2YJ0iE5y4pgciyUxXpcdYzLmACeM6x2
1/YhnAnrCZ0EP9Rt+ObORUQ=
=5eN0
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------