Subject: [Fwd: Re: 10.4 IDENTIFY Command II]

From: Doug Royer <[email-masked]>
Date: Wed, 04 Dec 2002 16:15:17 -0700

[email-masked] wrote:
 >
 >  > If you determined that a hacker was attacking your system, would
 >  > you first inform them:
 >  >
 >  >    > 1: Network failure
 >  >    > 2: CS crash/shutdown
 >  >    > 3: "Im a bad boy"
 >  >    > 4: "Im not allowed to be the CFO of the company"
 >  >    > 5: "Sorry C&S Team AA, you are still not allowed to assume
 > Bruces identity"
 >  >    > ...
 >
 > Hmm, Im impressed that you alone have developed the means to make
 > software clairvoyant and have imbued it with the ability to tell a
 > hacker from a legitimate user who is retrying something they think
 > should/will work.

I have made no such claim. I claimed that if I detect
a hacker - I am dropping the connection and I think
that is good protocol practice.

-- 

   Doug Royer                     |   http://INET-Consulting.com
   -------------------------------|-----------------------------
   [email-masked]                 | Office: (208)612-INET
   http://Royer.com/People/Doug   |    Fax: (866)594-8574
                                  |   Cell: (208)520-4044

                  We Do Standards - You Need Standards

---

From: [email-masked]
Date: Fri, 6 Dec 2002 12:04:57 -0500

> that is good protocol practice.

Before this determination can be made there must have been at least a 
couple failed attempts.  _THESE_ should have some kind of response on them 
that indicate the cause for the failure (see numbered cases above). 

As I originally stated back on 18-Nov: "The CS should _at_least_ send back 
some info before slamming the entire BEEP session.  Otherwise the CUA has 
NO way to determine why the connection to the CS was lost"  The current 
description and draft make no mention of this and I think that it should. 
_BEFORE_ the CS gets to the point of making the determination of a 
possible security breach the CS should be sending back informative failure 
responses for the CUA to use, present to the CU or just plain log!

I for one would expect the CS to be consistant and just send back a (3) 
response _before_ it just dropped the connection and punted the CUA but 
perhaps thats just me.  After all doing that would be consistant 
w/non-punting cases AND its not giving any extra info to any potential 
hacker...

Bruce
===========================================================================
Bruce Kahn                                INet: 
[email-masked]
Messaging & Collaboration                 Phone: 978.399.6496
IBM Software Group                         FAX: and nothing but the FAX...
Standard disclaimers apply, even where prohibited by law...