Was Mr. Moulton doing a professional job, though?

I work for a security consulting firm. As part of that, we do "Ethical Hacking" or Penetration Attacks. We always verify with the client which IP addresses belong to him and ensure we have (in writing) permission to run port scans and other scans on those addresses, and we run our scans only on those addresses.

Yes, sometimes clients don't understand this - we had one client who refused to give us his IP addresses, on the grounds that "Real hackers wouldn't phone up and ask for this information". (We did a series on "whois" lookups on their sites, identified some IP addresses that we thought belonged to the client, and then asked him to confirm that these IPs did, in fact, belong to him and that we were authorized to attack them.)

A professional security expert should not be running port scans or ping sweeps or nmap or Satan or any other attack tool against IP addresses without permission from the owner, let alone without knowing who the owner is.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/126/4102#4102