"is failing to prevent something the same authorizing it?"

I would look at it from the point of view of did he use or abuse a public interface. Using the host command (regardless of whether or not it is arcane knowledge) is not abusing the interface; exploiting a buffer overflow and SQL injection is abuse.

An analogy I would like to see explored is "dumpster diving". As I understand it, if you throw it in the trash, it is fair game. As long as I don't have to trespass to get at your trash, I am allowed to search through it. That aligns nicely with my "no abuse" rule. The purpose of DNS is to publish a mapping between host names and IP addresses so that people can find your hosts. There is no abuse of the interface to ask a DNS server for information that it has been instructed to publish. If you have hosts that you don't want the general public to know about, you shouldn't publish the information to the public. I think you have your question wrong, it was not a "failure to prevent"; someone configured a DNS server to take a set of data and publish it publicly. That to me implies that access to that information is authorised. They may have been mistaken when they did it, but that does not negate the authorisation.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/463/34884#34884