full-disclosure - MediaSentry false positives?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41E72D21.90808@utc.edu>
From: jeff-kell at utc.edu (Jeff Kell)
Subject: MediaSentry false positives?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Another interesting twist in DMCA reports in general that I've noticed
in recent tracebacks to see whom to approach with the clue bat, I'm
finding no correlating connections (by NTP timestamps) in our PIX logs,
but do see evidence of attempts to connect.  The attempts timeout on the
incoming SYN.  At first thought, they're making an accusation based on
stale directory cache data from another peer in the P2P network.

On closer examination, I find connections *from* the accused IP going
out to P2P server ports outside campus, and they are moving data, so
they are, in fact, doing something.

Further checking and there are hours and hours of attempted connections
inbound to the accused that are dropped due to SYN timeouts.  So now I'm
thinking it's someone with WinXP firewall, and it's dropping incoming
requests.  Well how about that :-)

So they are not, in effect, sharing anything on the network.

Does the DMCA cover "attempted sharing" ??

Jeff

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)

iD8DBQFB5y0hot2VatFbXMERAl8kAJ9EYiMxyPJZwXZV3GJ/6msvsY/zAQCeKHkW
XHuZ0vx0wSXBfCLzUUwl9aE=
=vp2V
-----END PGP SIGNATURE-----