[plug] Monday meeting summary, Channel 7 tour offer

[Christian]

On Mon, May 22, 2000 at 10:42:02PM +0800, Leon Brooks wrote:
> First, about 8 PLUGgers and assorted others piled into the SAGE/WAUUG
> meeting and learned a bit about cyberwarfare from the horse's mouth, so
> to speak. I will be implementing some automatic countermeasures as a
> consequence. Visit http://www.auscert.com.au/ and follow the links for
> more details. Bret will be pleased to know that some recent (March 2000)
> scan were targeting RedHat 6.0 boxes. (-: The food was yummy as well,
> which always helps. (-:

Automatic countermeasures?  If you mean some sort of "intelligent"
firewall that automatically adds rules when it detects a probe then I
don't really remember the speaker suggesting that.  I do, however,
remember him pointing out quite correctly that such automatic
countermeasures are a very good way for someone to create a denial of
service for yourself.  I didn't stick around for group discussions
afterward so I don't know if he changed tack at that point but scripts
which "intelligently" react to block probes etc. are generally a bad
idea and typically open a bigger vulnerability than they close.

Regards,

Christian.