[Security400] Interesting Little Read

["Chuck Lewis" <clewis@xxxxxxxxxx>]

Hi Folks,
 
Not sure who all of you use various ?security tools? but just got this email
this morning:
 
From:                Fyodor [fyodor@xxxxxxxxxxxx]
To:                    nmap-hackers@xxxxxxxxxxxx
Subject:            FBI Subpoenas
 
Dear Nmap hackers,
 
Let me first wish you Americans a happy Thanksgiving.  Meanwhile, I'm hard
at work on a holiday Nmap version which should be available by Christmas.
 
But enough pleasantries -- I want to discuss a sobering topic.  With
increasing regularity this year, FBI agents from all over the country have
contacted me demanding webserver log data from Insecure.Org. They don't give
me reasons, but they generally seem to be investigating a specific attacker
who they think may have visited the Nmap page at a certain time.  If they
see that an attacker ran the command "wget
http://download.insecure.org/nmap/dist/nmap-3.77.tgz";
from a compromised host, they assume that she might have obtained that URL
by visiting the Nmap download page from her home computer.  So far, I have
never given them anything.  In some cases, they asked too late and data had
already been purged through our data retention policy.  In other cases, they
failed to serve the subpoena properly. Sometimes they try asking without a
subpoena and give up when I demand one.
 
One can argue whether helping the FBI is good or bad.  Remember that they
might be going after spammers, cyber-extortionists, DDOS kiddies, etc.  In
this, I wish them the best.  Nmap was designed to help security -- the
criminals and spammers put my work to shame!  But the desirability of
helping the FBI is immaterial -- I may be forced by law to comply with
legal, properly served subpoenas.  At the same time, I'll try to fight
anything too broad (like if they ask for weblogs for a whole month). 
Protecting your privacy is important to me, but Nmap users should be savvy
enough to know that all of your network activity leave traces.  I'm not the
only one who gets these subpoenas -- large ISPs and webmail providers
receive them daily. Most other major security sites probably do too.  Most
of you probably don't care if someone finds out that you downloaded Nmap,
Nessus, Hping2, John the Ripper, etc.  Nothing on Insecure.Org is illegal.
But for those of you who do care, there are plenty of mechanisms available
to preserve your anonymity.  Remember this security mantra: defense in
depth.
 
Cheers,
Fyodor
 
--------------------------------------------------
For help using this (nmap-hackers) mailing list, send a blank email to 
nmap-hackers-help@xxxxxxxxxxxx . List archive: http://seclists.org
 
Chuck