If I have someones IP can I send them a message?

[ebastler]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted

... who, I'm sure, is both the most impartial and most technically savvy expert to consult. 

It's like hitting refresh on a website a bunch of times.

... simultaneously on all of your 10,000 computers... 

[taydin]

All devices that are connected to the internet are behind some kind of firewall. It's either the firewall in the internet gateway (router, modem etc), or the device might be directly connected to the internet and running the firewall itself. If properly configured, the firewall will silently drop all unexpected incoming packets. From the point of view of the sender, that IP address will appear unallocated to any device and thus completely dead.

In order to send that person a message, s/he must somehow solicit that message, which means connecting to an outside service and listening for messages.

[Mr. Scram]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted:  It's like hitting refresh on a website a bunch of times.

Kinda silly that it's illegal, when you think about it.   But I guess it's the intent that makes it illegal.  A well orchistrated DDoS attack will take down even the most resilient web server.

It's the trouble you cause that generally makes it illegal. There are many things which are part of life when it's done moderately, but are frowned upon in large quantities. The consequences for something as simple as causing noise depends on the quantity of it. If you briefly turn up the speakers to show your friend how loud your system gets, the police isn't going to intervene. If you have a party with consistently loud music, they might fine you or even remove your equipment.

[Monkeh]

All devices that are connected to the internet are behind some kind of firewall.

hahahahaha.

[iampoor]

All devices that are connected to the internet are behind some kind of firewall.

Shodan will disagree with that statement.....

http://money.cnn.com/2013/04/08/technology/security/shodan/index.html

[Red Squirrel]

The funny thing about DoS attacks being illegal was best described by the mother of an Anonymous member who got busted

... who, I'm sure, is both the most impartial and most technically savvy expert to consult. 

That's the part that makes it funny, because she's technically not wrong.  

[taydin]

Shodan will disagree with that statement.....

http://money.cnn.com/2013/04/08/technology/security/shodan/index.html

Point taken ... A device that is intended to be used behind a firewall can certainly be directly connected to the internet, and the article does a good job explaining what will happen in that case.

[IanMacdonald]

It's hard to clearly define what constitutes most of the IT crimes. DoS is simply excessive use of a facility. With no clear limit on what is non-excessive use, at what point does the crime begin? If Google uses multiple computers to spider a site, is that DoS?

Is foisted software malware?

That's even before we get started on what constitutes spam.

In some jurisdictions it's illegal to 'harvest' email addresses from websiites. Whilst well-intentioned, this law is pointless as the harvesting is done in other jurisdictions. It has also been used as an excuse by design outfits to continue posting mailtos, therefore it may actually be counterproductive, and encourage the very thing it's trying to stop.

[Twoflower]

In case the IP address is a IPv4 most devices are not having a public IP address. That means they're behind a NAT (Network Address Translation). This behaves as a kind of Firewall by nature. The NAT-Device (usually your Router) knows which requests are send out from a local computer and can correlate the incoming answers to the device within your local LAN. For a not requested packed from the Internet the NAT-Device don't know who should receive this packet within the local LAN so it gets dropped.

The only idea to contact someone would be to identify the ISP owning the IP address-range. But you probably need a extremely good argument to get any further than that. But this depends on the country and the laws in that country. In some countries only the police with a warrant is allowed to get the next step to the user of the IP. Also keep in mind the IP changes in some countries from time to time. In Germany for example the normal end user usually gets a new IP every 24h to prevent them to run a server (including having extremely low upload rates for ADSL) Also it that address in an IPv4 it might even happen that the IP was used by several users. With IPv6 that sharing isn't happen any more (hopefully).

The Idea to send Morse code is nice, but how often do you look at your router to see if there's anything knocking? Most Routers don't even have this possibility. Not saying this isn't happen. On the last CCC congress this did actually happened to troll the CCC network team.

[cdev]

If you want people to be able to send you any particular kind of info, or engage in any kind of communication with you, look at the RFCs at http://ietf.org/rfc.html

chances are, its already been thought about by others, hashed out, and that there is an Internet governance-sanctioned way to do it and authenicate it.

That goes for messaging of any kind. 

Why reinvent the wheel?

[IanMacdonald]

On the contrary, the RFCs still advocate the use of 'mailto' links. They do now carry a warning that spam may result, but it is not prominent. Another reason why it's hard to get site designers to stop doing this, since they will invariably say, 'but the RFCs say it's OK so it must be OK...'

The issue is that many of these standards are very old, dating back to when the Internet was largely used by trusted people. When it comes to security, they are naive in the extreme. 

IPv6 is also a very old standard. IIRC it was available as an add-on for Windows 95. The problem again is that anything as old as this was almost certainly not designed with security as a priority. That means there are likely to be a fair-sized collection of nasty security gotchas lurking. Which, I suspect, is why most sysadmins don't want to use it. 

IPv4 is of course even older, but it has evolved to meet modern security needs. IPv6, like the dinosaurs, refuses to change.

[Red Squirrel]

I was surprised to learn just how old IPv6 is.  Makes you wonder why they did not just go straight to that instead of IPv4.  It was thought of practically before the internet really went mainstream.
 
I still need to setup an ipv6 lab some day, I've read up on it but don't know enough about it to actually implement it and feel comfortable.  I still don't like the lack of NAT, because I like having control of my local IP addressing space and not it being dictated by my ISP, but a fix will be to implement NPT.  Your local IPs will stay the same, just your outside ones will change, as normal, but the client prefix portion will always match up.  (at least that's how I understand it)  The nice thing is you can have multiple devices on your network listening on the same port and both will be separately accessible. 

[timb]

It's hard to clearly define what constitutes most of the IT crimes. DoS is simply excessive use of a facility. With no clear limit on what is non-excessive use, at what point does the crime begin? If Google uses multiple computers to spider a site, is that DoS?

Whether it’s criminal or not depends on intent. While the technical mechanisms behind a web spider and DDoS script might be similar, Google doesn’t have the necessary mens rea that a script kiddie controlling a botnet does.

That said, Google could still be criminally liable in some situations, for example, if their web spider had a huge security vulnerability in it (which they were aware of, but didn’t fix for whatever reason) and hackers were using it to perform DDoS attacks (which they were also aware of and did nothing to prevent). In that case it could be inferred that Google has criminal intent, based solely on the fact they knew their facilities were being used to commit a crime and made no efforts to stop it.

Here’s an interesting thought experiment:

Case 1) A 52 year old man is trading thousands of hardcore, explicit images and videos of pre-pubescent children with other pedophiles on the darknet.

Case 2) A 16 year girl in sends a topless picture of *herself* to her 18 year old boyfriend.

<Edit>
Assume both of these cases take place in a country where it is illegal to distribute sexual photographs of persons under the age of 18.
</Edit>

These two people have broken the same law. Should the girl be charged? This is why the law shouldn’t be based solely on logic. Emotion, intuition and common sense must add to the equation. Unfortunately this isn’t always the case. (In fact, Case 2 has actually happened multiple times here in the US; these teenagers have had their lives ruined because of overzealous or overreaching prosecutors.)

Edit: Added qualification to my example, because some people don’t understand the purpose of said examples.

[cdev]

We should have asked Beamer whether the person who was to receive the message wanted it. I was going on the assumption they did.

Assuming they do, they can use "TXT" messages in their domain's DNS to make any information available, as long as it is short and ASCII.

[Twoflower]

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

[Mr. Scram]

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

It's very common, though some nationalities seem to be more inclined to do so than others.

[james_s]

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

What surprises me is how pedantic some people can be at times.

He's in the US so those two people did in fact break the same law in the US where the example takes place. That doesn't mean that exact law applies to other countries, but I would bet that any country has a few laws on the books that could lead to similarly ridiculous criminal charges. The example made the point it was intended to make.

[HumbleDeer]

Now, they may not have changed the default password, but that's another story.

Ha, yes! I was able to tap off high speed wi-fi from the bank office just across the street for months until they noticed. I sent random popup messages to people on the network that were connected to the server, as.. well.. I was posing as that server. Had lots and lots of fun. :p

[timb]

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

What surprises me is how pedantic some people can be at times.

He's in the US so those two people did in fact break the same law in the US where the example takes place. That doesn't mean that exact law applies to other countries, but I would bet that any country has a few laws on the books that could lead to similarly ridiculous criminal charges. The example made the point it was intended to make.

Thank you!  At least someone understands my point.

...
These two people have broken the same law.
...

I really surprised how people think that their own country laws apply to the world. Especially your second example isn't violating the laws in many countries.

I never said that particular law applied anywhere else. That wasn’t the point. It was simply an example intended to show that you can’t just blindly apply laws to every situation.

Just for you I edited my post to specifically point out the examples take place in a country where distributing those types of images are against the law. Even though that should be plainly obvious based on the context of said examples and the additional comments made later on about how this a real case from the
US.

Good thing there’s no law against pedantry, or you’d be doing some hard time! [emoji6]

[Twoflower]

The problem I have is that I don't have the understanding of such laws as you use as example. Yes it applies to the USA, or at least parts of it. I might be the only one here who's missing the complete set of laws of every country in the world.

I only wanted to stress the point that such examples aren't easy to understand for many people in an international forum like this. Unfortunate this kind of law isn't as universal as the physical laws.

[james_s]

All one needs to know in order to understand the example is that outside of some gray area covering non-sexual artistic or medical depictions, nude photos of someone who is under the age of 18 are considered child pornography. Creating or distributing such images is a serious crime, even when the person creating and distributing is the "victim" themselves.

Surely every developed country has some similar age threshold below which photos of that nature are not legal or socially acceptable.