Classroom use of a limited port scan in the wild?

Question

Under what circumstances is it ethical for teachers to teach the existence of a tool such as MXtoolbox? Under what circumstances is it legal and ethical to use a superficial scan with protocol-adhering requests to scan a target that is not your own?

Portscanning a school district's web or mail server is likely to be regarded as hostile under any circumstances without working with the school's IT department. Students are likely to do so if they know about such a tool, even if warned about the consequences.

Background:

The Computer Fraud and Abuse Act (CFAA) makes it a felony to access computer resources that are not your own without written permission from the owner if such access causes $5000 damage or more. The CFAA identifies as damages the cost to investigate any potentially unauthorized use and harden the resource against such future access.

No one has ever been found guilty under the CFAA for portscanning, but only one judge has ever ruled on the matter and it is considered ambiguous under the law if it involves thousands of ports across thousands of computers, especially if the scan uses requests that do not conform to the expectations of the protocol at each corresponding port.

Ports and protocols are important concepts early in a student's learning. Tools like MXtoolbox perform non-damaging scans and send a dozen or so requests, one of which is identical to directing a web browser to the target.

Answer 1

In general is is unethical to teach people skills that they intend to employ to harm others. That said, it is hard to know the intent of your students. Do you have Beavis and Butthead in your class? Pretty problematic then. But many people the age of secondary school students make a lot of judgment mistakes. (The human race probably wouldn't exist if most people that age didn't take risks.) So you need to be cautious. Some of my undergraduate classmates were pretty off-the-wall. (We had a mad-bomber who mostly blew up harmless things.) Teaching how to make high explosives in his Chem class would be irresponsible.

So, if you want to teach dangerous tools, you need to provide a safe environment (likely not the wild) and give legal and ethical guidance with strong warnings about consequences. I'll second @thesecretmaster's answer. But even if you aren't responsible for the actions of others, your life could be ruined if someone goes off the rails with things you teach.

There is controversy in the industry about the place of white-hat hackers, for example. They may mean good and may do good, but bad things happen and some are in jail. Tread carefully.

Teachers in martial arts are cautioned not to take on a student who displays traits of a bully. It is clearer to see there, of course. That tradition is at least a thousand years old.

Answer 2

I taught a Cisco networking class for a couple of years and we had to stay off of the district network any time we were doing networking stuff.

What I did was build a separate network in the middle of my room with old computers. Ran network drops from there to the racks in the back of the room so we could hook into switches, routers, and stuff.

Once we got to the point where they knew how to program routers over IP instead of wiring directly in I started messing with them. For one of the labs I closed the ports they needed on the router. One student figured it out and started scanning ports on the router to see if I had changed it. I had.

We spent a lot of time going over the reasons you would want to do certain things like port scanning. When it's the right thing to do and when it's not. I also posted links to several articles about people getting arrested for computer crimes each week.

Since our network was segregated, we could do pretty much anything we wanted to on it though. A couple of times I setup a web server and had them try and break in. My personal favorite though was having a student put their iPhone on our network and had about 20 computers constantly pinging it. You could watch the battery meter dropping and by the end the phone was seriously hot.

Answer 3

It's certainly ethical to teach the existence of such tools. It's only unethical if the teacher neglects to teach the legality of these tools along with their existence, or if the teacher advises students to use the tool in an unethical way. It's rare that a tool is not ethical, it's more common that a use of the tool is not ethical.

It's ethical because the students could also find it on their own and get in legal trouble, or they could here it from you and at least know the risks in advance.

Answer 4

Teaching about the existence of such tools is totally ethical. We need people who understand computer security, period. Mentioning the law is also almost self-apparently necessary.

In my district, I am lucky, because I can get folks from the district IT staff to run the port scanner in front of my hacking class and discuss the results themselves. No one in my prior district would have allowed such an activity (or, for that matter, a hacking class in the first place).

In situations where IT would not be as understanding, I would recommend discussing the tool, discussing the ramifications, and going to YouTube to find an example of someone using your tool of choice.