Does port scanning open up a hole for hackers?

My supervisor reprimanded me for testing two utilities: A full-featured commercial port scanner and an e-mail verifier that verifies e-mail addresses by connecting to e-mail servers via Simple Mail Transfer Protocol. The supervisor said using these utilities exposes us to attacks by hackers.

My supervisor reprimanded me for testing two utilities: A full-featured commercial port scanner and an e-mail verifier that verifies e-mail addresses by connecting to e-mail servers via Simple Mail Transfer Protocol. The supervisor said using these utilities exposes us to attacks by hackers.

I know that port scanning might irritate other administrators (and could be illegal?), but how does it expose us to an attack? Same for the e-mail product: How does connecting to an e-mail server via SMTP expose us? The rationale I was given is roughly, “these hackers can do anything, they have all sorts of tricks – you just don’t understand.” That level of paranoia defies common sense. What do you think?

If software talks to the network then there is always the possibility that it is covertly communicating with some outside entity.

One should only install software from trusted sources and even then only carefully. Trusting commercial and open source sites to distribute honest software is less of a danger to system administrators than not knowing or simply ignoring network security policy regarding Internet downloads and unauthorized software installation.