Word on the grapevine is saying that Google is doing similar. One of the "perk" of being a well-known DNS resolver (8.8.8.8) is getting an early notification whenever a server goes "online" on the internet.

> is getting an early notification whenever a server goes "online" on the internet.

Please elaborate.

Someone types in your new server/domain, like "ijustmadethissite.com", or "newlocation.existingsite.com"

For their computer to resolve this domain name, it's going to call out to a DNS server, of which Google hosts a major one. It can be assumed that they log these names, and can then use that as a "notification" for a site coming up.

But what does that have to do with scanning webservers for vulnerabilities, do they do something with the "newly seen sites", and if so is it documented what they do for scanning?

Because if the vulnerability involves an HTTP request, then the Host header needs to have the domain name of the target website.

So you need: IP address and port for the TCP headers, and the domain name to go in the TCP packet content.

One example of a vulnerability would be having phpMyAdmin with a database password hardcoded and no login needed. Without the domain name it would still be impossible to access. (Of course, domain names shouldn't be considered secret so this would be a very insecure setup.)

True, they have a DNS resolver, but they also have Chrome. And the Certificate Transparency list. Google Analytics. And so on…

I'd never considered the value all those things have when it comes to finding out what to index. Clever, actually.

Way back in the early 2000s the FBI contacted a company I was working for to inform us that someone was hosting Disney movies on our servers. So something like this is at least sort of happening.

I don’t know if copy right protection is the same as penetration testing.

no, but takedowns for copyright protection is the same thing as censorship and goes against free speech. we're all just too blinded by capitalism to see it that way.

So nobody should pay for anything? I pirate tons of stuff and still pay for things that I think are worthy of my payment

I would be surprised if this was the result of active scanning. It's more likely the FBI received a report from someone, and just forwarded it along.

Disney: "Hey FBI, this server is pirating us, plz 2 takedown tyvm"

Maybe it has something to do with the Nord Stream pipeline, maybe it doesn't

I think it's illegal under the Computer Fraud and Abuse act. Also, what should the government do when it finds something? What if the site operators are unresponsive or cannot be contacted? There are a lot of practical problems.

> What if the site operators are unresponsive or cannot be contacted?

This seems like only a minor problem. If people are unresponsive, then oh well, they tried to tell you you're hacked. If the site owner cannot be determined, they can email your ISP. This seems to work well for "one of your customers is torrenting movies", and since every ISP is known by definition (thanks, IP addresses), it should be fairly straightforward to get that message to the actual customer. (Send it with the invoice; if the customer doesn't pay invoices, then it's easy to resolve the hacked site. You were shutting them off anyway.)

Everything's illegal under the CFAA. It's an old bad overreaching law that should be repealed. The government rarely prosecutes itself though, so that's no reason why. Unfortunately, the culture in the US is such that the populace would freak out if the government tried to do such a thing, never mind practical surmountable issues.

Does CFAA restrict government interactions?

If the site operators are unresponsive then that sucks, but it would still help secure those that are responsive.

I mean... They could at least ty to contact the operator.

Greetings Citizen,

We have detected a dangerous virus or service in your hosting environment. Conspiracy theorists and foreign state actors often use these types of methods to spread fake news and influence our elections. These are serious threats to our Democracy, but Fatherland Security is here to help you through this difficult time. Your local neighborhood Security Helper will be at your home in the next few minutes to assist you in removing the dangerous HTTP service. For your safety, please stay away from all doors and windows.

Sincerely,

Rob E. Friendly

The way I read the article, they're actually collecting vulnerability information. So they check a site with Version X running on it, and detect the vuln; then they later see Version Y, without the vuln, and update their vulnerability database.

Nothing in the article suggests that they contact site-owners (I haven't re-read the article, so might be wrong).

I'm not sure why you think it's a potential violation of CFAA to connect to a public server and probe it. There's no suggestion of unauthorized access; that would involve exploiting vulnerabilities they find, and that would be unauthorized access.

> I think it's illegal under the Computer Fraud and Abuse act.

Things that are illegal for individuals to do aren't necessarily illegal for governments to do. This is a reason why the government should be vigorously doing this, rather than leaving it to private citizens, who risk being charged under the Computer Fraud and Abuse Act.

-----

> Also, what should the government do when it finds something?

It should contact the site operator.

-----

> What if the site operators are unresponsive or cannot be contacted?

I would imagine that in the case that site operators couldn't be contacted, they wouldn't be contacted.

Something tells me that even with the somewhat stretched version of extraterritoriality that the US claims about laws like CFAA, they wouldn't try applying that to their closest intelligence/defence partner country operating largely domestically...

Too busy spying on citizens. And maybe they want to use vulns for their own gain.

The US does do this, it is offered as part of security hygiene.

https://www.cisa.gov/cyber-hygiene-services

Looks like it's offered only to "critical infrastructure organizations".

Correct

"Who can receive services? Federal, state, local, tribal and territorial governments, as well as public and private sector critical infrastructure organizations."

However, methinks US definition of critical infrastructure organizations, both public and private, will be quite broad.