Starting with one device and assuming a scan speed of ten IP addresses
per second, it [the scanner] should find the next open device within one
hour. The scan rate would be doubled if we deployed a scanner to the
newly found device. ... We did this in the least invasive way possible ....
I wonder if/when attaching a widely accessible and easily exploitable
device will be considered illegal (attractive nuisance, negligence,
public nuisance, contribution to a crime)?
To leap to a car analogy, if a driver leaves the keys in a vehicle
ignition, and the vehicle is stolen and used to commit some other crime,
does the driver face criminal penalties or civil liability?
Should a computer vendor or user who neglects to secure their
systems or network face penalties or liability? Should external
entities do wide scans to encourage better security? I think
that a "name and shame" approach aimed at vendors who ship
or install insecure-by-default systems could be effective.
Re:Here’s what you find when you scan the entire Internet in...
by groby_b on Sunday August 18, 2013 @03:30PM
(#6233826)
Since it's stateless, all info is encoded in the outgoing packet. If the outgoing packet (or the reply to it) is lost, it will look exactly the same as if the server didn't respond - after all, the scanning tool has no local state, and thus can't track if an address has been pinged/re-ping it. The port map is entirely drawn based on incoming packets.
Re:Here’s what you find when you scan the entire Internet in...
by perbu on Sunday August 18, 2013 @05:35PM
(#6234334)
I don't know how they progress through the IP space, but couldn't they simply solve this by doing it in a deterministic manner? At progress N they should easily be able to tell that A has been scanned. Iterating three times through the IP space all IPs that haven't answered should have gotten the connection attempts.
Re:Here’s what you find when you scan the entire Internet in...
by hmsimha on Sunday August 18, 2013 @07:42PM
(#6234766)
That might introduce the same overhead that maintaining state does in the first place. It sounds like they're sending out at least a million requests per second.
Re:Here’s what you find when you scan the entire Internet in...
by AlexanderDhoore on Sunday August 18, 2013 @12:18PM
(#6233091)
Yes... They are using the term 'internet' here, and only use 'web' when talking about HTTPS. They are port scanning hosts, at the TCP or UDP level. That seems correct to me?
Re:Here’s what you find when you scan the entire Internet in...
by guard-of-terra on Sunday August 18, 2013 @04:19PM
(#6234057)
I'm not sure there is. I'm not sure one can be truly sure he scanned the Internet before impersonating every host. Can't know anything before trying out the inside of every skin.
After all, what would you know, as a traveller, about simple lives of local people?
Re:Here’s what you find when you scan the entire Internet in...
by vacri on Sunday August 18, 2013 @05:47PM
(#6234376)
I've spent one hour of my life in Germany, when I was 11 years old, in a transit lounge in Frankfurt. I have 'visited Germany', but not in any real sense.
Re:Here’s what you find when you scan the entire Internet in...
by D9u on Sunday August 18, 2013 @04:40PM
(#6234140)
There's more to the internet than just port 80, so to declare that a scan encompassing only a single port on each host is a scan of "the entire internet" is somewhat mistaken.
The more correct title would be, "a scan of the entire World Wide Web."
"We experimentally showed that ZMap is capable of scanning the public IPv4 address space on a single port in under 45 minutes, at 97% of the theoretical maximum speed for gigabit Ethernet and with an estimated 98% coverage of publicly available hosts."
Re:Here’s what you find when you scan the entire Internet in...
by fla on Sunday August 18, 2013 @02:30PM
(#6233602)
I realise that my comment was not so clear, sorry about that. Yes, to me scanning the whole internet means at least the full port range in TCP (and why not UDP too).
My 'rant' is really about the article sensational title promising to let you know about the result of scanning the entire internet really fast... wich turns out to be about scanning web services. The data is however interessting.
http://census2012.sourceforge.net/paper.html
Starting with one device and assuming a scan speed of ten IP addresses per second, it [the scanner] should find the next open device within one hour. The scan rate would be doubled if we deployed a scanner to the newly found device. ... We did this in the least invasive way possible ....
I wonder if/when attaching a widely accessible and easily exploitable device will be considered illegal (attractive nuisance, negligence, public nuisance, contribution to a crime)?
To leap to a car analogy, if a driver leaves the keys in a vehicle ignition, and the vehicle is stolen and used to commit some other crime, does the driver face criminal penalties or civil liability?
Should a computer vendor or user who neglects to secure their systems or network face penalties or liability? Should external entities do wide scans to encourage better security? I think that a "name and shame" approach aimed at vendors who ship or install insecure-by-default systems could be effective.
http://en.wikipedia.org/wiki/Strict_liability_%28criminal%29
the downside of stateless portscanning is that you are trading speed for false negatives.
That's interesting. Could you explain this in a bit more detail? Unless I missed it, the thread from yesterday didn't discuss this.
https://github.com/dugsong/dscan
Are they scanning all ports, or a subset, or just one?
In any event, the best time to scan the Internet, at least from Michigan, seems to be early in the morning.
After all, what would you know, as a traveller, about simple lives of local people?
The more correct title would be, "a scan of the entire World Wide Web."
More correct would be "A scan of world wide web servers running on the default port 80"
"We experimentally showed that ZMap is capable of scanning the public IPv4 address space on a single port in under 45 minutes, at 97% of the theoretical maximum speed for gigabit Ethernet and with an estimated 98% coverage of publicly available hosts."
Why be in doubt when the research is published?
Did you even read the documents?
This makes "they visited the whole internet" true, "they aren't limited to web only" also true.
My 'rant' is really about the article sensational title promising to let you know about the result of scanning the entire internet really fast... wich turns out to be about scanning web services. The data is however interessting.