3 ms·

And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, mor

And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations. Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior. In short, I suspect this entire article is bullshit. It is on Wired, after all.

gjs278 8y ago
you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.
- blitmap 8y ago
  I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.
meowface 8y ago
It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services. (I'm sure NSA is, too, but obviously with different objectives.)
zmapuser 8y ago
There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday. [0]:https://zmap.io/ https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/ https://memcachedscan.shadowserver.org/

gjs278 8y ago

you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.

blitmap 8y ago
I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.

meowface 8y ago

It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services. (I'm sure NSA is, too, but obviously with different objectives.)

zmapuser 8y ago

There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday. [0]:https://zmap.io/ https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/ https://memcachedscan.shadowserver.org/