3 ms·

How do researchers just "come across" these massive data dumps

by ridaj 7y ago

Fordec 7y ago
Brute force search and intuition for areas to target (eg. likely open ports, dictionary attacks)
- glenneroo 7y ago
  Does brute forcing still work these days? I thought the wild-west free-for-all scanning days would have ended, as ISPs (or someone in the routing chain) would block such attempts? I haven't tried since the 90s because I'm slightly paranoid about being classified as an evil hacker. Somewhat relatedly, my bank recently wouldn't let me login (cryptic error message) because they started using a "trusted IP scanner service" in the UK which had marked me as a proxy, probably because I was running a Tor Relay last year. I had to send multiple unblock requests, all of which were denied with canned responses that no, they won't reclassify my IP. Only when I mentioned that I couldn't login to my bank account did they finally unblock me. Point of my story is that it sure feels like more gatekeepers are being implemented to stop "nefarious" operations.
  - Fordec 7y ago
    The thing about standard practices is that they don't come as standard. For every 10 fort knox, there's at least one place with the side door left ajar. You only hear about those instances when a hack makes the news in a sort of reverse survivorship bias
    - glenneroo 7y ago
      So you're saying I could brute force scan IPs for vulnerabilities and won't have to worry about being denied access by e.g. my ISP, CloudFlare, AWS, etc?
      - Fordec 7y ago
        There will be access denials, but don't use your laptop IP and change up when it becomes a blocker. IPv6 has so many anyway you won't run out
tastroder 7y ago
Likely explanation for this type of discovery would be either internet wide scans of known services or happening across these servers while reverse-engineering an app / protocol related to the specific service. The former seems to be the case here, as the authors refer to some of their "web-mapping" efforts in the last paragraph and have previously published similar findings [1, 2] they discovered through the same process. You can get starting points for probing into this as a service from places like [3] if you don't want to perform the scan on your own infrastructure - although the tools for this became insanely accessible over the last few years (at least for IPv4 coverage). [1] https://www.vpnmentor.com/blog/report-millions-homes-exposed/ https://www.vpnmentor.com/blog/report-millions-homes-exposed... [2] https://www.vpnmentor.com/blog/report-theta360-leak/ https://www.vpnmentor.com/blog/report-theta360-leak/ [3] https://www.shodan.io/ https://www.shodan.io/
bostik 7y ago
Shodan safari. If you're researching internet-facing setups of anything, shodan is an excellent resource. You'll still have to actually investigate and sample the data from the discovered locations, but that's where even rudimentary tooling comes along.

How do researchers just "come across" these massive data dumps

by ridaj 7y ago

How do researchers just "come across" these massive data dumps

Fordec 7y ago

Brute force search and intuition for areas to target (eg. likely open ports, dictionary attacks)

glenneroo 7y ago
Does brute forcing still work these days? I thought the wild-west free-for-all scanning days would have ended, as ISPs (or someone in the routing chain) would block such attempts? I haven't tried since the 90s because I'm slightly paranoid about being classified as an evil hacker. Somewhat relatedly, my bank recently wouldn't let me login (cryptic error message) because they started using a "trusted IP scanner service" in the UK which had marked me as a proxy, probably because I was running a Tor Relay last year. I had to send multiple unblock requests, all of which were denied with canned responses that no, they won't reclassify my IP. Only when I mentioned that I couldn't login to my bank account did they finally unblock me. Point of my story is that it sure feels like more gatekeepers are being implemented to stop "nefarious" operations.
- Fordec 7y ago
  The thing about standard practices is that they don't come as standard. For every 10 fort knox, there's at least one place with the side door left ajar. You only hear about those instances when a hack makes the news in a sort of reverse survivorship bias
  - glenneroo 7y ago
    So you're saying I could brute force scan IPs for vulnerabilities and won't have to worry about being denied access by e.g. my ISP, CloudFlare, AWS, etc?
    - Fordec 7y ago
      There will be access denials, but don't use your laptop IP and change up when it becomes a blocker. IPv6 has so many anyway you won't run out

tastroder 7y ago

Likely explanation for this type of discovery would be either internet wide scans of known services or happening across these servers while reverse-engineering an app / protocol related to the specific service. The former seems to be the case here, as the authors refer to some of their "web-mapping" efforts in the last paragraph and have previously published similar findings [1, 2] they discovered through the same process. You can get starting points for probing into this as a service from places like [3] if you don't want to perform the scan on your own infrastructure - although the tools for this became insanely accessible over the last few years (at least for IPv4 coverage). [1] https://www.vpnmentor.com/blog/report-millions-homes-exposed/ https://www.vpnmentor.com/blog/report-millions-homes-exposed... [2] https://www.vpnmentor.com/blog/report-theta360-leak/ https://www.vpnmentor.com/blog/report-theta360-leak/ [3] https://www.shodan.io/ https://www.shodan.io/

bostik 7y ago

Shodan safari. If you're researching internet-facing setups of anything, shodan is an excellent resource. You'll still have to actually investigate and sample the data from the discovered locations, but that's where even rudimentary tooling comes along.