4 ms·
Well scanning has some useful security research applications. The part about scanning the whole internet is useful if you want to do larger scale research (like
by antoinealb 6y ago
Well scanning has some useful security research applications. The part about scanning the whole internet is useful if you want to do larger scale research (like how many % of the internet run telnet).
In addition massscan is really interesting from a software engineering persepective. They do kernel bypass to talk to network drivers directly, have a custom TCP stack, custom mutexes, etc. All of that to be able to reach ~1.5M packets per second (from the README), allowing someone to scan the whole IPv4 range in 6 minutes. Really impressive work.
- Netcob 6y agoI wonder how many "counter-scans" would start arriving immediately afterwards.
- stoolpigeon 6y agoresulting in the much loved venn diascan.
- wang_li 6y agoScanning other people's networks without their permission has no valid research purpose.
- deleted 6y ago[deleted]
- shawnz 6y agoThe person you are replying to just gave an example of a research application. What's not valid about it?
- wang_li 6y agoBecause it's always invalid to research on someone else's property without their permission. Also what is the hypothesis that is being researched or investigated by knowing how many systems on the internet respond to TCP SYNs on port 23?
- nwallin 6y agoIt's valid to perform research on Earth by taking satellite photos and examining them for land cover use. It's valid to use a laser range finder to map the land elevation of the entire planet. Among the various governments which have done this, Airbus has as well. Presumably to ensure nobody flies a plane into a mountain. If it's valid to shine a laser pulse from space/the sky onto the entire surface of the Earth (private property included) to determine the elevation of everything, it's valid to send TCP SYNs out to the entire surface of the internet.
- shawnz 6y agoThat seems ridiculous to me. Is it invalid to conduct research about the colours of houses in my neighbourhood without asking my neighbours first?
- wang_li 6y agoThat's a poor analogy. The outside colors of the majority of the homes in your neighborhood effectively broadcast that information into the public sphere. A more analogous question is "Is it valid to conduct research about all the homes in the world by around and attempting to peer into all their windows to see if there are any interior bedrooms with pink walls and fluffy animals?" Alternately, you could ask me "If a computer is broadcasting packets to my computer which is connected to a network port that I'm allowed to connect to, is it ok for me to note that?" In which case I'd say yes.
- c22 6y agoIt's really more like knocking on people's doors and noting the clothing colors of anyone who answers.
- shawnz 6y agoScanning through windows to find fluffy animals is certainly getting closer to crossing an ethical boundary but it's not strictly illegal. I also think that moves the analogy too far in the other direction. While it may not be the case that servers are actively "broadcasting" their port open status to all internet users, that's only because it would not be feasible to do so. It is not because port open status is supposed to be private or secret information, like the inside of my bedroom for example. In fact TCP/IP is designed with the intention that anyone can check the port open status without authentication. It is part of the intended usage of the protocol, so presumably it is safe to assume that anyone using it is probably using it with that intention.
- paranoidrobot 6y agoThere's an argument to be made that if your system accepts a connection, then that's permission to connect. If it then accepts a HTTP Request, as these folks have, then that's permission to continue with the request. If they didn't want to accept any connections, they should've closed the port. If they only wanted authorised users to connect, they should put an authorisation requirement on the connection. As for your statement that there's no valid research purpose, that's your assertion, a lot of people will disagree.
- deleted 6y ago[deleted]
- wang_li 6y agoWhat a machine does in response to a network packet does not prove the intent of the owner of the system. Otherwise RCEs and local privilege escalations would be permission to do as you will to any system which us susceptible to them. Is it valid to research untreated syphilis in black men? Yes. Is it valid to research untreated syphilis in black men without their permission and informed consent? No.
- shawnz 6y ago> Is it valid to research untreated syphilis in black men without their permission and informed consent? No. The Tuskegee Syphilis Study was inappropriate because they purposely withheld information about the diagnosis and lied about the efficacy of the treatments they were giving. The problem wasn't that they conducted the research without telling the patients. Obviously the patients were aware that they were part of a research effort, since they directly interacted with the clinicians conducting it.
- yjftsjthsd-h 6y agoThis isn't exploiting a vulnerability. If I knock on your door and you open it and invite me in, you don't get to complain about how I'm trespassing. If your server responds to traffic on a port, then it's completely fair to conclude that you're okay with that.
- toyg 6y agoWut? It's like saying that going around in a google car taking pictures of all doors has "no valid research purpose". (And yes, checking if the doors are opened or closed, or cataloguing their locks, would be fairly legitimate too; as long as one does not step into an actual property, at which point it's trespass.)
- samoa42 6y agoplease tell us the addresses and ports where you have been scanned inappropriately