18 ms·
UK Government scans all web servers hosted in the UK for vulnerabilities
- maptime 4y agoFrom personal experience this is a fantastic service for gov entities For those not aware, UK gov has pretty world leading tech services, the best example is the UX of the main sites like car tax
- Gordonjcp 4y ago> the best example is the UX of the main sites like car tax To give you a comparison, in the US you need to go down to the DMV with a wad of forms, get the bits you can't fill in filled in, let someone make up a price, decide you haven't filled a bit in properly, send you away to a different window, get something else filled in, pay a fee for the filling in, hand the papers in at yet another window, pay for the actual registration, get a temporary registration slip, pay for a set of plates to actually be fixed onto the vehicle, pay for the stickers that say you've paid for a plate, all of which paid by cheque at various windows, with no real idea of the total cost up front. In the UK (where cars tend to keep the registration number they're given on first registration), you go to the DVLA website, follow the prompts for the kind of paperwork you have (reminder letter, V5 registration certificate, V5C "green slip" if you've just bought it that the previous owner tears off the bottom of the V5 and gives you), it tells you how much it'll be per month or per year, you put your credit card details in, and that's it. Paid, done, nothing more to do.
- tialaramex 4y agoLots of this stuff is required to be done by US States, rather than by the US Federal Government, and Americans are in general keen to keep it that way, for a mix of good and bad reasons. So every problem needs to be solved independently fifty times. People who live in continental Europe might have examples similarly because there are undoubtedly things European countries, especially EU member states could co-ordinate and don't. The difference in population between Luxembourg and Germany is even bigger than between Vermont and California.
- bombcar 4y agoYeah, my states system is basically the same as the UKs but you can also pay for registration via some weird kiosk.
- 2Gkashmiri 4y agowaiting for india to implement something similar for seemingly benign reasons like vulnerability and code quality and immediately use it to find critics and hang them. heck, a guy was sentenced for 5 years over a facebook post.
- bhaskara2 4y ago> 2Gkashmiri Stop lying and not relevant, you clearly came here with an agenda.
- 2Gkashmiri 4y agooh really. an agenda... >In the unlikely event that we do discover information that is personal or otherwise sensitive, we take steps to remove the data and prevent it from being captured again in the future. beyond a promise, what assurances do you get it wont be weaponzed?
- pessimizer 4y agoScanning for vulnerabilities won't help you find critics. If you wanted to look for critics, you would scan for critics.
- 2Gkashmiri 4y ago>We design our requests to collect the smallest amount of technical information required to validate the presence/version and/or vulnerability of a piece of software. We also design requests to limit the amount of personal data within the response. In the unlikely event that we do discover information that is personal or otherwise sensitive, we take steps to remove the data and prevent it from being captured again in the future. what is preventing a government to disregard the removal of sensitive data? why can they not weaponize this?
- mantas 4y agoOld news? Few years ago I got a similar notification. A government agency here in Lithuania was happy to remind that my wordpress instance was outdated.
- blitzar 4y ago"We have received a notification from the German Federal Office for Information Security (BSI) for (the IP address of) a server you have with us. Access to a MongoDB server should be restricted to trusted systems (for example, the related web application server)." My mongodb had with auth - but port was open.
- anonymousDan 4y agoSounds like a good service for a national security service to provide (in comparison to finding more ways to spy on us).
- deleted 4y ago[deleted]
- pessimizer 4y agoWhy isn't the US doing this?
- deleted 4y ago[deleted]
- neets 4y agoMaybe it has something to do with the Nord Stream pipeline, maybe it doesn't
- luch 4y agoWord on the grapevine is saying that Google is doing similar. One of the "perk" of being a well-known DNS resolver (8.8.8.8) is getting an early notification whenever a server goes "online" on the internet.
- DaiPlusPlus 4y ago> is getting an early notification whenever a server goes "online" on the internet. Please elaborate.
- doorsopen 4y agoSomeone types in your new server/domain, like "ijustmadethissite.com", or "newlocation.existingsite.com" For their computer to resolve this domain name, it's going to call out to a DNS server, of which Google hosts a major one. It can be assumed that they log these names, and can then use that as a "notification" for a site coming up.
- underdeserver 4y agoThe UK government seems to be doing the right thing in IT, again and again.
- mnd999 4y agoProbably breaking their own ‘Computer Misuse Act’ in the process though.
- switch007 4y agoI’m not sure we’ve invented a measurement sufficiently small to measure how little recent governments have cared about breaking the law.
- denton-scratch 4y agoThat'll be the Planck shit-given unit.
- mijoharas 4y agoI believe Alex Van Someran recently took over as head of the UK NCSC. He's someone that I trust to make the right decisions, so I'm quite glad of this fact. (NOTE: I have no idea if this specific link is related to Alex or anything he's done)
- core-utility 4y agoAgreed, but if the US Government were doing this there would be outcry of "spying" and "Government overreach". And before anyone says that the US Gov has lost its trust, let me remind you that UK has GCHQ.
- decide1000 4y agoHow can one get all the active ip's within the borders of a country? Is there a database for this?
- dekken_ 4y agohttps://lite.ip2location.com/united-kingdom-of-great-britain-and-northern-ireland-ip-address-ranges https://lite.ip2location.com/united-kingdom-of-great-britain...
- treffer 4y agoScanning only needs to know the potential ips, not the active ones. And you might be interested in the ip space of all UK entities. If you put it this way then the problem becomes way easier. Just check public ip databases for AS and technical contact.
- SXX 4y agoWithin IPv4 address space you can certainly do it in a day using $100 dedicated server on Hetzner and ZMap.
- mantas 4y agoIn my case it was out-of-country website with a local TLD.
- nix23 4y agoUK Government also scans all internet traffic and save's it 3 days.
- IndigoIncognito 4y agoGood to know where my tax money is going
- dagenix 4y agoCitation?
- damagednoob 4y ago"Valuable data can be kept for three days, and metadata for 30 days. One leaked document states that all metadata is usually kept: 'we pull in everything we see'." https://www.amnesty.org.uk/why-taking-government-court-mass-spying-gchq-nsa-tempora-prism-edward-snowden https://www.amnesty.org.uk/why-taking-government-court-mass-...
- dagenix 4y ago"metadata" & "everything we see" is not the same thing as "all internet traffic". I'm not trying downplay the quantity or sensitivity of what is stored, its just the idea that all internet traffic is being recorded by any government seems technically very challenging and makes me very skeptical of that unqualified claim when I see it.
- BurningFrog 4y agoI always wonder how much of the bandwidth in the world is used to spy on the "regular" traffic. I suspect it's well over 50%. I mean, the UK is far from the only power capturing all our traffic.
- RadiozRadioz 4y agoGiven the percentage of global internet bandwidth that is video streaming, and the immense expense that entails, I find your >50% figure hard to believe.
- politelemon 4y agoScanning web sites hosted in the UK. Scanning the web server implies their software is running on the server OS.
- iso1631 4y agoIf I ping a server it doesn't mean my software is running on it.
- LightG 4y agoYes, I'm sure they're just scanning for vulnerabilities ...
- benbristow 4y agoGot something similar here in the UK also. I once had a Linux server box running on my DMZ, got a few physical letters from my residential ISP (Virgin Media UK) saying they detected some open port that was recommended to be closed (Think it was NetBIOS port). Might have been part of this scheme. Don't have that box anymore (was around 5 years ago) or a PC on the DMZ so haven't received any since.
- denton-scratch 4y ago> Might have been part of this scheme. I doubt it. Network operators like Virgin have very good business reasons to ensure their own network isn't infested with computers running services like NetBIOS, which has no business being exposed on the internet (it is rather verbose, and completely useless outside of a LAN).
- bitL 4y agoGermany is doing the same, Hetzner customers get emails from government pentests if they find something.
- sam_lowry_ 4y agoI received their emails a couple of times. Not sure if a cost-benefit analysis would find such ops positive for the society. Think of the time wasted by people who read such emails vs the money spent protecting from attacks. Factor in the cost to the taxpayer. That's a good topic for a Master thesis in Economics. Anyone interested?
- WesolyKubeczek 4y agoAlso, I’ve got an email about any freshly imaged Mac Mini from Hetzner. Turns out macOS runs with legacy netbios ports open to the wide world by default, but to disable that service, you have to unload a service via Terminal. There’s no prefpane for that.
- chmod775 4y agoI know Germany provides the same service as well, but I don't know how fleshed out it is really. So far all the mails they sent me have been not very helpful.
- danudey 4y agoCanada does the same thing, they actually found a memcached instance of ours on a dev VM that was accidentally exposed to the internet.
- BonoboIO 4y agoSame. I run a plex server and they send me the same unhelpful and wrong email every few days. I created a gmail rule to delete it immediately.
- lutoma 4y agoMore details on the German one: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Reaktion/CERT-Bund/CERT-Bund-Reports/cert-bund-reports_node.html https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisati... The intention is good, but in practice I think it's mostly useless because: * The reports go to the AS operator, who in most cases are not the actual admins of the vulnerable software. Some hosting providers such as Hetzner and Manitu have scripts in place to forward reports to the respective customers, but most don't since it involves a lot of parsing of the email (which is not in an easily machine readable format). * The emails often warn about security issues that may not actually be problematic (i.e. merely warning about some open port that may be intentionally open, and especially if you operate, say, a honeypot), with no way to opt out for specific hosts/ports. So you can only really filter them entirely in your mail client which I think most people do.
- bayindirh 4y agoTurkey also does the same. You get vulnerability reports.
- no-dr-onboard 4y agoAnyone who has worked with Chinese companies operating within China can tell you that very similar laws were enacted a year ago. The CCP has a law that any vulnerabilities made aware to private companies need to be disclosed to the federal government. This was done in the name of "national security". IMO, this seems to be a more veiled version of that same mindset. http://www.cac.gov.cn/2021-07/13/c_1627761607640342.htm http://www.cac.gov.cn/2021-07/13/c_1627761607640342.htm https://www.cpomagazine.com/cyber-security/is-china-looking-to-stockpile-zero-days-new-vulnerability-disclosure-rules-could-create-closed-pipeline-from-security-researchers-to-ccp/ https://www.cpomagazine.com/cyber-security/is-china-looking-...
- adamckay 4y agoThis is the opposite, though. It's a part of the UK's security services running scans for vulnerabilities they already know about to tell you that you've got an issue.
- franga2000 4y agoI was about to say how great I think that law is, but then I checked the link you provided... > anything discovered in the country must now be reported to the CCP *and to no one else* (in most cases). The "no one else" part is terrible and completely changes the story. However, I do generally support a "tell the government about discovered vulnerabilities" law. Ideally, the government would then inform affected users and investigate whether the vuln could be considered negligence and the company prosecuted. I've been in a few situations where I reported very easily exploitable vulns that leaked sensitive user data and in all cases, I couldn't for the life of me convince the companies to disclose the leak. Yes, I could've gone public myself where I didn't have a contract, but I would've 100% ended up in jail for some poorly defined crime of "hacking".
- keepquestioning 4y agoHow do they find all web servers?
- iso1631 4y agofor NET in $UK_NETS; do nmap -p 80,443 $NET; done
- deleted 4y ago[deleted]
- AtNightWeCode 4y agoCool. But in most cases you need to get behind services like Cloudflare.
- LinuxBender 4y agoGood on them. They should get an account on shodan.io [1] and pull in all that existing data whilst they are at it. [1] - https://www.shodan.io/ https://www.shodan.io/
- mike_d 4y agoThere are already a handful of organizations that scan the entire internet and feed the data to western governments. You can poke around at https://viz.greynoise.io/ https://viz.greynoise.io/ to see who is doing what.
- jokabrink 4y ago> feed the data to western governments It is ironic that the very link [1] you provided proves you wrong. The top 5 countries of origin doing IP scanning in the last seven days are China (120k), India (67k), US (52), Iran (44k), and Russia (27k). - [1] https://viz.greynoise.io/query/?gnql=last_seen%3A7d https://viz.greynoise.io/query/?gnql=last_seen%3A7d
- acdha 4y agoThat doesn’t mean they’re wrong: it just says that other people scan the internet, too, which nobody would argue.
- _0ffh 4y agoRight, also the source IP of a port scan doesn't say anything about who has initiated that scan. If I were a state actor, I'd do my port scanning from machines in a different jurisdiction for sure.
- acdha 4y agoTotally - this is like thinking you’ll catch FSB agents by looking for Russian passports.
- TheRealPomax 4y ago"As part of the NCSC’s mission to make the UK the safest place to live and do business online" those are pretty wildly disparate goals. Why would those two things be under the same agency at all?
- mytailorisrich 4y ago'Online' applies to both 'live' and 'do business' in the sentence above. Their mission is to make online activities safe.
- TheRealPomax 4y agoExcept people don't live online. They live in the UK, and maybe spend time online, and this agency knows that.
- adamckay 4y ago> They live in the UK, and maybe spend time online I think "maybe" drastically undersells the amount of time and things some people do online (generally the younger generations). You're also overlooking that a very large portion of daily life has moved online and it's important to protect that. Everything from buying groceries, booking doctors appointments to looking up the menu of local restaurants. I'd want all my personal and payment details protected, and it's reassuring to know information I'm reviewing hasn't been maliciously tampered with.
- xg15 4y agocue star wars meme to assist the scanned site with fixing the vulnerabilities, right?
- matthews2 4y agoHopefully it's slightly less pathetic than the "Police CyberAlarm". https://paul.reviews/police-cyberalarm-abysmal-security-yet-again/ https://paul.reviews/police-cyberalarm-abysmal-security-yet-... https://scottarc.blog/2022/07/04/police-cyberalarm-uses-alarming-cryptography/ https://scottarc.blog/2022/07/04/police-cyberalarm-uses-alar...
- geek_at 4y agoFunny enough I did a similar thing for my country (Austria). Found quite a few strange things and even made a collage of screenshots of all webservers hosted in Austria - https://blog.haschek.at/2019/i-scanned-austria.html https://blog.haschek.at/2019/i-scanned-austria.html
- ultra_nick 4y agoWhere did you find an index of all of your county's websites?
- EthicalSimilar 4y agoYou didn’t open the post, did you?
- maerF0x0 4y ago
- treesknees 4y agoTo be clear, they said "web servers" not "websites". They just pulled a list of all public IP blocks registered to the country and opened port 80/443 on each IP address and took a screenshot. It's by no means a list of the websites hosted on those servers. You could get somewhat closer by inspecting public DNS records for those IP addresses and then attempting to load each site by DNS name, but it still wouldn't be a complete index of all websites in the country. I'm thinking that's impossible to collect, or at least very nearly.
- BonoboIO 4y agoYou got a new rss subscriber. I like that, I’m surprised that are only 60.000 ips that answer on the 80 port.
- Waterluvian 4y agoI once ranted loudly that governments should be doing this for free. That governments should be assembling the best team of pentesters to pentest everything they can possibly find within their jurisdiction. I love seeing this.
- godelski 4y agoI've also ranted about this, and how it should be one of the NSA's top priorities (including doing it for our allies). It's interesting because there are two main methods for what to do when you find a vulnerability: 1) hold onto it so you can later use it as a weapon or 2) disclose it and patch it. The offensive method has problems because as soon as you use it you are disclosing it. It also has the issue that your enemies may be able to (are likely to) find the same vulnerability and exploit it first. But the second method means you're losing your weapons but instead gaining a shield. As I see it, the shield is a lot bigger and has far higher utility. But part of that is that I see democracies as having differing vulnerabilities than autocracies. Attacking autocracies is more spear phishing, very directed attacks on the specific people that control power. But attacking democracies is in some sense easier (and in another sense harder) because more power is held by the average person. People who are more vulnerable to manipulation, especially at the large scale. But now we're edging into the data privacy domain and that's probably out of scope here. I really think there should be a very strong blue team effort by these organizations. I am okay holding on to a specific vulnerability if you're going to attack a specific person in the ,,immediate'' future, but these agencies should also be working with companies to patch these vulnerabilities. That is the government providing a social good. You know, the reason we have the social contract and government in the first place.
- Waterluvian 4y agoThis just made me think of something I need to look up now. Allied nations regularly perform war games for practice. What about cyber war games?
- godelski 4y ago
- dwheeler 4y agoI wonder how effective this is. The text suggests that the only thing that they look for is that they look for is a version statement of a major component, and then compare it to known vulnerable components. That could be somewhat helpful, but a lot of vulnerabilities won't be detected by that process. Does anyone know if they do more?
- anonymousDan 4y agoI think this kind of service should be heavily skewed to favour false negatives instead of false positives.
- amelius 4y agoThey should do this for privacy violations too.
- godelski 4y agoDoes anyone remember that hacker that scanned printers and if they found a vulnerability they exploited it to print out a warning to the owner of said vulnerability? I think they patched it too? Edit: Looks like it has happened more than once https://cybernews.com/security/we-hacked-28000-unsecured-printers-to-raise-awareness-of-printer-security-issues/ https://cybernews.com/security/we-hacked-28000-unsecured-pri... https://www.bleepingcomputer.com/news/security/a-hacker-just-pwned-over-150-000-printers-left-exposed-online/ https://www.bleepingcomputer.com/news/security/a-hacker-just...
- coretx 4y agoThat happend over 9000 times. Fun fact: Some are print server appliances, no patches or updates for some of those available as they are EOL - but still in use...
- maurits 4y agoThe Swiss do it too. I got a very polite email in 4 languages. ps: Anybody? [1] [1] https://serverfault.com/questions/1112995/prevent-the-git-directory-from-being-server-by-nginx https://serverfault.com/questions/1112995/prevent-the-git-di...
- motohagiography 4y agoTaking responsibility for collecting and using vulnerabilty scan data in this case also means assuming authority to do so. A good test would be whether citizens are also free to inspect the vulnerabilities of government systems, or have a right to do so. If they don't, that's worth scrutinizing. Canada has a different approach, where institutions can sign up to using a federal DNS service provided through the domain registrar, which I interpret is not unlike 1.1.1.1 or 9.9.9.9, but with malware detection. I believe it's called Canadian Shield, and it's not active scanning, but rather passive collection from institutions that manage infrastructure. Active scans by government seems a bit like domestic intelligence collection. Given the techincal capabilities of most of these agencies when they work with ISPs, hairpinning traffic from one of these scanned servers for inspection is trivial. Fine if the threat model involved exceptional cases with clear oversight, and individual decision accountability in response to ticking bomb situations, but the examples of how similar powers have been used in the past are so abundant that I'm having trouble remembering a situation where they were used to protect a mere citizen.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- zemnmez 4y agoI can personally attest to the fact that yes, british citizens can assess vulnerabilities in UK government systems. This was something I worked with the UKNCSC on: https://www.ncsc.gov.uk/information/vulnerability-reporting https://www.ncsc.gov.uk/information/vulnerability-reporting
- motohagiography 4y agoThat's pretty cool. There are these pockets of really great public service internet services. Am I interpreting correctly that you can join HackerOne to do work on UK public service projects? I tried to get something like that done for a municipality and a province, where it was going to be a way to engage college students on doing vulnerability hunting on public infrastructure, but also use it as a recruiting pipeline to get people interested in public service.
- OnlyMortal 4y agoYup. When I worked in “secret” level security, we’d often have an email circulation from “someone I can’t name” about potential vulnerabilities in software “I’m not allowed to talk about”. But, at least at some level, this is true.
- hannesm 4y agosrsly it's 2022 and they only have legacy IP and no IPv6?
- bombcar 4y agoScanning IPv6 is effectively impossible.
- funshed 4y agoSounds like low hanging fruit scans.
- autoexec 4y agoCleaning up the low hanging fruit would be a huge benefit for everybody (except criminals)
- mr_gibbins 4y agoAll connections are made using one of two IP addresses: 18.171.7.246 35.177.10.231 Block these IPs.
- acdha 4y agoWhy? That won’t stop anyone malicious — wouldn’t your time be better spent making your services more secure?
- nmeagent 4y agoWhy not? Maybe they don't 100% trust their government for whatever reason. Why must they let their ports be subject to arbitrary inspection by an entity they don't trust if they don't have to? Hell, I'd block this port scanning on general principle.
- autoexec 4y ago> Why must they let their ports be subject to arbitrary inspection by an entity they don't trust because that's literally how the internet works. Their ports are and will always be subject to arbitrary inspection while they are reachable on the internet.
- nmeagent 4y agoThe if they don't have to was a rather important part of the statement you quoted. I'm saying if they can block the scanning packets and have some subjective reason to do so then this is fine, the value of the scanning as a service notwithstanding.
- autoexec 4y agoThe point is that if you want to have a device on the internet you will "have to" by definition. You don't get a choice. Everything on the global internet is subject to arbitrary inspection at any time by anyone. That's how it works. Someone may inspect your device and discover they are blocked, or ports aren't open, but arbitrary inspection isn't something you ever have a choice in.
- Gordonjcp 4y agoLooks like rangerovers.pub isn't interesting or critical enough to get scanned. I didn't think it would be. Fun watching all the foreign traffic trying to hit Wordpress vulns on it, though.
- WaitWaitWha 4y ago> What precautions and safety measures does the NCSC take when scanning? > The NCSC is committed to conducting scanning activities in a safe and responsible manner. As such, all our probes are verified by a senior technical professional and tested in our own environment before use. We also limit how often we run scans to ensure we don’t risk disrupting the normal operation of systems. That is it? So... One gal looks at in and says, yep, fire up the guns! All is go!? Can I see the publish test? Can I see your "own environment"? What will they do if (when) this service gets whacked and delivers a DoS on a bunch of sites? Send the webmaster a free credit check? How does cloudflare, akamai, and similar feel about this? Personally, I would not trust my dog's toothbrush to any gouvernement. I would be happy to see this if it was opt in. In my opinion, they should have spent all the money on securing themselves, increase their own security education, increase security staff compensation to get higher caliber staff, and public education.
- technion 4y agoThere's a reality that the second you put something on the Internet it starts being scanned by bots and bad actors. The problem with the various "checking your door is locked" analogies is that you'd have to picture a locksmith putting in a door with five bad actors lined up behind up waiting to check it immediately. The HN crowd is probably thinking about startups with in-house apps, but the canonical case for this argument is the Microsoft Exchange or Confluence servers that are consistently abused by ransomware actors - which then go on to cost that Government a lot of money as they get dragged into suppliers and contractors being held up for ransom, or investigatory resources being spent in response. It's very easy to tell who owns such a server, and being proactive helps address that. It's fine to "not trust", but if this service poses any more of a threat to an organisation than the dozens of services already running you've got other issues.
- inferiorhuman 4y agoPersonally, I would not trust my dog's toothbrush to any gouvernement. From https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Eschew flamebait. Avoid generic tangents. Omit internet tropes. Please don't use Hacker News for political or ideological battle. It tramples curiosity. Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead.
- raggi 4y agoNow if only gmail, hotmail and friends would all close accounts who's passwords are on public lists, this would all make a dent.
- jasmer 4y agoIt's heartening to see a government do something that is technologically progressive and useful. I would rather hope that EU/Anglosphere/Japan/Korea etc. 'team up' on this one and at minimum exchange notes and best practices.
- tsujamin 4y agoThe Australian counterpart to NCSC does similar with its CHIPs program (https://www.cyber.gov.au/acsc/view-all-content/news/acscncsc-collaboration-strengthen-cyber-security-posture https://www.cyber.gov.au/acsc/view-all-content/news/acscncsc...)
- tmn007 4y agoThat is just government though. However I'm sure ACSC is scanning all known AU websites...
- astonex 4y agoKorea and Japan are far far behind when it comes to government agencies and their tech competency.
- jollofricepeas 4y agoSorry. Im going to say this isn’t technologically useful. REASONS: 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. 2. Most attacks lead with phishing and account takeovers not software vulns. Most people assume that if you scan all the things it fixes the problem or even empowers people to fix problems but it doesn’t. If governments want to do something truly progressive then here’s a better option. 1. Use MFA preferably hardware tokens everywhere. 2. Catalog all externally exposed assets 3. Catalog all high-risk internal assets 4. Regularly white box pentest your assets (switch vendors annually) and implement a bug bounty program as well 5. Penalize any organization that doesn’t remediate their critical pentest and bug bounty findings
- zinekeller 4y ago> 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. EQUIFAAAAAAAAAAAAAX!!!!!!!!! (Yes, the Equifax hack was due to a widely-known vulnerability in Apache Commons that apparently the DHS warned about but Equifax didn't bother to patch it.) Also, knowing that hospital equipment still runs Windows XP (with some sturdy-but-aged machines running Windows 2000), I'm not sure if there's any good benefit for this. Sure, small businesses might take action on a genuine oversight but larger businesses tend to know already that their systems are insecure (even when taking state-level/sponsored attack out of the equation).
- Eleison23 4y agoSo they scan web servers, cool. What about other kinds of servers? Do they scan SMTP servers? What about POP/IMAP servers? Do they scan web servers not on 80/443? Do they scan IoT servers? Login servers on routers? SSH servers on anything? Do they scan VPN servers, TOR exit nodes, or open proxies?
- ZhadruOmjar 4y agoWow you sure got them. I'm sure some of the country's brightest minds forgot to check SMTP.
- taubek 4y agoIf you are a sys admin how can you tell the difference between legit scan and scan by potential hacker?
- deleted 4y ago[deleted]
- dang 4y agoThe article doesn't appear to say what the submission title says. Is it true? If not, what's a better title?
- jollofricepeas 4y agoWhy not summarize the leading description from the page… “This page provides information on the [UK’s National Cyber Security Centre] NCSC’s scanning activities”
- jankal 4y agoThe German government also does that through their BSI (federal office for information security). It’s just not widely known and they don’t have any good information on their website about it. The only thing I found was this (in German, there does not seem to be an English version): https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Reaktion/CERT-Bund/CERT-Bund-Reports/cert-bund-reports_node.html https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisati...
- another2another 4y agoI inadvertantly opened an unprotected NFS port on a Hetzner server and they alerted me. Personally I was very grateful.
- egao1980 4y agoSo now when the government hacks your website it's called - "scanning for vulnerabilities".
- mrcartmeneses 4y agoWhich fucking idiot minister banned the Oxford Comma?
- mehmedra 4y agosa