7 ms·
Sounds like a good service for a national security service to provide (in comparison to finding more ways to spy on us).
by anonymousDan 4y ago
Sounds like a good service for a national security service to provide (in comparison to finding more ways to spy on us).
- deleted 4y ago[deleted]
- pessimizer 4y agoWhy isn't the US doing this?
- deleted 4y ago[deleted]
- neets 4y agoMaybe it has something to do with the Nord Stream pipeline, maybe it doesn't
- luch 4y agoWord on the grapevine is saying that Google is doing similar. One of the "perk" of being a well-known DNS resolver (8.8.8.8) is getting an early notification whenever a server goes "online" on the internet.
- DaiPlusPlus 4y ago> is getting an early notification whenever a server goes "online" on the internet. Please elaborate.
- doorsopen 4y agoSomeone types in your new server/domain, like "ijustmadethissite.com", or "newlocation.existingsite.com" For their computer to resolve this domain name, it's going to call out to a DNS server, of which Google hosts a major one. It can be assumed that they log these names, and can then use that as a "notification" for a site coming up.
- SteveNuts 4y agoBut what does that have to do with scanning webservers for vulnerabilities, do they do something with the "newly seen sites", and if so is it documented what they do for scanning?
- lozenge 4y agoBecause if the vulnerability involves an HTTP request, then the Host header needs to have the domain name of the target website. So you need: IP address and port for the TCP headers, and the domain name to go in the TCP packet content. One example of a vulnerability would be having phpMyAdmin with a database password hardcoded and no login needed. Without the domain name it would still be impossible to access. (Of course, domain names shouldn't be considered secret so this would be a very insecure setup.)
- deleted 4y ago[deleted]
- Consultant32452 4y agoWay back in the early 2000s the FBI contacted a company I was working for to inform us that someone was hosting Disney movies on our servers. So something like this is at least sort of happening.
- l33t233372 4y agoI don’t know if copy right protection is the same as penetration testing.
- woodruffw 4y agoI would be surprised if this was the result of active scanning. It's more likely the FBI received a report from someone, and just forwarded it along.
- 0xbadcafebee 4y agoDisney: "Hey FBI, this server is pirating us, plz 2 takedown tyvm"
- GartzenDeHaes 4y agoI think it's illegal under the Computer Fraud and Abuse act. Also, what should the government do when it finds something? What if the site operators are unresponsive or cannot be contacted? There are a lot of practical problems.
- noodlesUK 4y agoSomething tells me that even with the somewhat stretched version of extraterritoriality that the US claims about laws like CFAA, they wouldn't try applying that to their closest intelligence/defence partner country operating largely domestically...
- l33t233372 4y agoDoes CFAA restrict government interactions? If the site operators are unresponsive then that sucks, but it would still help secure those that are responsive.
- iot_devs 4y agoI mean... They could at least ty to contact the operator.
- GartzenDeHaes 4y agoGreetings Citizen, We have detected a dangerous virus or service in your hosting environment. Conspiracy theorists and foreign state actors often use these types of methods to spread fake news and influence our elections. These are serious threats to our Democracy, but Fatherland Security is here to help you through this difficult time. Your local neighborhood Security Helper will be at your home in the next few minutes to assist you in removing the dangerous HTTP service. For your safety, please stay away from all doors and windows. Sincerely, Rob E. Friendly
- jrockway 4y ago> What if the site operators are unresponsive or cannot be contacted? This seems like only a minor problem. If people are unresponsive, then oh well, they tried to tell you you're hacked. If the site owner cannot be determined, they can email your ISP. This seems to work well for "one of your customers is torrenting movies", and since every ISP is known by definition (thanks, IP addresses), it should be fairly straightforward to get that message to the actual customer. (Send it with the invoice; if the customer doesn't pay invoices, then it's easy to resolve the hacked site. You were shutting them off anyway.)
- yellow_lead 4y agoToo busy spying on citizens. And maybe they want to use vulns for their own gain.
- yeuxardents 4y agoThe US does do this, it is offered as part of security hygiene. https://www.cisa.gov/cyber-hygiene-services https://www.cisa.gov/cyber-hygiene-services
- Zamicol 4y agoLooks like it's offered only to "critical infrastructure organizations".
- yeuxardents 4y agoCorrect "Who can receive services? Federal, state, local, tribal and territorial governments, as well as public and private sector critical infrastructure organizations." However, methinks US definition of critical infrastructure organizations, both public and private, will be quite broad.
- marricks 4y agoWhy not both? They will never tell you the unsavory things they're doing. At least, not without coercion.
- belter 4y agoIn Germany the BND does this. You get an annoying email from them if they find UDP ports available for an amplification attack on your Linux server...
- Tomte 4y agoAre you sure that it's not BSI?
- belter 4y agoYou are correct, its the BSI.
- hannob 4y agoNot as annoying as getting DDoS'ed with amplification attacks because some people can't properly configure their servers... (Also I doubt the BND does this, as another commenter pointed out.)
- treesknees 4y agoThat depends on whether the BND are testing that it could be used in an attack, or just seeing a port is open. Having UDP/11211 could mean you're running a vulnerable memcached service, but not necessarily so.
- belter 4y agoAs others pointed out, its indeed the BSI not the BND. Sorry for the confusion.
- hkt 4y agoHah - one of my first ever network programming tasks was to do this at a UK hosting company. That and SMTP relays. Good that (some) governments are wise enough to try to keep this sort of thing in check. I hope they aren't using a perl script triggered by a cronjob on a hand-rolled VM though..
- 4y ago
- onetimeusename 4y agoI have some doubts. For example, if they are just outputting the scan results from some tool with a high false positive rate, how is that helpful? It's a waste of time and money for the government. Bug bounty programs have the same issue that probably most bugs found are trash results from a scanning tool. On the other hand, a custom built tool that tries to find the most serious known vulnerabilities with a low false positive rate would probably be a good thing for the government to run.
- fao_ 4y agoI'd imagine part of the job of the people working there would be to limit the number of false positives.
- doubled112 4y agoCould be, but it is certainly not how it works at my org.
- ygjb 4y agoWhat scale does your org function at?
- pessimizer 4y agoSo if they use a bad tool, it would be bad, but if they use a good tool it would be good?
- hsbauauvhabzb 4y agoThere are no good tools. Just a bunch of shady vendors.
- onetimeusename 4y agocorrect. fortunately, the sales person from the security vendor, the media, and the public officials are aware of this constraint.
- verisimi 4y agoI think you misunderstand. I'm reading that the UK government is spying on us, and their retrospective plausible excuse is that they are scanning web servers for, erm, vulnerabilities. No, I don't think that the government is here to help. It allows itself only to maintain force, that it then uses to forcibly extract wealth from its herd, er, sorry citizens.
- archsurface 4y agoThe downvoting tells us about the crowd, not about your comment.
- jodrellblank 4y agoIt tells you that the crowd don't want to read unsubstantiated cynicaler-than-thou hot takes on HN. Downvoting "It's raining because Soros and his globalist Jewish cabal control the weather" does not mean I disagree that it's raining but the edit always comes in [downvoters can't handle the TRUTH, stay classy HN] or similar. e.g. how is scanning for vulnerabilities "spying on us"? How is scanning for vulerabilities "forcibly extracting wealth"? How is informing people of vulernabilities "not here to help"? It's a thinly disguised flamewar comment, not a comment on the topic.
- 988747 4y ago>> e.g. how is scanning for vulnerabilities "spying on us"? To play Devil's advocate: once you discover a vulnerability you always have two options: report it and have it fixed, or exploit it for your own gain. You charitably assume that government is somehow obligated to chose the former, while in reality in some cases it might choose the latter.
- _kbh_ 4y ago> To play Devil's advocate: once you discover a vulnerability you always have two options: report it and have it fixed, or exploit it for your own gain. You charitably assume that government is somehow obligated to chose the former, while in reality in some cases it might choose the latter. This assumes that the government that wants to compromise a domestic host can't do it in a way that is a lot more deniable than porting scanning you from a gov owned IP range. If the government wants to find and exploit a vulnerability they likely will find a way they don't need some loose cover story for it.
- stuaxo 4y agoDepends what they do when they find a vuln, there is incentive to not always reveal it.
- nonrandomstring 4y agoWell, as tradition I maintain a watch on postmaster and webmaster at... so I'd hope for a friendly heads-up. Basically well done.
- autoexec 4y agoRFC 2142 role mailboxes are critical. It's pretty telling that the webhosts that ignore the RFC are the ones I constantly find problems at. Godaddy not only routinely hosts all kinds of evil, but they make reporters jump through hoops to let them know they need to clean up their mess. If you do try to email abuse@godaddy.com they'll ignore your report and kick back an autoresponder message telling you to fill out a shitty web form instead. Nothing like making more work for people who already went out of their way to let you know you're causing problems for everyone else.
- Ptchd 4y agoBut, do they tell you about the vulnerabilities before they exploit them? Maybe they put it like this to exempt themselves...