3 ms·

This is why the checking doors / neighborhood analogy isn't a good one. Having one person with poor computer security negatively impacts everyone. Hacked sites

This is why the checking doors / neighborhood analogy isn't a good one. Having one person with poor computer security negatively impacts everyone. Hacked sites turn into phishing landing pages, exploit kit hosting, stolen data dumps, and launching off points for attacks on everyone else. The vuln scanning ShadowServer is doing is meant to be a public good, which is why they share the info with ISPs and governments. Security is too intertwined to stand by and say other people's vulnerabilities aren't your problem.

FabCH 13d ago
It is a good analogy because thieves stealing from one house successfully gives them resources and incentivizes them stealing from the same area again. And even if you remove the analogy, ShadowServer means good, but good intentions doesn’t necessarily make their action moral or legal. Yes, compromised servers can be used by hackers as means to commit crimes. But when these groups scan the entire internet, they do cause harm as well, as shown in the original linked article. Much less harm than a black hat, but they still waste time and resources from innocent third parties. It’s fair to ask if the harm they cause is worth the good they do.
- 9x39 13d ago
  > It’s fair to ask if the harm they cause is worth the good they do. Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples. Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities. If we’re talking harm, it should be in the broader context of internet history, imo.
  - FabCH 13d ago
    Ok, but there is a massive difference between "I hammered my own CPU and found a bug that affects everyone" and "I hammered THE ENTIRE INTERNET and found some poor persons website that is not super secure and then I snitched on them to their ISP". The first is a lot more legal and ethical than the second.
    - 9x39 12d ago
      They didn't hammer the entire internet. That would be like a multi-terabit DDOS. In contrast, the scanner in question sent a trickle of web requests for old vulns, nearly-innocuous at this point. Fear & the danger aren't the same. anyway, I'll let it go.
      - FabCH 11d ago
        Think of it this way: It’s a fact that these scanners send unauthorized requests to servers whose owners did not consent to scanning. If we think this is acceptable, which of the following is also acceptable, and if some is not, where is the difference: 1) Detecting the scan and notifying the ISP of the scanner that they are abusers 2) Notifying law enforcement and filing a formal complaint 3) Implementing passive defense measures and responding with a reverse slow loris attack where you trickle 1 response packet per minute down the pipe to attempt to DoS the scanner. But only to prevent them from accidentally hitting some innocent third party’s homemade wiki system that deletes content on GET requests. Not with any malice, just to help prevent harm to others. 4) Implementing active defense where you return progressively more hostile response starting with zip bombs and ending with whatever sota cyberweapon latest AI can give you. But only to shut down the scanner and not cause any damage what so ever. Simply to check if their security is up to par. You would of course report any detected vulnerabilities to the ISP of the scanner, to prevent criminals from using the same. 5) Actively responding with a scan of your own to any incoming scans.

FabCH 13d ago

It is a good analogy because thieves stealing from one house successfully gives them resources and incentivizes them stealing from the same area again. And even if you remove the analogy, ShadowServer means good, but good intentions doesn’t necessarily make their action moral or legal. Yes, compromised servers can be used by hackers as means to commit crimes. But when these groups scan the entire internet, they do cause harm as well, as shown in the original linked article. Much less harm than a black hat, but they still waste time and resources from innocent third parties. It’s fair to ask if the harm they cause is worth the good they do.

9x39 13d ago
> It’s fair to ask if the harm they cause is worth the good they do. Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples. Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities. If we’re talking harm, it should be in the broader context of internet history, imo.
- FabCH 13d ago
  Ok, but there is a massive difference between "I hammered my own CPU and found a bug that affects everyone" and "I hammered THE ENTIRE INTERNET and found some poor persons website that is not super secure and then I snitched on them to their ISP". The first is a lot more legal and ethical than the second.
  - 9x39 12d ago
    They didn't hammer the entire internet. That would be like a multi-terabit DDOS. In contrast, the scanner in question sent a trickle of web requests for old vulns, nearly-innocuous at this point. Fear & the danger aren't the same. anyway, I'll let it go.
    - FabCH 11d ago
      Think of it this way: It’s a fact that these scanners send unauthorized requests to servers whose owners did not consent to scanning. If we think this is acceptable, which of the following is also acceptable, and if some is not, where is the difference: 1) Detecting the scan and notifying the ISP of the scanner that they are abusers 2) Notifying law enforcement and filing a formal complaint 3) Implementing passive defense measures and responding with a reverse slow loris attack where you trickle 1 response packet per minute down the pipe to attempt to DoS the scanner. But only to prevent them from accidentally hitting some innocent third party’s homemade wiki system that deletes content on GET requests. Not with any malice, just to help prevent harm to others. 4) Implementing active defense where you return progressively more hostile response starting with zip bombs and ending with whatever sota cyberweapon latest AI can give you. But only to shut down the scanner and not cause any damage what so ever. Simply to check if their security is up to par. You would of course report any detected vulnerabilities to the ISP of the scanner, to prevent criminals from using the same. 5) Actively responding with a scan of your own to any incoming scans.