Starting with one device and assuming a scan speed of ten IP addresses
per second, it [the scanner] should find the next open device within one
hour. The scan rate would be doubled if we deployed a scanner to the
newly found device. ... We did this in the least invasive way possible ....
I wonder if/when attaching a widely accessible and easily exploitable
device will be considered illegal (attractive nuisance, negligence,
public nuisance, contribution to a crime)?
To leap to a car analogy, if a driver leaves the keys in a vehicle
ignition, and the vehicle is stolen and used to commit some other crime,
does the driver face criminal penalties or civil liability?
Should a computer vendor or user who neglects to secure their
systems or network face penalties or liability? Should external
entities do wide scans to encourage better security? I think
that a "name and shame" approach aimed at vendors who ship
or install insecure-by-default systems could be effective.
Since it's stateless, all info is encoded in the outgoing packet. If the outgoing packet (or the reply to it) is lost, it will look exactly the same as if the server didn't respond - after all, the scanning tool has no local state, and thus can't track if an address has been pinged/re-ping it. The port map is entirely drawn based on incoming packets.
I don't know how they progress through the IP space, but couldn't they simply solve this by doing it in a deterministic manner? At progress N they should easily be able to tell that A has been scanned. Iterating three times through the IP space all IPs that haven't answered should have gotten the connection attempts.
That might introduce the same overhead that maintaining state does in the first place. It sounds like they're sending out at least a million requests per second.
Yes... They are using the term 'internet' here, and only use 'web' when talking about HTTPS. They are port scanning hosts, at the TCP or UDP level. That seems correct to me?
I'm not sure there is. I'm not sure one can be truly sure he scanned the Internet before impersonating every host. Can't know anything before trying out the inside of every skin.
After all, what would you know, as a traveller, about simple lives of local people?
I've spent one hour of my life in Germany, when I was 11 years old, in a transit lounge in Frankfurt. I have 'visited Germany', but not in any real sense.
There's more to the internet than just port 80, so to declare that a scan encompassing only a single port on each host is a scan of "the entire internet" is somewhat mistaken.
The more correct title would be, "a scan of the entire World Wide Web."
"We experimentally showed that ZMap is capable of scanning the public IPv4 address space on a single port in under 45 minutes, at 97% of the theoretical maximum speed for gigabit Ethernet and with an estimated 98% coverage of publicly available hosts."
I realise that my comment was not so clear, sorry about that. Yes, to me scanning the whole internet means at least the full port range in TCP (and why not UDP too).
My 'rant' is really about the article sensational title promising to let you know about the result of scanning the entire internet really fast... wich turns out to be about scanning web services. The data is however interessting.
http://census2012.sourceforge.net/paper.html
Starting with one device and assuming a scan speed of ten IP addresses per second, it [the scanner] should find the next open device within one hour. The scan rate would be doubled if we deployed a scanner to the newly found device. ... We did this in the least invasive way possible ....
I wonder if/when attaching a widely accessible and easily exploitable device will be considered illegal (attractive nuisance, negligence, public nuisance, contribution to a crime)?
To leap to a car analogy, if a driver leaves the keys in a vehicle ignition, and the vehicle is stolen and used to commit some other crime, does the driver face criminal penalties or civil liability?
Should a computer vendor or user who neglects to secure their systems or network face penalties or liability? Should external entities do wide scans to encourage better security? I think that a "name and shame" approach aimed at vendors who ship or install insecure-by-default systems could be effective.