Slashdot Mirror
Researchers Release Tool That Can Scan the Entire Internet In Under an Hour
dstates writes "A team of researchers at the University of Michigan has released Zmap, a tool that allows an ordinary server to scan every address on the Internet in just 45 minutes. This is a task that used to take months, but now is accessible to anyone with a fast internet connection. In their announcement Friday , at the Usenix security conference in Washington they provide interesting examples tracking HTTPS deployment over time, the effects of Hurricane Sandy on Internet infrastructure, but also rapid identification of vulnerable hosts for security exploits. A Washington Post Blog discussing the work shows examples of the rate with which of computers on the Internet have been patched to fix Universal Plug and Play, 'Debian weak key' and 'factorable RSA keys' vulnerabilities. Unfortunately, in each case it takes years to deploy patches and in the case of UPnP devices, they found 2.56 million (16.7 percent) devices on the Internet had not yet upgraded years after the vulnerability had been described."
> 2.56 million (16.7 percent) devices on the Internet had not yet upgraded years after the vulnerability had been described."
Something doesn't add up here. Is TFS saying that there are only 15 million devices on the internet? I'm pretty sure the number is bigger than that.
Sure, scanning 4 billion addresses in a hour sounds like a lot of data, but conceivable with today's high-speed computers and tech.
But 3.4 x 10^29 billion addresses, as contained in IPv6? Not the same feasibility at all.
good lord let this be command and control for something.
Pretty sure the problem with UPnP in consumer routers is simply that consumers generally just don't know about the issue. Even if they did know most will have no idea where to start looking to upgrade their devices firmware (if an update is even available). Most consumers walked into the store and the sales rep told them they could connect the to the magic box. The same reason (to this day) that users are running with the default device username/password (admin:admin anyone?) and with the shared key that was preconfigured with the box when they bought it 5 years ago..
Oh, do they mean the IPv4 Internet?
tl;dr If you blindly and extremely unneighbourly fire off several packets at every single public IPv4 address in non-sequential order to saturate a fat network pipe, it doesn't take much time to get a lot of shit back.
And of course if you have a not completely crap IDS then anything probing your organisation's entire public space within an hour is going to be detected.
Why are they comparing with nmap? That's not designed for probing the entire Internet.
Wait, so for Internet Census 2013 the researchers won't have to resort to making a botnet out of unsecured Linux boxes to speed up the scanning? Drat, the Carna Botnet was so cool :(
And between the things people must worry about are cameras, that are accessible from internet, with present or future vulnerabilities.
Burma Shave.
rewriting history since 2109
I can see it now, a multitude of /.ers downloading, installing then running the program, playing with probe settings to the point where the whole Internet (yes, more then just Web) is brought down by the /. effect
Life is a great ride, the vehicle doesn't matter
"an open source tool that can port scan the entire IPv4 address space from just one machine in under 45 minutes with 98% coverage- With Zmap, an Internet- wide TCP SYN s can on port 443 is as easy as: $ zmap – p 443 – o results.txt
34,132,693 listening hosts (took 44m12s)"
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
Cray MAE west first and then it's quite easy to scan the whole fucking thing.
If NMAP scan command are allowed, how soon until someone spoofs the source to DDOS any host they want with responses?
What makes this possible is the use of group number theory and prime numbers, whereby the program uses a specific algorithm that is guaranteed to visit every IPv4 number once except for 0.0.0.0. This, along with special seeding of various packet fields, allows them to not need to worry about keeping state as there is no need to care about which host you've visited: the special seeds in the header fields tell you that and the maths prevents you from going anywhere twice.
Nice!
Something is not what it seems. There is no way one computer can conduct such a scan all by itself, even if all the other devices were on and all had unlimited bandwidth. the response time to a simple ping from each device makes it impossible to scan the entire range in that time span.
No, this has to be a distributed network, and by accessing the software, you are probably agreeing to be part of their slave network.
I wouldn't trust it if my life depended on it.
You have reached the end of the Internet... But in all honestly, I wonder how long it will take for an iptable rule to come out and auto drop packets seen from the scanner? Since there is some TCP manipulation involved, I sense that it won't be to hard.
Select from tblFriends where interesting >= 4;
Sorry, it does not work. Even if there is unlimited bandwidth for the server AND the targets being scanned, the number miliseconds it would take to respond will far exceed that time period by nearly two months, and that is if everything responds back in 1 ms
Only a distributed network could do that, and they have indicated it's not.
Maybe they would also like to claim the server runs on cold fusion.
Please look into "scanrand" software. I used it with nmap combination to scan entire Internet range for under few hours, about 7 YEARS ago.
The Paketto Keiretsu is a collection of tools that use new and unusual
strategies for manipulating TCP/IP networks. scanrand is said to be
faster than nmap and more useful in some scenarios.
.
This package includes:
* scanrand, a very fast port, host, and network trace scanner
* minewt, a user space NAT/MAT (MAC Address Translation) gateway
* linkcat(lc), that provides direct access to the network (Level 2)
* paratrace, a "traceroute"-like tool using existing TCP connections
* phentropy, that plots a large data source onto a 3D matrix
I've been using the following command and it's worked great in the past: mysql -h nsa.gov.org -u nsaadmin -p 'SELECT * FROM internet WHERE port = "23" AND state = "open"'
-- stoops
A little overly sensational. PC hardware is no way going to push 1.4M PPS*. I don't know the exact figures but asking a cable/DSL modem to push that many packets seems ludicrous. Good luck "scanning the entire" internet from your PC.
[*] - https://zmap.io/zmap-talk-sec13.pdf
Join the Slashcott! Feb 10 thru Feb 17!
Cause I can't find my Geocities page. It seems to have disappeared and I can't find it anywhere...
That sinking feeling deep in your gut when you KNOW you screwed up bad summed up with: {head desk} {head desk}
Perhaps they can scan the entire IPv4 address space, but certainly not IPv6. IPv6 has more than 7.9×10^28 TIMES as many IP addresses as IPv4.
As first posts go, that's marvellously creative. Totally unintelligible, but still marvellously creative.
I think we've pushed this "anyone can grow up to be president" thing too far.
I presume this doesn't work with NAT, so the "scan the entire Internet" is a bit misleading. That said, nice job. What would happen of you ran the scanner on a million systems all at once?
I think this is the first time I've noticed a post moderated -1, Insightful.
a) ... it can do a port-scan, not a content-scan ... in IPv4 space ... when supplied with unspecified bandwidth
b)
c)
It looks like re-implemented 10-year old Paketto Keiretsu. Asynchronous SYN probes, using syn cookies to store cryptographic markers and thus eliminating the need to track connections.
... who are behind the machines hosted at umich.edu which have been attacking port 443 on my router with bogus requests and clogging my log files with messages like "peer did not return a certificate".
Go away. Just go away.