Slashdot Mirror
Researchers Release Tool That Can Scan the Entire Internet In Under an Hour
dstates writes "A team of researchers at the University of Michigan has released Zmap, a tool that allows an ordinary server to scan every address on the Internet in just 45 minutes. This is a task that used to take months, but now is accessible to anyone with a fast internet connection. In their announcement Friday , at the Usenix security conference in Washington they provide interesting examples tracking HTTPS deployment over time, the effects of Hurricane Sandy on Internet infrastructure, but also rapid identification of vulnerable hosts for security exploits. A Washington Post Blog discussing the work shows examples of the rate with which of computers on the Internet have been patched to fix Universal Plug and Play, 'Debian weak key' and 'factorable RSA keys' vulnerabilities. Unfortunately, in each case it takes years to deploy patches and in the case of UPnP devices, they found 2.56 million (16.7 percent) devices on the Internet had not yet upgraded years after the vulnerability had been described."
> 2.56 million (16.7 percent) devices on the Internet had not yet upgraded years after the vulnerability had been described."
Something doesn't add up here. Is TFS saying that there are only 15 million devices on the internet? I'm pretty sure the number is bigger than that.
Sure, scanning 4 billion addresses in a hour sounds like a lot of data, but conceivable with today's high-speed computers and tech.
But 3.4 x 10^29 billion addresses, as contained in IPv6? Not the same feasibility at all.
good lord let this be command and control for something.
Pretty sure the problem with UPnP in consumer routers is simply that consumers generally just don't know about the issue. Even if they did know most will have no idea where to start looking to upgrade their devices firmware (if an update is even available). Most consumers walked into the store and the sales rep told them they could connect the to the magic box. The same reason (to this day) that users are running with the default device username/password (admin:admin anyone?) and with the shared key that was preconfigured with the box when they bought it 5 years ago..
Oh, do they mean the IPv4 Internet?
tl;dr If you blindly and extremely unneighbourly fire off several packets at every single public IPv4 address in non-sequential order to saturate a fat network pipe, it doesn't take much time to get a lot of shit back.
And of course if you have a not completely crap IDS then anything probing your organisation's entire public space within an hour is going to be detected.
Why are they comparing with nmap? That's not designed for probing the entire Internet.
Burma Shave.
rewriting history since 2109
I can see it now, a multitude of /.ers downloading, installing then running the program, playing with probe settings to the point where the whole Internet (yes, more then just Web) is brought down by the /. effect
Life is a great ride, the vehicle doesn't matter
"an open source tool that can port scan the entire IPv4 address space from just one machine in under 45 minutes with 98% coverage- With Zmap, an Internet- wide TCP SYN s can on port 443 is as easy as: $ zmap – p 443 – o results.txt
34,132,693 listening hosts (took 44m12s)"
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
You have reached the end of the Internet... But in all honestly, I wonder how long it will take for an iptable rule to come out and auto drop packets seen from the scanner? Since there is some TCP manipulation involved, I sense that it won't be to hard.
Select from tblFriends where interesting >= 4;
Can I trust if if my life doesn't depend on it?
Because it doesn't.
There are two types of people in the world: Those who crave closure
Please look into "scanrand" software. I used it with nmap combination to scan entire Internet range for under few hours, about 7 YEARS ago.
The Paketto Keiretsu is a collection of tools that use new and unusual
strategies for manipulating TCP/IP networks. scanrand is said to be
faster than nmap and more useful in some scenarios.
.
This package includes:
* scanrand, a very fast port, host, and network trace scanner
* minewt, a user space NAT/MAT (MAC Address Translation) gateway
* linkcat(lc), that provides direct access to the network (Level 2)
* paratrace, a "traceroute"-like tool using existing TCP connections
* phentropy, that plots a large data source onto a 3D matrix
People who say it can't be done should not interrupt those who are doing it.
Why would you limit yourself to ssh, when there's so many useful unpatched exploits for so many other server applications? Among other things, you're missing out on all the easily exploitable Windows ME boxen out there.
I am officially gone from
Something is not what it seems. There is no way one computer can conduct such a scan all by itself, even if all the other devices were on and all had unlimited bandwidth. the response time to a simple ping from each device makes it impossible to scan the entire range in that time span.
No, this has to be a distributed network, and by accessing the software, you are probably agreeing to be part of their slave network.
I wouldn't trust it if my life depended on it.
"Slave network". :D Anyway, it works because you can scan multiple hosts in parallel. You don't have to wait for each one of them to respond (and many of them won't anyway). A simple ping is a small packet and you can fire out them quite fast with a gigabit pipe.
You're assuming they wait for one host to respond before starting to probe the next host. That is not a reasonable assumption.
A little overly sensational. PC hardware is no way going to push 1.4M PPS*. I don't know the exact figures but asking a cable/DSL modem to push that many packets seems ludicrous. Good luck "scanning the entire" internet from your PC.
[*] - https://zmap.io/zmap-talk-sec13.pdf
Join the Slashcott! Feb 10 thru Feb 17!
Why would you limit yourself to ssh, when there's so many useful unpatched exploits for so many other server applications? Among other things, you're missing out on all the easily exploitable Windows ME boxen out there.
ssh defaults to port 22. Port 23 is usually telnet.
alias sudo="echo make it yourself #" ; # https://pipedot.org/~stderr & http://soylentnews.org/~stderr
Cause I can't find my Geocities page. It seems to have disappeared and I can't find it anywhere...
That sinking feeling deep in your gut when you KNOW you screwed up bad summed up with: {head desk} {head desk}
You clearly have no idea what you're talking about.
During grad school, I worked on analyzing the data that my research group had collected during what was at the time the largest web crawl in academia (around 4.6B pages; and mind you, this was an actual crawl, rather than a simple scan, so we were pulling down entire pages) that was gathered over the course of about 40 days, and that was all done from a single server (if memory serves, it was a 2.7GHz Xeon with 16GB RAM, so not all that impressive by today's standards). You're assuming synchronous communication with blocking requests. Instead, most tools like this rely on a massively multithreaded architecture with thousands of asynchronous lines of communication open at any given time, none of which are blocking each other most of the time. You don't need a distributed network to do that.
You're right to assume that most requests don't come back in 1ms. In fact, some webmasters had configured their servers in...interesting... ways. Despite abiding by robots.txt and using techniques to avoid slamming servers with requests, we still got angry e-mails from webmasters who saw our user agent in their logs (sometimes even after just a single page load!), and there were even some webmasters that reconfigured their servers to take hours or days to respond once they identified our user agent as a bot, even though we made it clear who we were, what our purpose was, where more information could be found, and how they could simply block us using robots.txt or simply ask us to put them on our blacklist so that we stopped crawling them.
And yet, despite all of those issues (and many more), we still managed to crawl quite a bit just fine. Our biggest bottleneck was bandwidth, honestly, but if you're just scanning rather than crawling, that issue is significantly diminished, since you're grabbing very little.
Perhaps they can scan the entire IPv4 address space, but certainly not IPv6. IPv6 has more than 7.9×10^28 TIMES as many IP addresses as IPv4.
As first posts go, that's marvellously creative. Totally unintelligible, but still marvellously creative.
I think we've pushed this "anyone can grow up to be president" thing too far.
I presume this doesn't work with NAT, so the "scan the entire Internet" is a bit misleading. That said, nice job. What would happen of you ran the scanner on a million systems all at once?
I think this is the first time I've noticed a post moderated -1, Insightful.
a) ... it can do a port-scan, not a content-scan ... in IPv4 space ... when supplied with unspecified bandwidth
b)
c)
... who are behind the machines hosted at umich.edu which have been attacking port 443 on my router with bogus requests and clogging my log files with messages like "peer did not return a certificate".
Go away. Just go away.