Slashdot Mirror
Leaked Documents: GCHQ Made Port-Scanning Entire Countries a Standard Spy Tool
Advocatus Diaboli writes with this excerpt from Heise: Since the early days of TCP, port scanning has been used by computer saboteurs to locate vulnerable systems. In a new set of top secret documents seen by Heise, it is revealed that in 2009, the British spy agency GCHQ made port scans a "standard tool" to be applied against entire nations. Twenty-seven countries are listed as targets of the HACIENDA program in the presentation, which comes with a promotional offer: readers desiring to do reconnaissance against another country need simply send an e-mail.
Also from the article:
The list of targeted services includes ubiquitous public services such as HTTP and FTP, as well as common administrative protocols such as SSH (Secure SHell protocol – used for remote access to systems) and SNMP (Simple Network Management Protocol – used for network administration) (Figure 4). Given that in the meantime, port scanning tools like Zmap have been developed which allow anyone to do comprehensive scans, it is not the technology used that is shocking, but rather the gargantuan scale and pervasiveness of the operation.
I use nmap to find what address my Boxee has. It is faster then check the dhcpd logs.
SSH (Secure SHell protocol – used for remote access to systems) and SNMP (Simple Network Management Protocol – used for network administration)
I'm glad that was made clear, us nerds know very little about IT in reality.
So basically this is an article about the intelligence agencies using the same tricks criminals and security specialists in the industry have been using for years?
Let me show you my shocked face ... :|
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
what a waste of tax payers money.. everybody knows you can use Shodan to do it for "free"
Gotta love how the folks who get their panties in a wad when big out-of-control government does this kind of thing are the same ones who want to make that government even BIGGER by putting it in charge of health care.
Hey, guess what: A government that abuses you with X amount of power and resources will abuse you even MORE when it gets 3X power and resources.
Spy agencies need to care only about two things. Following the laws of their countries and not getting caught.
It's not so much of them "spying" it's more so "were they doing it legally." And if not, who inside the organization and government is going to pay for the travesty. It seems to me that in the UK, the government wishes to throw the social contract not only in the dirt, but shit on it, burn both, and then piss on the ashes.
Om, nomnomnom...
I though it was common knowledge.
We are surprised because these are our governments spending our tax payer dollars to find exploits in computers in foreign countries that have done us no wrong. While you may have no scruples about this sort of thing, most of the rest of us are offended when something is done in our names that we would never stand having done to us.
Let me show you my shocked face ... :|
I raise you my face ... (^_~(__*__)
You are raising one eyebrow and winking while burying our face in boobies?
It seems like the press has run out of new interesting things to report with regards to spy agencies, so rather than do some informed discussion on the stories or something, they are digging for shit.
Yes, we know, spy agencies spy. That is their purpose, that is the reason they get funding. If this shocks you then you've had your head in the sand. Now if you think governments shouldn't have spy agencies, ok, but that is a different argument (and you might want to look in to why they do). But acting all surprised that they spy, and use known tricks to spy, is stupid.
It also takes away from the real issue, the story that needs to be discussed: That spy agencies were illegally spying on their own populace. THAT is the story that should be getting coverage. However it seems like the press did their thing on it, and now wants to move on to "something new" no matter how irrelevant it is.
If the GCHQ is spying on other countries, Brits shouldn't be concerned. That is why they have a GCHQ. If the GCHQ is spying on their own subjects, they should be concerned, since that is illegal.
Tomorrow on Slashdot:
Folks at Spy Agencies Caught Doing Their Jobs AGAIN!
These leaks are all meaningless, wikileaks, blackvault..etc. all the same obfuscated, redacted crap that tell u f-all..
It's a freaking port scan. It is not a denial of service attack. It is not remotely illegal and any private citizen is legally allowed to exactly the same and many researchers do without any need for special permissions.
This article could not possibly be any more pathetically sensationalist.
There are faster ways to scan large address blocks - at least for TCP. We used a customized form of stateless scanning based on scanrand almost 10 years ago that could do the "usual suspects" across an entire 10/8 block off a single Linux machine in the space of about 8 hours. This was in a corporate environment much of the space was >=1G but also covered lower speed international routes. The 8 hrs was a balance between performance and network impact so could have been reduced.
Should we not now be at a state of war with the nations? They have entered our sovereign space, friend or not they have broken a trust between country's.
Let the bombing begin.
-
Wasted time and money, but hardly shocking or evil.
Every IP address exposed on the Internet is constantly scanned.
Bulk port scanning is something I'd expect criminals to do looking for vulnerable systems to exploit. Its not going to tell you anything about the use of that system or the motives of its owners unless you install some sort of exploit. The only thing this will reveal is the possible presence of certain peer-to-peer apps that use well known ports.
I'd expect the intelligence agencies to develop a list of likely terrorists and then concentrate on breaking into their systems. This looks like GCHQ has given up on al Qaida and is chasing file sharers full time. Public funds expended to protect the Disney companies property. When can I expect the local police department to pay two officers to guard my old pickup truck parked in my driveway every night?
Have gnu, will travel.
'..it is revealed that in 2009, the British spy agency GCHQ made port scans a "standard tool" to be applied against entire nations. '
2009? then we were a bit late at getting into the game there then.
In the late '90s/early 2000 it wasn't uncommon for me to spot countrywide port scans originating from a handful of IP numbers at a certain chinese technical institute (At the time, I was looking after machines for various organisations in widely different geographical locations here in Britain).
I'm sure If I dug through all of the old backup tapes/cds from that time I've still got I could probably find records of similar port scans originating from 'unassigned' IP numbers lurking in US Gov/Military netblocks I'd logged, they used to happen occasionally back then too.
Portscans? I always regarded them as the networking equivalent of this
nmap as a "hacking" tool reveals such an old mindset. Back then the prize was finding a service, which was inevitably not locked down or was easily compromisable. Nowadays even basic installs are secure thanks to sane package managers and distributions. The old "find an old version of sendmail and open a shell" tricks don't work.
I want to delete my account but Slashdot doesn't allow it.
i don't see what the social contract has to do with anything here. if UK is port scanning other nations then fine whatever. but if UK were portscanning the UK to identify vulnerabilities then that would be sucky and make me feel icky inside.
Port Sentry is your friend :)
A. The Sentry tools provide host-level security services for the UNIX platform. PortSentry, Logcheck/LogSentry, and HostSentry protect against portscans, automate log file auditing, and detect suspicious login activity on a continuous basis.
It can also automatically respond to scans by blocking the originating hosts.
I have been using it continuously since the 1990's
http://sentrytools.sourceforge...
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
Unless they were contacting the owners of the UK computing infrastructure and advising them how to protect that infrastructure from foreign agencies and hackers. Then it might be good.
Security researchers are required to get written consent before port scanning for an audit.
So you can see why this sounds like a massive endeavor following no ethical rules.
Whether it's as bad as it sounds... meh... but really, it is quite contrary to all one would hold ethical.
It is not remotely illegal and any private citizen is legally allowed to exactly the same and many researchers do without any need for special permissions.
That's a bit like saying it is OK to break into peoples' houses because it is legal to enter into someones house when they give you permission, and they are essentially the same thing, right?
Your logic is beyond broken. It is incredibly illegal to commit any type of computer fraud, including brute force attacks (which includes port scanning), unless you have explicit permission before doing so.
I would estimate that in the last decade, any host visible on the Internet has gotten between 10 and 100 full port-scans per year, and most not from these people but other criminals.
So let me say this clearly: If a port-scan is a risk for your server, you should
a) Fix the damned thing already!
b) If you cannot, stop administrating systems when you have no clue how to do it!
Hell, in many countries port-scans are even perfectly legal.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Your EXPECT of your government to do it to foreigners, well guess what 'us' foreigners expect our government to do the same to you.
No. No it isn't, and literally every single thing you wrote is either factually wrong, or completely unrelated to what I was saying.