I scanned Austria • Hacker News Board

Re: I scanned Austria

#21

Post by mikecb » Sat, Feb 09, 2019, 2:53 PM UTC

piokoch wrote: post #5

I think soon or later we will need some kind of public institution that will do this sort of scans; all those unsecured IoT printers, vacuum cleaners, fridges, abandoned servers, Synology servers, etc. would become a real threat at some point and the costs of dealing with issues caused by them like identity theft, false accusations because on someone's server there is child porn uploaded by a cracker, bot nets will b…

Japan is doing this: https://www.zdnet.com/article/japanese-government-plans-to-h...

In the US, DHS does this for the federal government, as well as some state and private organizations: https://www.us-cert.gov/resources/ncats

Re: I scanned Austria

#22

Post by pletnes » Sat, Feb 09, 2019, 3:14 PM UTC

pgeorgi wrote: post #11

astrea wrote: post #6

Slightly off topic, but I noticed it in the article. You can run "wc" directly, you don't need to pipe from cat. Especially since cat on any sufficiently large file takes quite a while.

It's sometimes easier when you're composing command lines: `cat foo | bar` is easier to transform into `cat foo | baz` (esp. when foo or bar are rather long). Also, piping doesn't mean that cat does all its work and only then will it be passed into wc, cat only acts as a rather tiny buffer.

Just get into the habit of typing < foo bar which is then easier to edit to < foo baz | grep hamspam.

Re: I scanned Austria

#23

Post by icebraining » Sat, Feb 09, 2019, 3:27 PM UTC

pmontra wrote: post #19

butz wrote: post #16

What's the best way to inform owner of unsecured device about vulnerabilities and simple ways to fix them? On printers one could just print out a message, but what about webcams or home automation systems?

I wouldn't do anything myself, too risky. Printing on somebody's else printer could get me sued. What about a state level authority doing this scans, contacting owners, maybe even fining them? That would be like authorities for food safety, etc. It would put pressure on manufacturers because people don't want to buy things that get their owners fined.

What's the reasoning for fining someone for leaving stuff available? Should self-hosting a site be made illegal? If not, how do you distinguish the two?

Re: I scanned Austria

#24

Post by Spooky23 » Sat, Feb 09, 2019, 3:37 PM UTC

I see this as progress. I would imagine that an exercise like this done a decade ago would be much worse.

Re: I scanned Austria

#25

Post by Semaphor » Sat, Feb 09, 2019, 3:55 PM UTC

dev_dull wrote: post #18

simonsaidit wrote: post #10

I scanned public writable ftps for months back between 97-99 to distribute warez. I Think it was those gov ranges that cost me the relationship with a few ISPs.

Tell us more (I love to hear things about the wares days).

Not OP but I did some stuff as a kid.

On the script kiddie level, you had different options. The easiest was simply scanning for public FTPs and IIS IPs and posting those in the member section of whatever forum you were a member of (or in public to get that access). The next level was using checking them for vulnerabilities (or in the case of FTPs checking if you had anonymous write access), those lists obviously were worth more. The higher level people would have their high-end servers (usually hacked, fast internet was expensive) and would use server to server transfer to go from their high-value FTP to some lower value ftp or IIS server for normal people to download from.

Re: I scanned Austria

#26

Post by simonsaidit » Sat, Feb 09, 2019, 4:06 PM UTC

dev_dull wrote: post #18

simonsaidit wrote: post #10

I scanned public writable ftps for months back between 97-99 to distribute warez. I Think it was those gov ranges that cost me the relationship with a few ISPs.

Tell us more (I love to hear things about the wares days).

This was for fxp sites. I was a mod on a fxp board. We would make locked directories eg with deep paths and Lots of Whitespace that ftp clients couldent handle easy and Hence not Enter without knowing the tricks. Also using reserved Windows names like aux would prevent owner to delete or even crash his server trying anything. Later came tricks like undeletable files as different sites would fight over the same ftps. I did however find a way to make the undeletable files 0 bytes to reclaim space. Later we just started to hack servers and install our own protecteed ftp server but by that time i has moved into the Real scene and running multi TB top rated sites in unis in US, netherlands and Korea with affiliation to top traders and release groups. Thats how my programming interrest started being the guy who set up glftpd servers and bots for IRC. After a few big FBI operations in 99 and 2001 i had enough excitement and left the scene.

Re: I scanned Austria

#27

Post by MrMorden » Sat, Feb 09, 2019, 4:10 PM UTC

butz wrote: post #16

What's the best way to inform owner of unsecured device about vulnerabilities and simple ways to fix them? On printers one could just print out a message, but what about webcams or home automation systems?

The 100% legal route would be to whois the IP address and send the contact an email; presumably they can identify a user and pass it on.

Re: I scanned Austria

#28

Post by groby_b » Sat, Feb 09, 2019, 4:42 PM UTC

lazyjones wrote: post #12

piokoch wrote: post #5

I think soon or later we will need some kind of public institution that will do this sort of scans; all those unsecured IoT printers, vacuum cleaners, fridges, abandoned servers, Synology servers, etc. would become a real threat at some point and the costs of dealing with issues caused by them like identity theft, false accusations because on someone's server there is child porn uploaded by a cracker, bot nets will b…

We don't need public institutions. It's the responsibility of ISPs to prevent security problems, spam zombie servers/appliances etc. in their networks, so they should perform these scans and warn first, then disconnect customers with problematic devices.

But the ISPs are not held responsible. They can externalize costs to society, and so they do so - because that is what capitalism mandates. Without an institution that puts those costs back where they belong, nothing will change, because it is cheaper not to change.

I'd recommend reading up on the Cuyahoga River, the Clean Water Act, and the formation of the EPA - it's pretty much the same problem. Industry creating problems by abdicating its responsibility, necessitating a legal solution. And enforcing that requires a public institution.

Re: I scanned Austria

#29

Post by simonsaidit » Sat, Feb 09, 2019, 4:46 PM UTC

simonsaidit wrote: post #26

dev_dull wrote: post #18

Earlier quoted context omitted.

Tell us more (I love to hear things about the wares days).

This was for fxp sites. I was a mod on a fxp board. We would make locked directories eg with deep paths and Lots of Whitespace that ftp clients couldent handle easy and Hence not Enter without knowing the tricks. Also using reserved Windows names like aux would prevent owner to delete or even crash his server trying anything. Later came tricks like undeletable files as different sites would fight over the same ftps.…

Here is a pretty good explaination of how it worked. https://www.reddit.com/r/CrackWatch/comments/92uz49/the_ware... I have No idea how it is today but back then it was pretty organised. We would have people funding eg a university apartment and servers and paying for eg 10x100mbit we would Bond or Having direct access to oc connections just so they could get leech.

Re: I scanned Austria

#30

Post by shadowashe » Sat, Feb 09, 2019, 5:05 PM UTC

you can also checkout app.binaryedge.io for more data like this from other countries! it's crazy the amount of stuff that is out there. to me the most baffling is still the amount of DBs with customer information on 'em