Internet Scanning - Current State and Lessons Learned
summary
Project Sonar runs continuous IPv4-wide scans with ZMap-derived probes and publishes raw datasets plus databases, a search engine and a trending DB; weekly HTTPS scans find about 40 million open 443 ports and ~25 million SSL certificates (55 GB in under 4 hours), biweekly HTTP grabs ~220–240 GB covering ~60–65 million web servers, and reverse DNS produces ~1.1 billion records. UDP probes (UPnP, IPMI, NTP monlist) reveal >1M exposed NAT-PMP devices and 10k–40k Internet-facing MS‑SQL instances with known CVEs; elasticsearch instances and many telnet/serial consoles expose remote code execution or open shells.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:53Outline
- 3:20Internet-wide scanning
- 6:59Research / Finding history
- 10:28SNMP - list processes, get credentials
- 11:50Telnet: Linux Shells
- 12:51Serial Port Servers
- 13:46Example Remote Serial Ports
- 14:37ElasticSearch, code execution is a feature
- 16:48Sonar - Data overview
- 18:32Sonar - Data sizes and record counts
- 19:47Recent findings - NAT-PMP
- 22:45Recent findings - DNS
- 24:58Example Use-Case Asset Discovery
related talks
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
58mWhere did you find that?
54mWhere did you find that?
19mThe Blind Spots of IT Experts on Security & What Companies Must Do Against It
24mImproving Internet-Wide Scanning with Dynamic Scanning
01h 00mSecurity Theatre
51mHelpful Hackers