An internet-wide view of internet-wide scanning

Proceedings of the 23rd USENIX Security Symposium

Volumn , Issue , 2014, Pages 65-78

  Durumeric, Zakir ^a   Bailey, Michael ^a   Halderman, J Alex ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BEHAVIORAL RESEARCH;

DEFENSIVE BEHAVIOR; HORIZONTAL SCAN; LARGE NETWORKS; LINKSYS; NETWORK OPERATOR; OPEN SSL; PORT SCANNING; SHEDDING LIGHT;

SCANNING;

EID: 84916235884     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (47)

1. Backdoor found in Linksys, Netgear routers. https://news.ycombinator.com/item?id=6997159.
2. Hackers spend Christmas break launching large scale NTP-reflection attacks. http://www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks.
3. Open resolver project. http://openresolverproject.org/.
4. Shadowserver open resolver scanning project. https://dnsscan.shadowserver.org/.
5. M. Allman, V. Paxson, and J. Terrell. A brief history of scanning. In Proc. 7th ACM SIGCOMM conference on Internet measurement, pages 77-82, 2007.
6. Anonymous. Internet census 2012. http://census2012.sourceforge.net/paper.html, Mar. 2013.
7. L. Bello. DSA-1571-1 OpenSSL - Predictable random number generator, 2008. Debian Security Advisory. http://www.debian.org/security/2008/dsa-1571.
8. A. J. Bonkoski, R. Bielawski, and J. A. Halderman. Illuminating the security issues surrounding lights-out server management. In Proc. 7th USENIX Workshop on Offensive Technologies. USENIX, 2013.
9. J. W. Bos, J. A. Halderman, N. Heninger, J. Moore, M. Naehrig, and E. Wustrow. Elliptic curve cryptography in practice. In Proc. 18th International Conference on Financial Cryptography and Data Security (FC), 2014.
10. S. Checkoway, M. Fredrikson, R. Niederhagen, M. Green, T. Lange, T. Ristenpart, D. J. Bernstein, J. Maskiewicz, and H. Shacham. On the practical exploitability of dual EC in TLS implementations.
11. R. Chirgwin. Hacker backdoors Linksys, Netgear, Cisco and other routers. http://www.theregister.co.uk/2014/01/06/hacker_backdoors_linksys_netgear_cisco_and_other_routers/.
12. J. Conway. Ecatel's harboring of spambots and malware causes BGP peers to stop peering with them. http://www.sudosecure.com/ecatels-harboring-of-spambots-and-malware-causes-bgp-peers-to-stop-peering-with-them/.
13. E. Cooke, M. Bailey, Z. M. Mao, D. Watson, F. Jahanian, and D. McPherson. Toward understanding distributed blackhole placement. In Proc. ACM workshop on Rapid malcode, pages 54-64, 2004.
14. J. Czyz, K. Lady, S. G. Miller, M. Bailey, M. Kallitsis, and M. Karir. Understanding IPv6 Internet background radiation. In Proc. 13th ACM SIGCOMM Conference on Internet Measurement, 2013.
15. A. Dainotti, A. King, F. Papale, A. Pescape, et al. Analysis of a/0 stealth scan from a botnet. In Proc. 12th ACM SIGCOMM Conference on Internet Measurement.
16. Z. Durumeric, D. Adrian, M. Bailey, and J. A. Halderman. Heart-bleed bug health report. https://zmap.io/heartbleed/.
17. Z. Durumeric and J. A. Halderman. Internet-wide scan data repository. https://scans.io.
18. Z. Durumeric, J. Kasten, M. Bailey, and J. A. Halderman. Analysis of the HTTPS certificate ecosystem. In Proc. 13th ACM SIGCOMM Internet Measurement Conference, Oct. 2013.
19. Z. Durumeric, E. Wustrow, and J. A. Halderman. ZMap: Fast Internet-wide scanning and its security applications. In Proc. 22nd USENIX Security Symposium, Aug. 2013.
20. P. Eckersley and J. Burns. An observatory for the SSLiverse. Talk at Defcon 18 (2010). https://www.eff.org/files/DefconSSLiverse.pdf.
21. S. Gallagher. Backdoor in wireless DSL routers lets attacker reset router, get admin. http://arstechnica.com/security/2014/01/backdoor-in-wireless-dsl-routers-lets-attacker-reset-router-get-admin/.
22. C. Gates. Coordinated scan detection, 2009.
23. R. Graham. MASSCAN: Mass IP port scanner. https://github.com/robertdavidgraham/masscan.
24. J. Green, D. J. Marchette, S. Northcutt, and B. Ralph. Analysis techniques for detecting coordinated attacks and probes. In Workshop on Intrusion Detection and Network Monitoring, pages 1-9, 1999.
25. N. Heninger, Z. Durumeric, E. Wustrow, and J. A. Halderman. Mining your Ps and Qs: Detection of widespread weak keys in network devices. In Proc. 21st USENIX Security Symposium, Aug. 2012.
26. R. Holz, L. Braun, N. Kammenhuber, and G. Carle. The SSL landscape: A thorough analysis of the X.509 PKI using active and passive measurements. In 11th ACM SIGCOMM conference on Internet measurement (IMC), 2011.
27. V. Jacobson, C. Leres, and S. McCanne. libpcap. Lawrence Berkeley National Laboratory, Berkeley, CA. Initial release June 1994.
28. M. Javed and V. Paxson. Detecting stealthy, distributed SSH brute-forcing. In Proc. ACM SIGSAC conference on Computer & communications security, pages 85-96, 2013.
29. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan. Fast portscan detection using sequential hypothesis testing. In Proc. IEEE Symposium on Security and Privacy, pages 211-225, 2004.
30. J. Kasten, E. Wustrow, and J. A. Halderman. CAge: Taming certificate authorities by inferring restricted scopes. In 17th International Conference on Financial Cryptography and Data Security (FC), 2013.
31. C. Leckie and R. Kotagiri. A probabilistic approach to detecting network scans. In Network Operations and Management Symposium (NOMS), pages 359-372, 2002.
32. D. Leonard and D. Loguinov. Demystifying service discovery: Implementing an Internet-wide scanner. In Proc. 10th ACM SIG-COMM conference on Internet measurement (IMC), pages 109-122, 2010.
33. G. F. Lyon. Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure, USA, 2009.
34. J. C. Matherly. SHODAN the computer search engine, Jan 2009. http://shodanhq.com.
35. MaxMind, LLC. GeoIP, 2013. http://www.maxmind.com/en/city.
36. N. Mehta and Codenomicon. The heartbleed bug. http://heartbleed.com/.
37. D. Moore, C. Shannon, G. M. Voelker, and S. Savage. Network telescopes: Technical report. Department of Computer Science and Engineering, University of California, San Diego, 2004.
38. H. Moore. Security flaws in universal plug and play. Unplug. Don't Play, Jan. 2013. http://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf.
39. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of Internet background radiation. In Proc. 4th ACM SIGCOMM Conference on Internet Measurement, pages 27-40, 2004.
40. P. Porras, H. Saidi, and V. Yegneswaran. Conficker C analysis. SRI International, 2009.
41. M. Prince. Technical details behind a 400Gbps NTP amplification DDoS attack. http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack.
42. C. Rossow. Amplification hell: Revisiting network protocols for DDoS abuse. In Proc. Network and Distributed System Security Symposium, Feb. 2014.
43. S. E. Schechter, J. Jung, and A. W. Berger. Fast detection of scanning worm infections. In Recent Advances in Intrusion Detection, pages 59-81. Springer, 2004.
44. E. Vanderbeken. TCP-32764: some codes and notes about the backdoor listening on tcp-32764 in linksys WAG200G. https://github.com/elvanderb/TCP-32764.
45. E. Wustrow, M. Karir, M. Bailey, F. Jahanian, and G. Huston. Internet background radiation revisited. In Proc. 10th ACM SIG-COMM Conference on Internet Measurement, pages 62-74. ACM, 2010.
46. V. Yegneswaran, P. Barford, and D. Plonka. On the design and use of internet sinks for network abuse monitoring. In Recent Advances in Intrusion Detection, pages 146-165. Springer, 2004.
47. J. Zhang, Z. Durumeric, M. Bailey, M. Karir, and M. Liu. On the mismanagement and maliciousness of networks. In Proc. Network and Distributed System Security Symposium (NDSS), Feb. 2014.