Re: [dispatch] Proposal for scantxt; scanning opt-in/out, identification, verification, notification, and reporting

Based on my past experience of scanning, generally the folks in an org who legitimately ask for a scan aren’t the people who administer a given system.
The day-to-day maintainers of the target system probably won’t be warned (and shouldn’t be) of a red-team exercise.
Likewise the ‘results’ will go to the infosec department, rather than the local firewall folks.

You certainly don’t want them to be able to say ’this is off limits’ because a) it would defeat the purpose of a pentest b) it would act as a red-rag-to a bull 
for all hackers of any persuasions.

I’m really struggling to see who might realistically benefit from this.

T.

> On 4 Dec 2022, at 19:37, John R Levine <johnl@taugh.com> wrote:
> 
>> Perhaps generic probing is mostly malicious but if you include services that people and businesses often use or sign up for, it likely isn't all that malicious. Consider the following as scanners (not recommendations, just examples): MXToolBox, Detectify, Hardenize, Snyk
> 
> I take your point about scanning by request, but that makes the problem a whole lot simpler.
> 
> It's not hard to see how you could come up with standard ways for scanners to say here's the kinds of scanning they do and here's the IPs they scan from, and for the victims to say here's the IP ranges you can scan and the ports you can probe, and replies from the scanners saying here's what we found.  Since the parties already know wach other you can wrap it in OAUTH or the like to authenticate it.
> 
> Beyond that, I still don't see the point.  It's hard to think of anything other than http that lets you bundle an authentication token with a probe and even there, one of the major points of scanning is to find ports and servers that are open by mistake so they wouldn't be looking for the token.  To identify the scanners, do the scans from dedicated IPs.
> 
> It's hard to imagine a use for a public "go ahead and scan this range" (as distinct from sending a message to a known party) other than as a honeypot or security challenge.  The bad guys will scan anyway, and challenges have a poor reputation in the security world.
> 
> Regards,
> John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY
> Please consider the environment before reading this e-mail. https://jl.ly
> 
> _______________________________________________
> dispatch mailing list
> dispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/dispatch