Re: [dispatch] Proposal for scantxt; scanning opt-in/out, identification, verification, notification, and reporting

[Ollie IETF <[e-mail]>]

> It's not hard to see how you could come up with standard ways for scanners
> to say here's the kinds of scanning they do and here's the IPs they scan
> from, and for the victims to say here's the IP ranges you can scan and the
> ports you can probe, and replies from the scanners saying here's what we
> found.

That is my objective - to come up with those standard ways?

I consider allowing/identifying via IP to be quite dated, prone to spoofing and network attacks (BGP hijacking) and requires effort to maintain and make people aware of the source IPs (and I'd argue IPv6 adoption makes it harder).
Adding a token of some sort makes the source IP agnostic (think environments where source IP may not be known, multi-cloud FaaS/SaaS) and reduces the spoofing potential, this is especially important in the instances where it is used to bypass firewall/WAFs.
Also, IPs may be transient, so if someone reviews logs days/months later, the IP may not 'belong' to the scanner anymore and so the token could be retrospectively verified (as long as the scanners public key is still available - perhaps there could be guidance around scanners keeping these in their JWK etc. for a minimum time period).

That said, I do suggest a standard way to indirectly identify via IP:
Source IP -> PTR "_scanner.*" (where this also has the "scanner" TXT record) -> A/AAAA of Source IP
So a victim/scanee could do a PTR lookup on the source IP and check for reverse DNS alignment and the TXT record and then allow if the domain equals a known/allowed list - this mechanism would allow a scanner to change IPs.

> Since the parties already know wach other you can wrap it in OAUTH
> or the like to authenticate it.

Part of the proposal is to have a primarily asynchronous approach where the parties don't necessarily know, or need to know, each other.

> The bad guys will scan anyway, and challenges have
> a poor reputation in the security world.

Yup, but this isn't for the bad ones, it's for people looking to do responsible, transparent scanning.

Ollie