Bugtraq mailing list archives
Internet Auditing Project
From: aleph1 () SECURITYFOCUS COM (Elias Levy)
Date: Fri, 13 Aug 1999 09:11:53 -0700
I believe this will be of interest to everyone. Recently Security Focus received an essay for the Guest Feature forum that discussing a project by a group of people that performed a security scan of most of the Internet. To my knowledge this is a first (at least publicly). They scanned over 36 million hosts. The results a very interesting. They have also made the source code of their scanner, BASS, available for download. Here is their announcement: PRESS RELEASE - The Internet Auditing Project Aug 13 - SSR, an independent security research group, have recently released a memorandum of the Internet Auditing Project, describing the groups efforts to scan over 36 million (circa Jan 1999) Internet hosts (including it's sensitive military, government and private networks) for commonly known remote security vulnerabilities. The article is written in full-disclosure HOWTO form, supplying the reader with everything he needs to know to repeat the scan on his own (wheels, map and the road), with relatively few resources, including the special-purpose bulk auditing software developed for the project. It offers several unique, interesting insights on the gloomy state of computer security on the Internet, touches on hacker culture, and in-between describes the group's encounter with counterprobes, angry e-mails, threatening lawyers (with relevant legal commentary), a crippling denial of service attack and even an Unidentified Cracking Object (OCO!) which successfully attacked and penetrated [part of] the group's networks with spine-chilling sophistication. The IAP's results? Grim: "... immediately threaten the security [...] of many millions of systems in commercial, academic, government and military organizations ..." And even... "We were stunned to find just how many networks you would expect to be ultra secure were wide open to attack. Banks, billion dollar commerce sites, computer security companies, even nuclear weapon research centers!" It's implications? Grimmer, suggesting an immediate present and future threat to the world's largest and most significant information technology infrastructure. (Holy smoke! So what do we do?!) The article introduces a viable solution, in the form of the "International Digital Defense Network" (IDDN). An ambitious proposal for a public interest project which could dramaticly influence the security of the Internet (for the good!), and resolve many of the most serious problems covered in the article. The article is available as a guest feature (the first) on www.securityfocus.com (the good people hosting Bugtraq) at: http://www.securityfocus.com/templates/forum_message.html?forum=2&head=32&id=32 BASS, the Bulk Auditing Security Scanner developed for the project has also been released and is free for download at http://www.securityfocus.com/data/tools/network/bass-1.0.7.tar.gz Seek the wisdom.
Current thread:
- Internet Auditing Project Elias Levy (Aug 13)
- Re: Internet Auditing Project Jerry Carlin (Aug 13)
- Re: Internet Auditing Project CyberPsychotic (Aug 16)
- Re: Internet Auditing Project Viljo Hakala (Aug 17)
- Stupid bug in W3-msql gregory duchemin (Aug 17)
- Re: Stupid bug in W3-msql David J. Hughes (Aug 19)
- Httpd Logging Methods v0rt (Aug 23)
- <Possible follow-ups>
- Re: Internet Auditing Project David Luyer (Aug 15)
- Re: Internet Auditing Project Peter J. Holzer (Aug 17)
- [RHSA-1999:028-01] Buffer overflow in libtermcap tgetent() Bill Nottingham (Aug 17)
- Re: [RHSA-1999:028-01] Buffer overflow in libtermcap tgetent() Michal Zalewski (Jul 03)
(Thread continues...)
- Re: Internet Auditing Project Jerry Carlin (Aug 13)