So what would be a legitimate use of this tool? I mean, concerning the "scan the whole internet" part.
In addition massscan is really interesting from a software engineering persepective. They do kernel bypass to talk to network drivers directly, have a custom TCP stack, custom mutexes, etc. All of that to be able to reach ~1.5M packets per second (from the README), allowing someone to scan the whole IPv4 range in 6 minutes. Really impressive work.
If they didn't want to accept any connections, they should've closed the port.
If they only wanted authorised users to connect, they should put an authorisation requirement on the connection.
As for your statement that there's no valid research purpose, that's your assertion, a lot of people will disagree.
Is it valid to research untreated syphilis in black men? Yes. Is it valid to research untreated syphilis in black men without their permission and informed consent? No.
We're not discussing the morals of human research, we're discussing IT security, and specifically in scenarios that are unlikely in the extreme to lead to any physical harm to people.
We're also not talking about trying to sabotage or attack a system.
Standard, well-formed web requests on standard HTTP sockets, made infrequently are very unlikely to cause problems on any system that's not outright deliberately misconfigured.
The Tuskegee Syphilis Study was inappropriate because they purposely withheld information about the diagnosis and lied about the efficacy of the treatments they were giving.
The problem wasn't that they conducted the research without telling the patients. Obviously the patients were aware that they were part of a research effort, since they directly interacted with the clinicians conducting it.
How do you know? Lots of people misconfigure their systems and leave them open to access unintentionally.
Huge numbers of people have done this, I've certainly done it in the past when I knew less. Discovering that the webserver logfiles were rather larger than I expected, or that HTTP Traffic was through the roof... oh, right, I left something open, better close that and remember it for next time.
However I don't think it's a reasonable assumption that the open status of TCP ports is supposed to be private information.
Also what is the hypothesis that is being researched or investigated by knowing how many systems on the internet respond to TCP SYNs on port 23?
If it's valid to shine a laser pulse from space/the sky onto the entire surface of the Earth (private property included) to determine the elevation of everything, it's valid to send TCP SYNs out to the entire surface of the internet.
Alternately, you could ask me "If a computer is broadcasting packets to my computer which is connected to a network port that I'm allowed to connect to, is it ok for me to note that?" In which case I'd say yes.
I also think that moves the analogy too far in the other direction. While it may not be the case that servers are actively "broadcasting" their port open status to all internet users, that's only because it would not be feasible to do so. It is not because port open status is supposed to be private or secret information, like the inside of my bedroom for example.
In fact TCP/IP is designed with the intention that anyone can check the port open status without authentication. It is part of the intended usage of the protocol, so presumably it is safe to assume that anyone using it is probably using it with that intention.
Scanning for open ports sounds like a legitimate use, but being a Network admin and not capable to block a robot called "masscan/1.0" is NOT legitimate.
It's more like looking through other people's windows as you walk by the street. May be creepy if you always stare at the same window, but formally there's nothing wrong with that. If you do not want people to see through your public-facing windows in your home, it's your responsibility to install blinds or shades.
Dude, what kind of town do you live in? It sounds scary!
Here in Europe many towns have narrow streets with houses directly by the street (with no front yard). It is essentially impossible to not look through the windows of people unless you make a robotic effort to avoid it.
I do that..even in a big city. It's cool when you do it to yourself, but makes much more fun with a another person, you should try it out someday.
You can ask Ebay about that.
If you don't want people to look at you, don't go out in public.
If you don't see a difference then I hope we don't share neighborhood.
> It’s behavior only two types of people would have: criminals and security professionals.
consider also curious people seeking knowledge; the Internet is a massive space and an interesting phenomenon in itself, scanning is one of many ways to learn about it.
Your House is not a Server, compare it to a Butler, i yell into your house and if a Butler answers i ask him whats on the table.
Yeah rlly hard ;)
Everyone knows flashlights are used by bank robbers. But if you can think of a legitimate use of a flashlight, then you can think of a legitimate use for this tool.
I am wondering the same thing myself; it's not obvious to those of us not looking for vulnerabilities in other people's systems what the use of it is at internet scale.
Flashlights are used by normal people for strictly local, very closely defined location illumination. We don't turn them on and light up the whole world.
I encountered a bunch, always trying the same, lame URLs for a PHP framework bug or a Wordpress config error, sometimes a hundred variations in a few seconds. What's the point? Same goes for all these ssh connections, but they seem to be real hacking attemps.
There are basically two types of people who do that. The security guards and... cat burglars.
You could also scan your own internal 10 net in a finite amount of time.
1/255th of the internet is for all practical purposes, the internet.