UK Government scans all web servers hosted in the UK for vulnerabilities

You can poke around at https://viz.greynoise.io/ to see who is doing what.

Personally I was very grateful.

Im going to say this isn’t technologically useful.

REASONS:

1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities.

2. Most attacks lead with phishing and account takeovers not software vulns.

Most people assume that if you scan all the things it fixes the problem or even empowers people to fix problems but it doesn’t.

If governments want to do something truly progressive then here’s a better option.

1. Use MFA preferably hardware tokens everywhere.

2. Catalog all externally exposed assets

3. Catalog all high-risk internal assets

4. Regularly white box pentest your assets (switch vendors annually) and implement a bug bounty program as well

5. Penalize any organization that doesn’t remediate their critical pentest and bug bounty findings

The intention is good, but in practice I think it's mostly useless because:

* The reports go to the AS operator, who in most cases are not the actual admins of the vulnerable software. Some hosting providers such as Hetzner and Manitu have scripts in place to forward reports to the respective customers, but most don't since it involves a lot of parsing of the email (which is not in an easily machine readable format).

* The emails often warn about security issues that may not actually be problematic (i.e. merely warning about some open port that may be intentionally open, and especially if you operate, say, a honeypot), with no way to opt out for specific hosts/ports. So you can only really filter them entirely in your mail client which I think most people do.

On the other hand, a custom built tool that tries to find the most serious known vulnerabilities with a low false positive rate would probably be a good thing for the government to run.

I'm reading that the UK government is spying on us, and their retrospective plausible excuse is that they are scanning web servers for, erm, vulnerabilities.

No, I don't think that the government is here to help. It allows itself only to maintain force, that it then uses to forcibly extract wealth from its herd, er, sorry citizens.

Maybe they put it like this to exempt themselves...

(NOTE: I have no idea if this specific link is related to Alex or anything he's done)

But the gov.uk website is pretty good and they did replace IT with computing in schools.

i.e., add a .* to the end so that it matches anything coming after .git

It's interesting because there are two main methods for what to do when you find a vulnerability: 1) hold onto it so you can later use it as a weapon or 2) disclose it and patch it. The offensive method has problems because as soon as you use it you are disclosing it. It also has the issue that your enemies may be able to (are likely to) find the same vulnerability and exploit it first. But the second method means you're losing your weapons but instead gaining a shield.

As I see it, the shield is a lot bigger and has far higher utility. But part of that is that I see democracies as having differing vulnerabilities than autocracies. Attacking autocracies is more spear phishing, very directed attacks on the specific people that control power. But attacking democracies is in some sense easier (and in another sense harder) because more power is held by the average person. People who are more vulnerable to manipulation, especially at the large scale. But now we're edging into the data privacy domain and that's probably out of scope here.

I really think there should be a very strong blue team effort by these organizations. I am okay holding on to a specific vulnerability if you're going to attack a specific person in the ,,immediate'' future, but these agencies should also be working with companies to patch these vulnerabilities. That is the government providing a social good. You know, the reason we have the social contract and government in the first place.

When you are found out by the government, you're going to think really carefully about frivolous lawsuits to save face.

Not sure if a cost-benefit analysis would find such ops positive for the society.

Think of the time wasted by people who read such emails vs the money spent protecting from attacks.

Factor in the cost to the taxpayer.

That's a good topic for a Master thesis in Economics.

Anyone interested?

I doubt it. Network operators like Virgin have very good business reasons to ensure their own network isn't infested with computers running services like NetBIOS, which has no business being exposed on the internet (it is rather verbose, and completely useless outside of a LAN).

And you might be interested in the ip space of all UK entities.

If you put it this way then the problem becomes way easier. Just check public ip databases for AS and technical contact.

To give you a comparison, in the US you need to go down to the DMV with a wad of forms, get the bits you can't fill in filled in, let someone make up a price, decide you haven't filled a bit in properly, send you away to a different window, get something else filled in, pay a fee for the filling in, hand the papers in at yet another window, pay for the actual registration, get a temporary registration slip, pay for a set of plates to actually be fixed onto the vehicle, pay for the stickers that say you've paid for a plate, all of which paid by cheque at various windows, with no real idea of the total cost up front.

In the UK (where cars tend to keep the registration number they're given on first registration), you go to the DVLA website, follow the prompts for the kind of paperwork you have (reminder letter, V5 registration certificate, V5C "green slip" if you've just bought it that the previous owner tears off the bottom of the V5 and gives you), it tells you how much it'll be per month or per year, you put your credit card details in, and that's it. Paid, done, nothing more to do.

Access to a MongoDB server should be restricted to trusted systems (for example, the related web application server)."

My mongodb had with auth - but port was open.

The HN crowd is probably thinking about startups with in-house apps, but the canonical case for this argument is the Microsoft Exchange or Confluence servers that are consistently abused by ransomware actors - which then go on to cost that Government a lot of money as they get dragged into suppliers and contractors being held up for ransom, or investigatory resources being spent in response. It's very easy to tell who owns such a server, and being proactive helps address that.

It's fine to "not trust", but if this service poses any more of a threat to an organisation than the dozens of services already running you've got other issues.

  Personally, I would not trust my dog's toothbrush to any gouvernement.

Eschew flamebait. Avoid generic tangents. Omit internet tropes.

Please don't use Hacker News for political or ideological battle. It tramples curiosity.

Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead.

curious to know how long until the scanning source IP's wind up in my pihole.

Opt in would miss exactly the sites they're targeting. People who don't bother to even think about security let alone do anything about security since as long as it works for them they don't care what happens to anyone else or their data. Opt in would also miss anyone who has been setting up their servers/sites maliciously or acting as safe havens for crime for profit.

If these scans end up causing problems they should be on the hook for damages, but I'm glad they aren't waiting around for people to find them and reach out begging for scans. The responsible people keeping up with security issues and doing things proactively are rarely the problem and do their own scanning already.

You dislike this not because it could be defined as invasive (it's not), or because it could DoS websites (it won't). You dislike this because it's done by the government.

The gov spending money on this endeavour hardly bleeds the coffers dry nor does it prevent investment in other sectors. This kind of radical, tech-first thinking is the kind of thing we should appluad the governments IT service for doing, because not too long ago there was virtually no innovation, anything tech related was offloaded to incompetent contractors such as Accenture and Deloitte.

In fact you're contradicting yourself in multiple ways.

> "[should have spent money on] public education.": this can be defined as public education.

> "increase security staff compensation": as noted, not too long ago lots of this work was delegated to contractors. This is a step in the right direction and soon we can hope the compensation will increase.

> "increase their own security education": have you got a source which states software engineers working for the gov aren't educating themselves?

> "That is it? So... One gal looks at in and says, yep, fire up the guns!": What were you expecting, a full panel of industry experts scrutinising the code followed up with a parliamentary committee? This is called a peer code review, a rather simple process which you'll find at any tech firm.

If NCSC scan my systems for vulnerabilities, they're unlikely to exploit them, and they'll (somehow?) attempt to notify me of the risk.

I'm curious which systems they scan; cloud systems only? Will they scan the stuff I host at home too?

Would be nice if they'd give us some of the tools to run ourselves; any one know if it's on their Github?

“This page provides information on the [UK’s National Cyber Security Centre] NCSC’s scanning activities”

Their mission is to make online activities safe.

  for NET in $UK_NETS; do nmap -p 80,443 $NET; done

I suspect it's well over 50%. I mean, the UK is far from the only power capturing all our traffic.

I believe CISA in the US has something similar too.

This is like saying foot patrols are a bit like SWAT raids. They are, a bit, but they are a lot more than a bit entirely unlike them.

It seems far more invasive to route all your DNS traffic through a untrusted source than having that same source use the exact types of scans attackers are using every day already and report problems they find to you.

I can learn a hell of a lot more about you by your DNS history than I can from knowing what ports you have open and what vulnerable services you're running.

The domain registrar is CIRA, and has only one of twelve board members having a federal government affiliation. See cira.ca for the facts. Their Canadian Shield services uses data from Akamai, Mozilla, and CCCS.

It is not "federal".

Sigh. Another comment from someone's memory that takes only 2 minutes to fact-check and discover to be incorrect.

It's a part of the UK's security services running scans for vulnerabilities they already know about to tell you that you've got an issue.

> anything discovered in the country must now be reported to the CCP *and to no one else* (in most cases).

The "no one else" part is terrible and completely changes the story. However, I do generally support a "tell the government about discovered vulnerabilities" law. Ideally, the government would then inform affected users and investigate whether the vuln could be considered negligence and the company prosecuted.

I've been in a few situations where I reported very easily exploitable vulns that leaked sensitive user data and in all cases, I couldn't for the life of me convince the companies to disclose the leak. Yes, I could've gone public myself where I didn't have a contract, but I would've 100% ended up in jail for some poorly defined crime of "hacking".