Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated.
I always assumed network data is network data. I don't see the difference between sending millions of packets of data to stream a video and to scan a network. The only difference is the intention - does that mean the act of learning someone's open ports is what's considered abuse? Or is it consent - the fact that you're learning about open ports that the server owner doesn't want you to know about?
> You may not use, or facilitate or allow others to use, the Services or the AWS Site ... to violate the security, integrity, or availability of any user, network, computer or communications system, software application, or network or computing device;
There's no cutoff because it's not about the number of connections; you could conceivably violate this policy with a single connection, and you could be in compliance with a million connections. Note the term "unwarranted" in OP's post.
Assume we're not talking about nmap (since it's widely known as a hacker tool which may muddy the waters), but instead of a user-written program that e.g. checks for open ports. If a port is open to the public internet, what exactly makes a connection to it "unwarranted"?
As for the AWS rule, scanning open ports does not violate, by itself, any of those things.
Intent: What is the connection's purpose? To use a service, to map a topology, to identify potentially vulnerable targets, to consume resources?
Impact: How does the act of connecting (once or many times) affect the remote end of the connection? Is a critical resource being exhausted (network connections, cpu, memory, etc)? Is the remote end's service still available for its intended purpose?
There's no magic spot on the scales but the further you get away from "to use the service" on the Intent scale and "no detectable impact" on the Impact scale, the more trouble you're likely to run into.
You're looking for a line in the sand (for whatever reason) but no provider will give one, nor should they. Because that would mean telling attackers how to get close to the line without going over it.
I'm asking questions to widen my understanding of how and why I might get in trouble for it.
And I know, now you want to define "legitimate user traffic".
The problem is that the expectation for such strictly defined terms is what leads to legalese that's impossible for anyone that isn't a lawyer to understand.
Several years ago (so things may be different now), I snagged a free-tier (IIRC, it was free for six months or something like that) AWS instance specifically to battle-test my new firewall and config.
Within an hour of beginning tests, I received a notification from AWS asking me why I was doing port scans/etc. and that they wanted me to stop or I'd be kicked off.
I replied and documented that I was testing my own systems/networks and they backed off. I completed my testing and never heard anything from them after that.
Like I said, this was a few years ago (2019, I think), so things may be different now, but back then AWS was definitely proactive about this stuff.
A normal port scan does none of these things. Unless you have some really crappy equipment (I've seen routers choke on a SYN scan), but in my opinion then that's on you.
But we signed a think with our rep to agree to only scan our own machines and then they let us do it..
Dont know if they will do that any more.
Gosh they're going to have a heck of a time figuring out what is and isn't warranted.
That was my guess as well. For example, I send about half a dozen emails every day but they are all coming to me and nobody else so I just assumed that it should be ok because the only person I am spamming is myself :)
If a scan is spotted in outgoing traffic, I would be concerned that there was a dumb bot of some kind running inside the network.
In the case of a service provider network, they want to make sure they are not facilitating criminals, either directly as their customer, or by hosting compromised systems.
A serious, targeted attack won't use an aggressive nmap type scan, but plenty of low effort malware scripts and bots will.
> the act of learning someone's open ports is what's considered abuse?
Yes, port-scanning a system without the permission of the owner of the system is widely considered abuse. It's conceptually similar to going to an apartment building and knocking on every door to see who's home and who's not.
The act itself isn't very harmful (my home firewall is basically always getting portscanned by somebody or another), but in practice, the reason it's done is as preparation for a more serious attack.
Yet it's fine for solicitors?
After almost being physically ejected from a secure data centre because a member of my group used nmap to see if a port was open, I recommend starting with telnet. :)
A wide nmap is probably going to trigger an IDS, and then you get to meet interesting people and answer interesting questions.
Makes you more excited to read the man page doesn't it?
By whom? I disagree; using nmap is more akin to, say, standing outside a building (on public property) and taking (or painting) a picture of the building. Yes, some people have gotten in trouble for that. Should they, though?
I can't really explain why but I think there is a difference between doing something manually and automating it. For example, it is perfectly ok for a police officer to sit behind the bushes in front of someone's front porch with a pair of binoculars but not ok to put a hidden camera 24/7 in front of everyone's front porch.
I wish linux man pages had more example sections. TBH I reach for `tldr nmap` or `tldr ...` first in most cases.
Why?
For the "they" of your provider, who is held accountable for allowing abusive traffic, the goal is to provide you outbound connectivity but to do that they also need to ensure they don't get de-peered or their network ranges blocked for hosting abusive traffic. Even for things which don't transit a 4th party there is negative incentive to let your customers abuse each other just because the addresses are reachable. This almost always results in automated systems with limited incentive for good uses of port scanning to be allowed.
For the "they" of the end system is (most likely) they didn't make the entire system available to you, just some select services for use in a certain way (e.g. loading their website). Doing that does not provide them an obligation to continuously allow all traffic received at the address to be processed and it's very likely they'll just block you entirely as another layer of defense.
Stealing someone's bitcoin? It's just network connections. Logging in to some admin portal with default passwords? It's just network connections.
> Why would they make a computer accessible to me if they don't want me connecting to it?
Why would they write bugs in software if they don't want to write bugs?
The administrator of the network didn't intend to allow port scanning, but there were no technical measures (firewalls) to prevent it, and you did port scanning => you're wrong.
The writer of the access control software intended to have no bugs, but a bug slipped in to allow you to exploit it => you're wrong.
I just want to know what's out there.
> exploit
How is this exploitation in any way?
How is this different from scraping publicly available websites? i.e. why would you get in trouble for one, but not the other?
Big companies with deep pockets will even bankrupt other companies this way. For an example, look at how Sony sued playstation emulator companies over the most bullshit claims possible, got an injunction, killed their profits and then it didn't matter that they lost in court afterwards. In my country, the judge would have estimated the profits the smaller player lost as a result of Sony's frivolous lawsuit and forced them to pay it all back on top of the legal fees.
In short, who's getting put out of business for redisplay or derived data uses of publicly available data?
Depending on the situation, it could be.
While not an issue any longer (well, at least for those without data caps -- man do I hate those!), ~30 years ago I worked for a network equipment manufacturer as an integrator/tester/3rd level support guy (yes, it was a small company) and was testing our IP stack.
I got the (not so) bright idea of running continuous pings to random IP addresses (changing them every couple days) to verify stability and identify possible memory leaks.
One of the addresses was someone in Australia who was charged by the byte (or packet...it was a long time ago) and after a day or two, we received some very angry telephone calls from them. Oops.
This person (and rightly so) felt I was abusing their internet link, even though I didn't know or care about them or the contents of their network.
Like I said, this isn't (or at least not for the most part) an issue any more, nor is it something more intrusive than port scanning, but it points up the idea that "abuse" is not a black and white thing.
Run port scans against my IP addresses and the absolute worst that might happen is me scanning you right back (yes, I know, that sort of thing is generally frowned upon. So sue me -- nobody has yet).
Run those same scans against government/military sites and you may well soon have a knock (or a battering ram) on your door.
Context matters.
For live practice, you should scan IP addresses in countries that are unlikely to be able to prosecute you, like Russia (if you are a westener)*
* joking (maybe)
This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn.
There are also platforms like tryhackme, hackthebox etc., that offer both free and paid networks, on which one can legally scan.
This is where my advice comes in handy :)