Hello, welcome to the Monday, May 10th, 2021 edition of the Sansanet Storm Center's Stormcast. My name is Johannes Ulrich. And then I'm recording from Jacksonville, Florida.

This weekend, Guy took a look at his honeypot and which scans that he received actually came from researchers that are scanning the internet

for open ports.

We do actually have an API that you can use to get a list of all the IP addresses that

we consider researchers.

I will add a link to that API to the show notes if you're

interested. And of course, feedback is welcome. Defining what is a researcher is, of course,

a little bit tricky. These are not necessarily universities. Some of them are companies

that are scanning the internet. Some of the organizations are a little bit harder to define, but they call themselves researchers, which is really all it takes to sort of be classified as a researcher in our feet.

Next question that usually comes up is, should you block scans

from researchers? Again, I don't think there's big harm in allowing them in. We don't really see a

lot of real outright malicious stuff, but of course, that's a matter of how you define this.

We had actually, I think, two years ago, a research paper

that one of our sans-dot students wrote, where he looked at whether or not it matters if you are

listed, for example, in Shodan, which is one of the sites we classify as researchers. And he didn't

see a big difference here here whether or not you are

or are not listed, but probably worthwhile doing this again and seeing what this looks like now.

Now talking about researchers, a group of researchers from SIDN labs, Internet, New Zealand, USC, and ISI have published an interesting

paper outlining denial of service vulnerability in DNS servers. Now, there are really two

parts to it. There's a first part that's a misconfiguration of zones.

So that affects the authoritative name servers.

But the real vulnerability that's then being used to take advantage of the misconfiguration is actually in the recursive name servers.

...