Discussion of Analysis #5
Description
As we are all excitedly waiting for the full output to complete I am going to theorize about the analysis of the results. In order to do this I will use some intermediate output as shown below.
Loading list of dutch hosts...
Found 43583070 dutch hosts.
Synchronizing threads...
Loading ZMAP IMAP-Banner results...
Loading ZMAP FTP-Banner results...
Loading ZMAP POP3S-Banner results...
Loading ZMAP Heartbleed-Banner results...
Loading ZMAP SMTP-Banner results...
Loading ZMAP IMAPS-Banner results...
Loading ZMAP HTTPS-Banner results...
Loading ZMAP POP3-Banner results...
Found Dutch 112179 hosts with POP3S.
Fetching banners for Dutch POP3S hosts...
Found Dutch 109645 hosts with IMAPS.
Fetching banners for Dutch IMAPS hosts...
Found Dutch 87183 hosts with IMAP.
Fetching banners for Dutch IMAP hosts...
Found Dutch 129094 hosts with POP3.
Fetching banners for Dutch POP3 hosts...
Found Dutch 200067 hosts with SMTP.
Fetching banners for Dutch SMTP hosts...
Found Dutch 240749 hosts with FTP.
Fetching banners for Dutch FTP hosts...
Found Dutch 572534 hosts with Heartbleed.
Fetching banners for Dutch Heartbleed hosts...
Found Dutch 664957 hosts with HTTPS.
Fetching banners for Dutch HTTPS hosts...
The tool has been able to find 43583070 dutch hosts. The distribution of the investigated services among these hosts is shown in the output and summarized below.
112179 hosts running POP3S
109645 hosts running IMAPS
87183 hosts running IMAP
129094 hosts running POP3
200067 hosts running SMTP
240749 hosts running FTP
572534 hosts running Heartbleed (these hosts are insecure and vulnerable)
664957 hosts running HTTPS
For the analysis I propose a random test, in this way we combine the broadness of scans.io with the depth of being able to find pages leading to further investigation HTTP/HTTPS and SSL (through cached pages?). Firstly for each service we take the appropriate sample size. Afterwards for each sample we can determine which version of software the service is running and do a simple SSL investigation to determine possible problems. This SSL research will be combined with the Heartbleed results. Once the versions have been found we can make a quantitative list of software versions used by the population. This list can then be combined with a vulnerability database to determine how many of these servers are vulnerable.
I propose that if a server contains any service with a high risk, the server is marked as being insecure. Otherwise we mark it as secure, in this way we are overestimating how many secure servers there are. This also leads to a result which is biased a certain way, however I expect even though it is biased it will show that in general hosts can be considered insecure.