Hackers abusing online Nmap Port Scanning service
2012-12-28T06:05:00Type thn
Reporter Mohit Kumar
Modified 2013-01-11T18:02:28
Description
Most of you knows the power of Nmap, When used properly, Nmap helps protect your network from invaders. One of the best tool for hackers, penetration testers and Security researchers. Officially Nmap a desktop tool, can be used as web version but should be under some limitations.
When someone does Nmap scan against a target to find out the open ports, enumerating system details and installed services versions, most obvious if used improperly, Nmap can get you sued, fired, expelled, jailed, or banned by your ISP for scanning a target under hacking attempt.
Hacker can be tracked back via the IP address from where one perform the scanning, but what if a web version of Nmap available on a website, where one just need to enter the target IP/website address and that website will do a free scan against your target ? Seems easy and one can use Proxy to access that website and which will do a simple and fast scan for you !
Yes, a service called "ScanPlanner" (http://scanplanner.com/) is such website, that allow anyone to scan any website for free and according to our recent analysis many hackers have start using this website for initial information gathering tool as "safe planner" << Yes I really mean it!
Is Unauthorized Port Scanning a Crime? Actually it depends upon what you target. If target is your own website or you are authorized to scan that, then it is considered to be legal process. But if one is scanning someone else server without authorization and it would be considered as an attempt to hack or find loopholes, in that case Yes, Its a Crime!
How hackers are abusing "ScanPlanner" service ? Officially ScanPlanner is a service for webmaster to scan their server to find out loop holes in security. There are two plans - Free and paid. Under paid scan, scanplanner will scan your website regularly. Whereas the Free scanning option is available on website as a demo for new users.
But Free scanning process, is not verifying that one who requesting a scan against website.com , either he actually own this website.com or not ! So anyone can scan any server/website without authentication.
You just need to open scanplanner website, Enter the URL of your target and Scan ! On the very next page you will get Results like this:
In case you are receiving message "Scan has not started yet.", that means , your scan in Queue and other hackers are currently using the free service for hacks. There is no information available on the website, that who own this service.
We has a word with Mikko Hypponen (CRO at F-Secure) about legality of this service two weeks before via a tweet and his reply was, "@TheHackersNews Oh boy. This service will be abused heavily. You can expect scanplanner․com to go offline in a day or two.".
Such types of services should first verify that either the user really own target website or not. For this purpose they can use Meta-Tag verification process or some other way. For now many Cyber criminals are misusing this service because my "Scan has not started yet."
