Government to Scan Every Internet Device
A government plans to scan every Internet-connected device in the country for vulnerabilities. The agency concerned insists it won't compromise privacy.
The scan is the work of the United Kingdom's National Cyber Security Centre (NCSC). It says its looking for zero-day vulnerabilities, meaning security holes that hackers are actively exploiting before a fix is available.
The NCSC says it will regularly scan all Internet connected devices based in the UK. It doesn't intend to access any data on devices but instead simply make a connection request.
The scanning software will then log any response, plus the date, time and IP address. The main aim of the scan is to build up a picture of any software version details included in the response.
Software Versions Logged
The idea is that as new threats emerge to take advantage of security flaws in specific software versions, officials can quickly assess how many people could be affected and thus how important it is to quickly develop, distribute and deploy a fix. The agency is looking for "vulnerabilities that are common or particularly important due to their high impact."
The NCSC's Ian Levy says the scanning is no different to what many cyber security companies do, but that he understands an intelligence agency needs to be more open about such activity. He insists the scanning is for legitimate security purposes and that "We're not trying to find vulnerabilities in the UK for some other, nefarious purpose." (Source: ncsc.gov.uk)
Opt-Out Available
The agency has published the details of the domain and IP addresses from which it will carry out the scans, namely scanner.scanning.service.ncsc.gov.uk, 18.171.7.246, and 35.177.10.231. People who don't want their devices or systems scanned can either block incoming communications from these addresses or email scanning@ncsc.gov.uk to request an opt-out. (Source: bleepingcomputer.com)
Levy says the scans may become more complex in future, but the agency will always reveal and explain any changes to its methodology. He also insists systems are in place to make sure only the minimum amount of data is collected. Any sensitive or personal information will be removed from the collected data and steps taken to avoid such collection in future.
What's Your Opinion?
Would you be happy for similar scans in your country? Do you buy the NCSC's insistence it's a security move only? Do the security benefits outweigh the privacy implications?
My name is Dennis Faas and I am a senior systems administrator and IT technical analyst specializing in cyber crimes (sextortion / blackmail / tech support scams) with over 30 years experience; I also run this website! If you need technical assistance , I can help. Click here to email me now; optionally, you can review my resume here. You can also read how I can fix your computer over the Internet (also includes user reviews).
We are BBB Accredited
We are BBB accredited (A+ rating), celebrating 21 years of excellence! Click to view our rating on the BBB.
Comments
Windows Defender
This isn't much different than owning a Windows 10 PC and having MS Defender automatically scan your system and report back via "the cloud" that your system contains certain software. The only major difference is that Windows 10 includes a EULA (end user license agreement) that you automatically accept should you install Windows on your machine.
On that note, nefarious bots on the Internet already scan machines for open ports and look to infect devices based on information they gather, and this is already being done without anyone's permission. The UK government is doing the same but is instead informing the public of their intentions.
While this is happening
While this is happening already whether by hackers or by MS, there's a difference when the Government is involved.
There's always somebody involved that has a hidden agenda. Or blatant misuse and policy violation.
And if it's just probing to check software vulnerability and approximate number of individuals at risk, why is the IP logging necessary? What value is the IP unless it would be used to contact the user of the IP(something that isn't part of the goals)?
At least they're informing their citizens.
I'm willing to bet the Biden government is already doing this to Americans in a more clandestine manner. And they are gathering more than IP addresses.
They've been doing far more
They've been doing far more than what's laid out in this article since they started doing it during Bush administration.
Neither Bush, Obama, Trump, nor Biden have any say-so in, or care about it. If you think otherwise, I have a lakeside property in Death Valley you might be interested in. But yeah, sure, "Biden". 🙄
UK scanning all internet connected devices
We are aware in the UK that the Government are already scanning internet traffic and following up anything that contains certain words or phrases. This is just another step towards "1984" type control. I would perhaps worry a bit less if it was not the Tory party in control of the Government just now, they are already riding roughshod over peoples rights, so I have no doubt that it will go further than just checking for malwaare. Unless you include people that don't support the Tory party as "malware" of course.