Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/15/2017
03:25 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services

Research on global Internet security posture found endpoints leaving Microsoft SMB file-sharing systems wide open online, a finding that explains the rapid spread of WannaCry, Rapid7 says.

More than one million global endpoints are exposed on the public Internet via Microsoft file-sharing services - 800,000 of which are confirmed Windows systems spanning nearly all product and release versions.

Security firm Rapid7 recently released its second annual National Exposure Index, which digs into Internet exposure around the world. Researchers scanned more than three billion IP addressable servers on the public Internet, and 30 ports on each device, for exposed services.

Researchers discovered 160 million devices (computers, servers, IoT products) had open ports exposed to the public Internet. Their results shed light on the rapid spread of WannaCry, the large-scale ransomware attack that hit global machines in May 2017, as well as exposure of Telnet ports and individual security exposure of countries around the world.

The study was conducted in March and April 2017, prior to WannaCry, explains chief data scientist Bob Rudis. The attack prompted researchers to a deeper dive and probe the Internet for any Microsoft servers running the SMB protocol that WannaCry exploited.

"We found around 800,000 Windows systems on the Internet exposing SMB," says Rudis. "A good chunk of those were susceptible, and are still susceptible, to WannaCry ransomware."

The file-sharing port 445, which enabled WannaCry, was actively sought out in May 2017. SMB port scan results increased by 17%, from 4.7 million to 5.5 million nodes, in that timeframe. Blocking port 445 would block attacks like this, the report indicates.

There were two themes throughout this research: the idea that broad Internet exposure makes an environment attractive to threat actors and accidental breaches; and the idea that technical leadership can protect users by reducing exposure.

Good News

More positive findings came from scanning port 23, or the Telnet port, which enabled the Mirai botnet that hit IoT devices in October 2016. Compromised devices were exposed on port 23, explains Rudis, and many IoT products use the same one.

Researchers predicted they would see less use of port 23 in 2017, which proved true. The Telnet scan returned nearly 10 million responsive nodes, a 33% drop from 14.8 million responses in 2016. This finding spans all devices and is a sign people are more frequently encrypting communication from their desktops and other endpoints.

"[Mirai] had an impact and created visibility about the weakness of the IoT," Rudis explains. "It's great that we saw a reduction in one of the worst ports on the Internet right now."

On a geographical level, researchers found the most exposed nations include Zimbabwe, Samoa, Hong Kong SAR, Romania, Ireland, Congo Republic, Tajikistan, Lithuania, Estonia, and Australia.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Belgium, the most exposed nation in 2016, cut the number of exposed services by 250,000 and fell off the top 50 ranking. The US has relatively low exposure in relation to its IPv4 space and isn't on the list of 50 most exposed nations.

Businesses should be aware of their exposure, especially as they move to the cloud and begin to do orchestration, says Rudis. Unfortunately, this isn't a very mature or robust space and there isn't much historical data on how to keep things secure on the Internet.

Security teams can start by being mindful of what they're deploying, and only deploy things they intend to expose.

"People should be watching what they're deploying and watching their exposures out there," he continues. "We look at these things, and we're the good guys. It doesn't take a whole lot of effort for the bad guys to scan the Internet and look for these things, too."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19807
PUBLISHED: 2019-12-15
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
CVE-2014-8650
PUBLISHED: 2019-12-15
python-requests-Kerberos through 0.5 does not handle mutual authentication
CVE-2014-3536
PUBLISHED: 2019-12-15
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3643
PUBLISHED: 2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2014-3652
PUBLISHED: 2019-12-15
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.