Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/15/2017
03:25 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services

Research on global Internet security posture found endpoints leaving Microsoft SMB file-sharing systems wide open online, a finding that explains the rapid spread of WannaCry, Rapid7 says.

More than one million global endpoints are exposed on the public Internet via Microsoft file-sharing services - 800,000 of which are confirmed Windows systems spanning nearly all product and release versions.

Security firm Rapid7 recently released its second annual National Exposure Index, which digs into Internet exposure around the world. Researchers scanned more than three billion IP addressable servers on the public Internet, and 30 ports on each device, for exposed services.

Researchers discovered 160 million devices (computers, servers, IoT products) had open ports exposed to the public Internet. Their results shed light on the rapid spread of WannaCry, the large-scale ransomware attack that hit global machines in May 2017, as well as exposure of Telnet ports and individual security exposure of countries around the world.

The study was conducted in March and April 2017, prior to WannaCry, explains chief data scientist Bob Rudis. The attack prompted researchers to a deeper dive and probe the Internet for any Microsoft servers running the SMB protocol that WannaCry exploited.

"We found around 800,000 Windows systems on the Internet exposing SMB," says Rudis. "A good chunk of those were susceptible, and are still susceptible, to WannaCry ransomware."

The file-sharing port 445, which enabled WannaCry, was actively sought out in May 2017. SMB port scan results increased by 17%, from 4.7 million to 5.5 million nodes, in that timeframe. Blocking port 445 would block attacks like this, the report indicates.

There were two themes throughout this research: the idea that broad Internet exposure makes an environment attractive to threat actors and accidental breaches; and the idea that technical leadership can protect users by reducing exposure.

Good News

More positive findings came from scanning port 23, or the Telnet port, which enabled the Mirai botnet that hit IoT devices in October 2016. Compromised devices were exposed on port 23, explains Rudis, and many IoT products use the same one.

Researchers predicted they would see less use of port 23 in 2017, which proved true. The Telnet scan returned nearly 10 million responsive nodes, a 33% drop from 14.8 million responses in 2016. This finding spans all devices and is a sign people are more frequently encrypting communication from their desktops and other endpoints.

"[Mirai] had an impact and created visibility about the weakness of the IoT," Rudis explains. "It's great that we saw a reduction in one of the worst ports on the Internet right now."

On a geographical level, researchers found the most exposed nations include Zimbabwe, Samoa, Hong Kong SAR, Romania, Ireland, Congo Republic, Tajikistan, Lithuania, Estonia, and Australia.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Belgium, the most exposed nation in 2016, cut the number of exposed services by 250,000 and fell off the top 50 ranking. The US has relatively low exposure in relation to its IPv4 space and isn't on the list of 50 most exposed nations.

Businesses should be aware of their exposure, especially as they move to the cloud and begin to do orchestration, says Rudis. Unfortunately, this isn't a very mature or robust space and there isn't much historical data on how to keep things secure on the Internet.

Security teams can start by being mindful of what they're deploying, and only deploy things they intend to expose.

"People should be watching what they're deploying and watching their exposures out there," he continues. "We look at these things, and we're the good guys. It doesn't take a whole lot of effort for the bad guys to scan the Internet and look for these things, too."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/7/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20637
PUBLISHED: 2020-04-08
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connecti...
CVE-2020-11650
PUBLISHED: 2020-04-08
An issue was discovered in iXsystems FreeNAS 11.2 and 11.3 before 11.3-U1. It allows a denial of service.
CVE-2020-11653
PUBLISHED: 2020-04-08
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.
CVE-2020-2732
PUBLISHED: 2020-04-08
A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.
CVE-2020-1627
PUBLISHED: 2020-04-08
A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service (DoS) by sending specific packets requiring special processing in microcode that the flow cache can't handle, causing the riot forwarding daemon to crash. By continuously sending ...