Vulnerabilities / Threats

6/15/2017
03:25 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services

Research on global Internet security posture found endpoints leaving Microsoft SMB file-sharing systems wide open online, a finding that explains the rapid spread of WannaCry, Rapid7 says.

More than one million global endpoints are exposed on the public Internet via Microsoft file-sharing services - 800,000 of which are confirmed Windows systems spanning nearly all product and release versions.

Security firm Rapid7 recently released its second annual National Exposure Index, which digs into Internet exposure around the world. Researchers scanned more than three billion IP addressable servers on the public Internet, and 30 ports on each device, for exposed services.

Researchers discovered 160 million devices (computers, servers, IoT products) had open ports exposed to the public Internet. Their results shed light on the rapid spread of WannaCry, the large-scale ransomware attack that hit global machines in May 2017, as well as exposure of Telnet ports and individual security exposure of countries around the world.

The study was conducted in March and April 2017, prior to WannaCry, explains chief data scientist Bob Rudis. The attack prompted researchers to a deeper dive and probe the Internet for any Microsoft servers running the SMB protocol that WannaCry exploited.

"We found around 800,000 Windows systems on the Internet exposing SMB," says Rudis. "A good chunk of those were susceptible, and are still susceptible, to WannaCry ransomware."

The file-sharing port 445, which enabled WannaCry, was actively sought out in May 2017. SMB port scan results increased by 17%, from 4.7 million to 5.5 million nodes, in that timeframe. Blocking port 445 would block attacks like this, the report indicates.

There were two themes throughout this research: the idea that broad Internet exposure makes an environment attractive to threat actors and accidental breaches; and the idea that technical leadership can protect users by reducing exposure.

Good News

More positive findings came from scanning port 23, or the Telnet port, which enabled the Mirai botnet that hit IoT devices in October 2016. Compromised devices were exposed on port 23, explains Rudis, and many IoT products use the same one.

Researchers predicted they would see less use of port 23 in 2017, which proved true. The Telnet scan returned nearly 10 million responsive nodes, a 33% drop from 14.8 million responses in 2016. This finding spans all devices and is a sign people are more frequently encrypting communication from their desktops and other endpoints.

"[Mirai] had an impact and created visibility about the weakness of the IoT," Rudis explains. "It's great that we saw a reduction in one of the worst ports on the Internet right now."

On a geographical level, researchers found the most exposed nations include Zimbabwe, Samoa, Hong Kong SAR, Romania, Ireland, Congo Republic, Tajikistan, Lithuania, Estonia, and Australia.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Belgium, the most exposed nation in 2016, cut the number of exposed services by 250,000 and fell off the top 50 ranking. The US has relatively low exposure in relation to its IPv4 space and isn't on the list of 50 most exposed nations.

Businesses should be aware of their exposure, especially as they move to the cloud and begin to do orchestration, says Rudis. Unfortunately, this isn't a very mature or robust space and there isn't much historical data on how to keep things secure on the Internet.

Security teams can start by being mindful of what they're deploying, and only deploy things they intend to expose.

"People should be watching what they're deploying and watching their exposures out there," he continues. "We look at these things, and we're the good guys. It doesn't take a whole lot of effort for the bad guys to scan the Internet and look for these things, too."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RIP, 'IT Security'
Kevin Kurzawa, Senior Information Security Auditor,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17906
PUBLISHED: 2018-11-19
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.
CVE-2018-9209
PUBLISHED: 2018-11-19
Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2
CVE-2018-9207
PUBLISHED: 2018-11-19
Arbitrary file upload in jQuery Upload File <= 4.0.2
CVE-2018-15759
PUBLISHED: 2018-11-19
Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perfo...
CVE-2018-15761
PUBLISHED: 2018-11-19
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges...