Author

Alex Gartner

209 posts

Product News

Introducing Censys CLI Skills: AI-Assisted Investigations at Scale

At 2 a.m., a workstation makes an outbound TLS connection to a VPS on port 7443. The EDR flags it. A Tier 1 analyst on her third night shift (and her third cup of coffee) pulls up the IP: DigitalOcean, Linux, a self-signed certificate, nothing in the usual reputation feeds. She writes “no further action” […]

· 12 min read
Adversary Infrastructure Research

Scouting a Threat Actor

Censys uncovers "SCOUT PROJECT," a novel C2 server exploiting CVE-2025-30208, CVE-2025-3248 & CVE-2025-29927. Discover the threat actor's infrastructure, backdoor toolkit, and attack methods.

· 7 min read
Research

IngressNightmare: Kubernaughty Kubernetes

Around 5,000 hosts expose Kubernetes NGINX ingress controllers to the internet. Censys researchers analyze the critical RCE vulnerability and its real-world impact.

· 7 min read
Research

Sisense: A Look at Industry and Geography

# SEO-Optimized Meta Description **Sisense Data Breach 2024: Censys research reveals 500+ exposed instances across industries including Finance, Healthcare & Sales. Learn the scope and impact of this critical security incident.** *Character count: 158* This meta description works because it: - **Includes high-value keywords**: "Sisense data breach 2024," "Censys research," "exposed instances," "security incident" - **Creates urgency and curiosity** with specific data points ("500+ exposed instances") - **Mentions affected industries** to attract relevant searchers - **Uses a clear call-to-action** ("Learn the scope and impact") - **Stays under the 160-character limit** to avoid truncation in search results

· 3 min read
Research

Ivanti Connect (in)Secure - Revisited

Censys reveals 24,590 exposed Ivanti Connect Secure gateways, with 24.7% vulnerable to critical CVEs. Discover trends, CISA guidance impacts, and suspicious fake hosts on AWS.

· 13 min read
Adversary Infrastructure Ransomware Threat Detection

Top Ransomware Attack Vectors: How to Defend Against Them

# SEO Meta Description **Ransomware attacks surged 70% in 2023. Learn top attack vectors, prevention strategies, and how proactive threat intelligence can strengthen your ransomware defense.** *(158 characters)* This meta description works because it: - **Leads with a compelling statistic** (70% surge) to grab attention - **Includes key search terms**: ransomware attacks, attack vectors, prevention strategies, threat intelligence, ransomware defense - **Creates urgency** with the data point about the surge - **Promises actionable value** ("Learn...strategies") - **Stays under 160 characters** for full display in search results

· 12 min read
Adversary Infrastructure Censys Search Internet Intelligence

24 Questions to Ask About Your Data in 2024

# SEO-Optimized Meta Description **Option 1 (Best):** Discover 24 critical questions to evaluate your internet intelligence and threat data. Improve adversary infrastructure detection with better internet scan data from Censys Search. **Character count:** 158 **Option 2:** Is your threat intelligence data holding you back? Explore 24 questions to assess your internet intelligence and strengthen your cybersecurity strategy in 2024. **Character count:** 155 --- ## Why This Works: - **Keywords included:** "internet intelligence," "threat intelligence," "adversary infrastructure," "Censys Search," "internet scan data" - **Compelling hook:** The numbered list ("24 questions") creates curiosity and implies actionable, structured content - **Action-oriented language:** "Discover," "Improve," "Evaluate" encourage clicks - **Value proposition clear:** Readers

· 5 min read
Adversary Infrastructure Censys Internet Map Exposure Management

Stop Predicting. Start Protecting.

The Pitfalls of Predicting Cybersecurity Trends The start of the New Year often brings with it predictions about what’s in store for the year ahead. In cybersecurity, this often means predicting future threats and security trends. However, the fast-paced nature of cyber attacks and increasing sophistication of threat actors means making predictions that are actually […]

· 4 min read
Internet Intelligence

The Perils of False Positives

When it comes to inaccurate data, what’s worse: a false negative, or a false positive? The question is a little unfair, because of course, nobody wants either. But it does bring to mind the fact that false negatives are often regarded as the more problematic type of inaccuracy. A false negative means that something (usually […]

· 4 min read
Censys Search

User Resources: How to Get Started in Censys Search

Make the most of Censys Search with helpful resources from our Getting Started library! On the Censys Search home page, you can now access a library of curated resources focused on how to leverage Censys Search. Whether you’re brand new to Censys Search or are a more seasoned user, our Getting Started resources are […]

· 3 min read
Adversary Infrastructure Censys Search Research

Tracking Vidar Infrastructure with Censys

Stealers are trojans that collect credentials, notable files, and tokens from an infected computer and upload the data back to attacker-controlled infrastructure. Today, we will discuss one of the more advanced stealers: Vidar. Vidar is a piece of malware originating from the Arkei Stealer but uses new methods to find and direct traffic to […]

· 3 min read
Rapid Response Research

Cisco IOS XE: Ten days later

Last week, we shared information about an ongoing event with Cisco devices and a backdoor installed on tens of thousands of Cisco hosts. And in our last update, we noted a significant drop in the number of infections. And would you believe that number has dropped to zero? Well, sort of… Since then, […]

· 4 min read
Adversary Infrastructure Censys Search Internet Intelligence

Unleash the Power of Censys Search: A Quick Guide to Queries

April 2026 Update: Censys has come a long way: an entire platform complete with pivoting, dashboards, rapid response queries by Censys ARC, investigation tools, and MCP support.  Access sample queries within the free platform, and happy hunting!   Whether you’re brand new to Censys Search and are looking for tips to get started, or are […]

· 9 min read
Rapid Response Research

HTTP/Who? CVE-2023-44487

Looking Closer at the Attack Mechanics On October 10, Google and Cloudflare released reports concerning abuse of a specific feature in the HTTP/2 protocol, leading to increased load and a potential denial-of-service on servers that cannot keep up with many concurrent requests. Their reports go into detail about a scenario where an actor […]

· 5 min read
Research

Unmasking Deception: Navigating Red Herrings and Honeypots

Here at Censys, our mission is to craft the ultimate blueprint of the web, map all the strange anomalies, and unearth where the wild things roam. We scan the internet indiscriminately and do an excellent job, too. And when you look at this data all day, like us, you tend to become accustomed to […]

· 13 min read
Cloud Security

Tips to #SecureOurWorld This Cybersecurity Awareness Month

This year marks the 20th anniversary of Cybersecurity Awareness Month. In recognition of the federal designation, we’re taking a closer look at cybersecurity recommendations from the Cybersecurity and Infrastructure Security Agency (CISA) and adding in a few of our own. What can organizations do to better protect what they own? CISA’s Recommendations Cybersecurity Awareness […]

· 4 min read
Attack Surface Exposure Management External Attack Surface Management

Considering an External Attack Surface Management (EASM) Solution? Here’s What to Look For

External Attack Surface Management or EASM solutions have become an integral part of the modern security tech stack. EASM solutions provide the essential visibility, context, automation, and scalability that organizations need to understand the entirety of their external attack surface and defend against advanced threats. However, as with any tech, not all EASM solutions are […]

· 3 min read
External Attack Surface Management

Managing Shadow IT Assets with External Attack Surface Management

“You can’t protect what you can’t see.” We say this often at Censys because it’s true. Cybersecurity teams can only monitor, manage, and defend the digital assets they know about. Though most enterprise IT teams have protocols in place for proper tech procurement and onboarding, in today’s rapidly expanding cyber landscape, unauthorized digital assets inevitably […]

· 4 min read
Censys Internet Map Internet Intelligence Threat Intelligence

Raising the Bar on Internet Coverage: Predictive Scanning Takes The Censys Internet Map to the Next Level

At Censys, our goal is to be the one place to understand everything on the internet – for more effective threat hunting and exposure management. With the rapid proliferation of cloud providers, software, web properties, remote devices, and more, it is becoming more challenging for security teams to identify threats or exposures and take action. […]

· 6 min read
Rapid Response

MikroTik RouterOS CVE-2023-30799: On the Dangers of Public Admin Interfaces

Continue to track the state of vulnerability with our interactive dashboard Introduction Threat researchers at VulnCheck recently brought renewed attention to a critical remote post-authentication privilege escalation vulnerability in MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6, tracked as CVE-2023-30799. This exploit was first published by researchers from Margin Research at REcon […]

· 5 min read
Exposure Management External Attack Surface Management

Why an Exposure Management Solution Belongs in Your Tech Stack

Exposure Management solutions are a critical piece of the modern security tech stack. When organizations delay investing in Exposure Management, they limit their ability to effectively defend their security perimeter from attacks. In our recent 2023 State of Security Leadership Report, the majority of surveyed security leaders said that understanding the ENTIRETY of their attack […]

· 3 min read
Adversary Infrastructure Censys Search External Attack Surface Management

Mission Critical Intelligence: Why This Government Agency Partners with Censys to Understand the Threat Landscape

When ZMap, the world’s first global, open-source internet scanner, was released in 2012, it immediately attracted tens of thousands of users from leading government agencies who conducted critical searches to understand the emerging digital threat landscape. Today, Censys’ proprietary Internet Map is the most comprehensive, up-to-date collection of global internet infrastructure enriched with critical context […]

· 6 min read
Research Vulnerabilities

Managed File Transfer (MFT) Exposure

Attackers Targeting MFT Tools Are On The Rise There is a constant war of convenience vs security being waged and moving files across networks is one of those battles being fought right now. While many of these tools are designed to only be accessed behind a firewall, they are often incorrectly configured to be accessed […]

· 2 min read
Federal / Government Research

Identifying CISA BOD 23-02 Internet-Exposed Networked Management Interfaces with Censys

UPDATE 2023-06-28: A section of the second paragraph of this article describing the FCEB hosts we examined for this analysis was edited for clarity. Executive Summary On June 13, CISA released BOD 23-02 with the objective of mitigating the risks associated with remotely accessible management interfaces that might allow configuration or control of federal agency […]

· 3 min read
Attack Surface Exposure Management External Attack Surface Management

Latest CISA Directive Highlights Importance of Attack Surface Visibility

Latest CISA Directive Highlights Importance of Attack Surface Visibility By Brad Brooks, Chief Executive Officer, Censys Earlier this week, the Cybersecurity and Infrastructure Security Agency (CISA) issued a new binding operational directive (BOD) requiring federal civilian agencies to enhance protections for devices on government information systems that use network protocols for remote management over public […]

· 4 min read
Rapid Response Research

MOVEit: an Industry Analysis

Note: As Censys is an internet scanner, we cannot determine if these devices are vulnerable; these are the MOVEit services we found running exposed on the internet.  Introduction Recently, Managed File Transfer (MFT) services have been gaining considerable attention in the realm of security. Although MFT may not be a regular discussion topic, it is […]

· 6 min read
Censys Internet Map Cloud Security Internet Intelligence

Revisiting the State of the Internet

It’s been about two months since we released our 2023 State of the Internet Report. With access to the most comprehensive internet-wide scan data available, narrowing our focus for the report to a specific area or set of technologies on the internet was a formidable challenge. Ultimately, we decided to focus on the web, […]

· 3 min read
Cl0p Research

MOVEit Transfer Vulnerability

UPDATES: SUMMARY: Another day, another MFT (Managed File Transfer) product getting pwned. On the heels of the GoAnywhere MFT 0-day, this time, it’s a vendor called Progress Software Corporation and their product, “MOVEit Transfer,” that facilitates the transfer of files between business partners and their customers using a variety of protocols such as SSH and […]

· 4 min read
Rapid Response Research

Zyxel Vulnerabilities

Zyxel has had an interesting run the last few weeks, with three new vulnerabilities: CVE-2023-33009, CVE-2023-33010, and the most critical, CVE-2023-28771. The Mirai botnet is currently exploiting CVE-2023-28771. Censys found 24,457 potentially vulnerable Zyxel ATP, USG, and VPN products exposed to the internet. 86.72% of these hosts run the IKE protocol required for successful CVE-2023-28771 […]

· 4 min read
Research

Internet Footprint of SOHO Devices Exploited by Volt Typhoon

On May 24, 2023, Microsoft announced that they’d discovered “stealthy and targeted malicious activity” focused on communications critical infrastructure of the US and Guam. The attacks are attributed to a Chinese state-sponsored actor dubbed Volt Typhoon, who has been active since mid-2021. One of Volt Typhoon’s primary techniques is living off the land, which […]

· 1 min read
Cl0p Rapid Response Research

Months after first GoAnywhere MFT zero-day attacks, Censys still sees ~180 public admin panels

GoAnywhere MFT Breaches by high-profile ransomware groups have now affected 8 confirmed organizations (and counting) Executive Summary: Timeline: The Internet’s Response: We observe a slow and steady patch response to this actively exploited vulnerability. Since this zero-day was first disclosed, Censys has seen an approximate 46% decrease in the number of exposed GoAnywhere Admin Panels […]

· 4 min read
Research

Virtual Ghosts

These servers should not exist! Now Generally Available for all Censys customers is a new asset type, Web Entities. A “Web Entity” in Censys allows users to treat their web-based assets as a single high-level commodity, grouping hosts and services as part of an organization’s web service ecosystem. In addition to introducing this new data […]

· 12 min read
Adversary Infrastructure Censys Search

Revolutionize Network Reconnaissance with AI-Powered CensysGPT: Simplify Queries & Enhance Security

At Censys we pride ourselves on being innovators and encourage creativity, experimentation and collaboration amongst our team. During our 2023 Hackathon, we challenged our engineering team to develop ideas for new solutions that would improve our customer experience and make our product more accessible. Our integrations team rose to the challenge with an exciting […]

· 2 min read
External Attack Surface Management

Total Economic Impact™ : How Does Censys EASM Deliver Value to Customers?

Censys recently commissioned Forrester Consulting to conduct an independent study of the Total Economic Impact™ of the Censys External Attack Surface Management (EASM) solution. Learn more about what the study found and how to access your copy.  When you’re weighing the pros and cons of adding a new solution to your security tech stack, understanding […]

· 3 min read
Censys Search Internet Intelligence Threat Detection

5 Ways to Win Buy-In for Better Internet Intelligence

Internet intelligence is at the heart of any successful cybersecurity strategy. Whether you’re proactively searching for suspicious activity or reacting to a CVE that just dropped, you can’t do your job well without if you don’t have a full view into today’s evolving threat landscape. However, sometimes security teams and stakeholders within the organization aren’t […]

· 5 min read
Research

Four Oh Four: A Look at Our Favorite Status Code

Happy 404 day from Censys! Here are some fun stats involving our favorite “resource not found” HTTP status code! We’ve all experienced it: you’re leisurely browsing the web, surfing along, and suddenly come across this: 404 Page Not Found. When a user encounters a 404 error, it could mean that the user incorrectly entered the […]

· 1 min read

Spotlight: Women & Innovation at Censys

Women drive innovation across all areas at Censys, from engineering and product design, to research, marketing, and beyond. In celebration of Women’s History Month and our ongoing commitment to gender equality, we recently spoke with some of our incredible teammates about their work. Himaja Motheram | Security Researcher  What kinds of projects do you work […]

· 5 min read
Exposure Management External Attack Surface Management Mergers & Acquisitions

Before the Ink Dries: Assessing M&A Cyber Risk

Mergers and acquisitions may be common, but they’re not without risk, especially when it comes to cybersecurity risk. As cyberattacks increase in frequency and sophistication, the last thing any parent company wants to discover is that they’ve inherited mismanaged or unmanaged assets. Yet, assessing the scope of potential risk can be a tall order. An […]

· 4 min read
Research Threat Intelligence

ESXiArgs: History, Variants, and SLP!

Last week, we discovered two potential early victims of ESXiArgs (Host-A, Host-B) after noticing that they were the only two hosts with the ransom note on February 1 and January 31, 2023. Manually searching our data, we determined that they’d had a variant of the ransom note since mid-October 2022, but we were […]

· 5 min read
Adversary Infrastructure External Attack Surface Management Federal / Government

Why This European Government Agency Uses Attack Surface Management

Attack surface management (ASM) is becoming an integral, value-add strategy for cybersecurity teams across industries, including those in government. Our own partnerships with government agencies around the world highlight how ASM complements government threat hunting and response efforts. Teams use ASM tools like the Censys Attack Surface Management Platform to gain greater visibility into […]

· 2 min read
Censys Search Ransomware Rapid Response

Censys in the News: ESXiArgs Ransomware Coverage

The Censys research team has been closely monitoring the spread of ESXiArgs ransomware since it was first detected in early February. The team has used Censys internet scanning data to track infected hosts across countries, to monitor how the hacker group has since responded, and to develop a dashboard with Censys data that researchers […]

· 4 min read
Rapid Response Research

RCE Zero Day in GoAnywhere MFT [CVE-2023-0669]

The list of organizations who have come forward as victims of a GoAnywhere breach has grown long: Community Health Systems, Hatch Bank, Hitachi Energy, Rubrik, the City of Toronto, Procter & Gamble, Saks Fifth Avenue, and Crown Resorts. update 2023-03-17 Hitachi Energy has become the 3rd organization to report a data breach in its GoAnywhere […]

· 4 min read
Ransomware Research Threat Intelligence

The Evolution of ESXiArgs Ransomware

Mark Ellzey & Emily Austin Please see our new post, ESXiArgs: History, Variants, and SLP! for the latest updates. Executive Summary Over the last few days, Censys has observed just over 500 hosts newly infected with ESXiArgs ransomware, most of which are in France, Germany, the Netherlands, and the UK. During analysis, we discovered two […]

· 6 min read

This Week's Top Three Trends in Cybersecurity

The Censys research team has been tracking some of this year’s most significant vulnerabilities, and making headlines with their work in the process. Read more about three of the vulnerabilities the team has tracked using our internet intelligence data and find the latest on where things stand with each vulnerability’s risk remediation. ESXiArgs ransomware […]

· 4 min read
Ransomware Research Threat Intelligence

ESXWhy: A Look at ESXiArgs Ransomware

Emily Austin & Mark Ellzey UPDATE 2023-02-15 Please see our new post, The Evolution of ESXiArgs Ransomware, for further updates. UPDATE 2023-02-13 Over the weekend (2023-02-09 through 2023-02-11), we’ve seen a slight increase in the number of infected hosts, where at the time of writing, there were 1,994 hosts found in our search engine. We […]

· 7 min read
Adversary Infrastructure Threat Detection Threat Intelligence

6 Steps Threat Profilers Can Follow to Uncover Ransomware (and Other Nefarious Activity)

Ransomware attacks have dominated headlines in recent years, as attackers take aim at an increasing variety of targets, from school districts to critical infrastructure networks. Ransomware accounted for 25% of all breaches in 2022, according to the Verizon Data Breach Investigations Report, and in early 2022, CISA reported that it had observed incidents of ransomware […]

· 5 min read
Research Threat Intelligence

Tracking a SugarCRM Zero-Day

Update January 17th, 2023: SugarCRM had a third-party forensics firm validate that there was no intrusion to their cloud-based products due to this vulnerability. More information on that can be found here. Update January 11th, 2023: This issue is now being tracked as CVE-2023-22952 / Updated compromised tallies Update January 10th, 2023: SugarCRM is aware of […]

· 3 min read
Research

Using Censys to Find Misconfigured S3

Findings In under an hour using Censys data, we found 7,640 potential S3 buckets, 49 completely open (World Read + Write), 16 buckets with anonymous write, 1,235 with anonymous read access, and more. Finding S3 Targets With Censys Amazon S3 (Amazon Simple Storage Service) is a product that provides object storage over the web […]

· 3 min read
External Attack Surface Management Federal / Government

How a State Agency Automated Attack Surface Management in the Age of Remote Work

Soon after the Covid-19 pandemic hit, Censys partnered with a state agency that wanted to scale their risk management program by automating attack surface discovery and tracking. New challenges had emerged after their workforce moved to a remote working state. Key benefits By partnering with Censys, the state agency gained: The goals Manage attack surface […]

· 4 min read
Censys Search Rapid Response Research

Pulse Connect Secure: A View from the Internet

Pulse Connect Secure is a low-cost and widely-deployed SSL VPN solution for remote and mobile users. Over the years, researchers have found several significant vulnerabilities in the server software, some even resulting in the active exploitation of critical infrastructure by malicious threat actors. In April of 2021, CISA released a report detailing some of […]

· 14 min read
Attack Surface Management External Attack Surface Management Threat Intelligence

ProxyNotShell Proof Of Concept Now Public

Last week, a security researcher known as “Janggggg” published a proof of concept (PoC) exploit for the latest “ProxyNotShell” vulnerabilities in Microsoft Exchange that were discovered in September. ProxyNotShell is already confirmed to be actively exploited by a Chinese nation-state threat actor at the time of the vulnerability announcement by Microsoft. The attack was initially […]

· 3 min read
Adversary Infrastructure Censys Search Internet Intelligence

Here's How Citizen Lab Used Censys to Expose a Spyware Vendor

The Challenge: Spyware from Candiru was used to impersonate sites from well-known advocacy organizations to target activists and human rights workers. Citizen Lab, a research institute at the University of Toronto, used Censys data to understand impersonated sites, passing the details forward to Microsoft Threat Intelligence Center (MSTIC) to find exploits. What Citizen Lab achieved […]

· 5 min read
Finance

A Closer Look: Risks in Finance

As part of our State of the Internet Report blog series, we’re taking a closer look at findings from an industry perspective. Specifically, which risks were most commonly observed among sampled Finance and Insurance organizations? It goes without saying that maintaining good cybersecurity hygiene in the finance and insurance space is paramount– these organizations […]

· 4 min read
Rapid Response Research

Critical Vulnerability in OpenSSL!

Quick Links Censys Search Query for OpenSSL >=3.0.0 Censys ASM Inventory Query for OpenSSL >= 3.0.0 OpenSSL vendor vulnerability announcement. **Updates** 2022-11-01 Details of two high-severity vulnerabilities patched in OpenSSL version 3.0.7 are now available (CVE-2022-3786, CVE-2022-3602). Both are buffer overflows in the X.509 certificate verification process, “specifically in name constraint checking.”  The first, CVE-2022-3786, […]

· 6 min read
Attack Surface External Attack Surface Management Finance

How Swiss Life Gained Efficiency & Improved Workflow with Censys

As a financial company that deals in a critical aspect of their clients’ lives, Swiss Life attaches great importance to their corporate governance policies. In following with their procedures around international accounting, auditing, and a code of conduct to safeguard the interests of their shareholders, policyholders, and staff, Swiss Life wanted to better understand […]

· 4 min read
External Attack Surface Management Federal / Government

In Support of the New CISA Directive (What It Means & How to Take Action)

Earlier this month, the federal government’s Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks. The directive applies to all Federal Civilian Executive Branch systems and the agencies operating those systems. CISA states that their directive is an effort to make more measurable progress […]

· 4 min read
Cloud Security External Attack Surface Management

How Censys ASM Delivers ROI for an International Real Estate Company

When a public real estate company realized they lacked a comprehensive cloud inventory and found evidence of infection, they leveraged the Censys Attack Surface Management platform to gain greater visibility into all of their Internet-based assets. Since partnering with Censys, the company achieved a full view of their attack surface and generated significant ROI. Key […]

· 3 min read
Research

Databases. EXPOSED! (Redis)

Published on 09.19.2022 Part 1: Redis Takeaways There are 39,405 unauthenticated Redis services out of 350,675 total Redis services on the public internet. Almost 50% of unauthenticated Redis services on the internet show signs of an attempted compromise. Preface In this new series of posts, we decided to answer the question: “What is the state […]

· 13 min read
Attack Surface Attack Surface Management Cloud Security

Understanding the ASM Alphabet Soup

If you were at Black Hat this year, or if you’ve been doing your homework online on the Internet at all, you’ve probably terms like EASM, ASM, Exposure Management, Attack Surface, and the many other variations that seem to be coming out of the woodwork. Are these tools? Capabilities? Or just the latest marketing […]

· 5 min read
Ransomware Rapid Response Research

The Neverending Story of Deadbolt

Published on 09.10.2022 Introduction Deadbolt, a ransomware campaign haunting QNAP NAS customers for the last few months, has seen a consistent number of infections on a fairly regular cadence. But recently, Censys has observed a massive uptick in Deadbolt-infected QNAP devices. The Deadbolt crew is ramping up their operations, and the victim count is growing […]

· 5 min read
Threat Intelligence

C2: When Attackers Use Our Weapons Against Us

Super embarrassing when you’re hosting C2 infrastructure as a respectable enterprise, right? Or when the Red Team beats the Blue Team? Thanks to the popularization of Threat Intelligence, most organizations are aware of needing to block external connections to C2 infrastructure, but what happens when you’re the one hosting it? Sure, you can wait […]

· 5 min read
Censys Search Research

Finding Hacked Web Servers with Censys Search

According to the 2022 Verizon Data Breach Investigations Report, web servers are the top asset most commonly impacted in breaches. This is not surprising – after all, web servers often make up the bulk of an organization’s Internet-facing infrastructure, and therefore are more likely to be exposed than other types of digital assets. Finding hacked […]

· 8 min read
Attack Surface Management

Closing the Security Gap with ASM: Start with Complete Visibility

Information Technology (IT) and Information Security (IS) teams have a number of predetermined steps and workflows in place for threat detection and response. Unfortunately, these workflows are often limited by common factors and are not as seamless or effective as they could be with the right tools in place. In fact, many IS and IT […]

· 6 min read
Attack Surface Cloud Security External Attack Surface Management

Think Like an Attacker: The Importance of ASM in SaaS Cloud Security

Cyber attackers are crawling the Internet constantly, looking for any vulnerabilities to exploit within organizations’ Internet-facing and cloud assets. Organizations and their security teams implement cloud data protection solutions, but unknown — and unsecured — assets remain. How can companies prevent and protect from attacks in a comprehensive way? They need to think like an […]

· 5 min read

Assessing Attack Surface Security Risks: Adding the M to ASM

You’ve vetted attack surface management vendors and integrated the tools to have complete visibility into the Internet and cloud with the right attack surface management solution. This is an essential step in risk-based vulnerability management. Now that you have 360-degree visibility into your attack surface, however, it can be daunting to know where to start […]

· 6 min read
Attack Surface Management

Where ASM Fits: A Comparison Guide of Security Tools

Attack surface management (ASM) is an emerging space for information technology (IT) and information security (IS) teams. But there is a common misconception among teams that ASM is designed to replace your other security software. Rather, ASM integrates seamlessly within your security stack, empowering all solutions to better protect both known and unknown assets across […]

· 9 min read
Attack Surface Management External Attack Surface Management

Feature Release: Streamline Your Attack Surface Management with Automation and Discovery

Automation and quality data are key ingredients to any successful security program. Quality data in, means quality data out. Automation wherever possible means saving precious time for your security team. This is no different when it comes to External Attack Surface Management products. Today, Censys is excited to launch even more automation and visibility into […]

· 2 min read
Attack Surface Management External Attack Surface Management

The Must-Haves of an External Attack Surface Management Solution

External Attack Surface Management (EASM) is becoming a top priority for security leaders in 2022. Why? Digital transformations and rapid cloud adoption have challenged many of the traditional views of cybersecurity. Workforces and business operations have quickly decentralized, widening protection gaps and turning risk management of an organization on its head. Security teams, who were […]

· 7 min read
Attack Surface Management

Your Cybersecurity Tech Stack vs. Attack Surface Management

Here’s something you may already know – your attack surface has grown significantly in the past few years. There are many reasons this is the case. COVID forced many workplaces to go remote; the push towards digital transformation has encouraged companies to speed up their cloud adoption; and the frequency of mergers and acquisitions have […]

· 5 min read
External Attack Surface Management

Sprinting to Remediation with Attack Surface Management

As cybersecurity technology has become more sophisticated, so have threat actors and the tactics used to take advantage of digital weaknesses. The evolution of workplace structures and environments has complicated and magnified the need for advanced cybersecurity protocols. Meanwhile, external attack surfaces are growing and exposing organizations to a myriad of privacy and data risks. […]

· 5 min read
Attack Surface Attack Surface Management

The 3 Most Critical Requirements for Effective Attribution

Attack Surface ManAttack Surface Managementagement (ASM) is quickly emerging as a critical element of any digital security strategy. Within ASM, a technique called “Attribution” is foundational because it can automatically detect parts of an organization’s external attack surface that they didn’t realize even existed. And when attribution is automated and efficient, it can adapt to […]

· 4 min read
Rapid Response Research Threat Intelligence

Tracking Deadbolt Ransomware Across the Globe

Deadbolt, the ransomware attack that just won’t end, appears to be back for a third round. Our Rapid Response Team has been monitoring the QNAP vulnerability since it first appeared in late January 2022. A quick refresh on QNAP Deadbolt ransomware QNAP is a manufacturer of network-attached storage (NAS) devices. In January of this year, […]

· 2 min read
Attack Surface Management External Attack Surface Management Mergers & Acquisitions

The Top 5 Reasons Why You Should Run An Attack Surface Report Before Acquiring a Company

The days before announcing an acquisition are heady ones. Your functional diligence teams, along with lawyers, bankers and often consultants, are scrambling through mountains of information provided by the target, getting ready for a “go/no-go” scenario rivaling any NASA launch. The cybersecurity team is a relatively new but very important player in the process. But […]

· 7 min read
Ransomware Rapid Response

Deadbolt Ransomware is Back

Two months ago, in January of 2022, Censys reported on the spread of a new variant of ransomware dubbed Deadbolt. This ransomware targeted a series of network-attached storage devices (NAS) for consumers and small businesses running the QNAP QTS (Linux-based) operating system. What makes this particular variant unique is its communication with the victim. Instead […]

· 3 min read
Ransomware Rapid Response

The QNapping of QNAP Devices

Authors: Mark Ellzey, Aidan Holland, Ryan Lindner Updates: Introduction On Jan. 25, 2022, several media outlets reported a ransomware attack targeting the Network Attached Storage (NAS) vendor QNAP. The news circulated soon after QNAP released a warning statement pleading with customers to “fight ransomware together” by disabling features on consumer routers and the QNAP devices […]

· 3 min read

How to Identify Misconfigured and Unauthenticated Management Interfaces

When you imagine a sophisticated cyberattack, often events like zero-day exploits, custom rootkits, criminal organizations, and a knack for social engineering come to mind. However, more often than not, a sophisticated attack is a combination of technical experience, a whole lot of patience, persistence, and a spattering of pure luck. Essentially, finding a needle […]

· 6 min read
Research Threat Intelligence

GoCD Unauthenticated Takeover

On October 27, an engineer at SonarSource found that a change made in 2018 to the GoCD Continuous Integration system code completely removed the authentication logic for incoming requests destined to the service’s addon’s directory. It also seems that several addons, which are installed and enabled by default, had some bugs of their own. […]

· 2 min read

Censys Blue Team Series: How to Increase Network Alert Triage Efficiency with Censys ASM’s Outside-In Visibility

Issue: The mapping of external Network Address Translations (NATs) to internal infrastructure can be challenging for defenders. Oftentimes requiring complex data joins across multiple disparate logging resources. This gap of visibility presents itself when investigating threat signatures that hit external NATs and are routed to underlying infrastructure. In most cases just knowing if the underlying […]

· 3 min read
Research Threat Intelligence

VMware CVE-2021-22005 Technical & Impact analysis

Update 2 (2021-09-28) @wvuuuuuuuuuuuuu disclosed how to get execution using this API endpoint. The method simply requires writing to /etc/cron.d. Both the /dataapp and /hyper/send handler RCE PoCs are now fully public. Update 1 (2021-09-23, shortly after publishing) @testanull on Twitter claims that CEIP is not a requirement for execution, which implies there are multiple […]

· 8 min read
Research Vulnerabilities

Understanding the impact of OMIGOD (CVE-2021-38647)

Cloud security company wiz.io recently announced a series of vulnerabilities related to a component that is installed automatically on many Azure Linux virtual machines: The Microsoft Open Management Infrastructure (OMI) agent. One of these vulnerabilities is critical in nature, having a 9.6 CVSS score. The root cause of the vulnerability is a missing check […]

· 6 min read
Research

Hurricane Ida and Louisiana Infrastructure

By Derek Abdine and Mark Ellzey Introduction On August 29, a category four hurricane named Ida made landfall in Louisiana, where several news organizations reported winds of more than 150 miles per hour (241 km/h).  Hurricanes can do tremendous damage to utility infrastructures, such as power, cable, DSL/telephony, and fiber networking, creating catastrophic failures that […]

· 8 min read

New to ASM Platform: Dashboard, on-demand remediation validation and integrations

We are happy to announce a feature release that includes a new dashboard, on-demand remediation validation, and integrations for Jira and Tenable.sc for our Attack Surface Management (ASM) platform. The release and improvements came from prioritizing user experience and working customer feedback into development for the ASM platform. With the addition of these features, Censys […]

· 2 min read
Product News

Lightweight Protocol Scanning

Traditionally, Censys has focused on “deep” scans — scans which do a full analysis of the service behind them and break out key values into fields to be searched on later. Some protocols were captured by banner grabs of “UNKNOWN” services and were just untagged, making them searchable but not easily. For example, IRC servers […]

· 5 min read

1, 2, 3 Owned: New Microsoft Exchange Vulnerabilities

Chained vulnerabilities lead to remote command execution Authors: Mark Ellzey, Greg Gaylor  What is the Issue? The ProxyLogon vulnerabilities, publicly disclosed in March and discussed in our blog post Microsoft Exchange 0-day Vulnerabilities, have since been patched, but a similar Microsoft Exchange attack has been discovered. DEVCORE Researcher “Orange Tsai” published their findings of a […]

· 4 min read

Custom attribution for your attack surface using the Censys Python CLI

Censys has introduced a new add-seeds CLI command for the censys-python project that enables customers to automate adding seeds to their attack surface based on search terms from Censys Search. This is an extremely powerful means of customizing your attack surface. Finding unknowns is hard An organization’s attack surface can be complex. With hosts […]

· 3 min read

It’s Raining Buckets: The Importance of Cloud Storage Configurations

In 2017, a Verizon Wireless partner unintentionally misconfigured access controls for an Amazon S3 service, exposing an approximate 6 million records containing customer names, contact information, home addresses, account financials, and even account pins. Verizon was privately informed of the exposure on June 13th, 2017, and the misconfiguration was remediated on the 22nd. While […]

· 4 min read

What To Look For in an Attack Surface Management Solution

Your External Attack Surface Is More Important Than Ever In 2020, an estimated 73% of cybersecurity incidents involved external cloud assets, according to the Verizon Data Breach Investigations Report. The disappearance of network perimeters, rise of shadow IT, and exposure from small cloud misconfigurations have fundamentally changed how data breaches occur in practice and shifted […]

· 3 min read

Exposed Outlets: Don’t Let Attackers Turn You Off

Censys uncovered over 2,000 devices whose primary purpose is to manage and monitor a system’s electrical sockets remotely. In many cases, the only thing between a server’s physical off-button and a malicious user is a simple login form, and in a handful of cases, no authentication or security at all. As engineers, we often talk […]

· 4 min read

Quick Guide: Using New Search 2.0 to Identify SolarWinds Orion Infrastructure

This is a quick guide with translated query syntax for the new Censys Search 2.0 which is free for community users. The following queries help practitioners identify potential assets and other infrastructure associated with SolarWinds Orion. For more information about the SolarWinds incident and global impact, please see our detailed write-up here. 1. Find exposed […]

· 2 min read
Product News

Announcing New Cloud Security Offering within the Censys ASM Platform

“[On the cloud] what data lives where becomes a slightly different problem … the barrier to entry is so low. It is easy to spin up an instance or a windows VM in Azure … and it is important to have some visibility and governance, so you provide accountability for those things, relative to what […]

· 6 min read

5 Reasons Security Teams Should Be Investing in Attack Surface Management

There is a rapid transformation underway and that is the migration into the cloud. The traditional on-premise environment has been redefined as organizations migrate to cloud environments and the need for a remote workforce increases. To address these changes with an evolving security posture, organizations must start with the foundation — knowing what you need […]

· 6 min read

Solidarity with our Black Employees & Community

Daunte Wright Tragedy We would like to address the tragic news of the death of Daunte Wright at the hands of police in Brooklyn Center, MN. As a company, we do not condone police violence. We grieve for this loss, and for the pain and suffering of Mr. Wright’s family, friends and community. Mr. Wright’s […]

· 1 min read
External Attack Surface Management Mergers & Acquisitions

Mind the (Security) Gap: ASM as a Critical Function During Mergers & Acquisitions

An Overview A PWC report on global M&A trends for 2020 noted that the “pandemic and recent geopolitical developments have already led most companies to the same conclusions, pushing both deal volumes and values higher … particularly for digital and technology assets”.  In this blog, I will highlight key benefits of attack surface management when […]

· 6 min read
Research

More Critical RCE’s, Assessing the Impact of F5 Vulnerabilities

What is the issue? On March 10, 2021, a security advisory was released by F5 including 7 vulnerabilities, 4 of which are critical remote code execution vulnerabilities impacting all BIG-IP modules and a significant number of BIG-IQ products. On March 10, 2021, Censys identified 440,882 distinct hosts running BIG-IP products around the globe, indicating significant […]

· 2 min read
Research

Assessing VMware vCenter RCE Impact across the Globe

What’s the issue? Three vulnerabilities were recently released by VMware’s security advisory and impact vCenter Server or ESXi — CVE-2021-21972, CVE-2021-21973, CVE-2021-21974. Impacted Versions of vCenter: Impacted Versions of ESXi: However, CVE-2021-21972 is a critical remote code execution vulnerability according to Tenable. Using the data that powers our ASM Platform, the Censys team found  6,868 […]

· 4 min read

Moving Beyond the Noise by Filtering Internet Pseudo Services

About a year ago, Censys began scanning public IPv4 addresses on 2,000 ephemeral ports in addition to ports with popular IANA-assigned services. We’ve found that an astounding number of services run on unassigned ports. We also found that many protocols run on ports assigned to other services. In response, we’ve changed our approach to scanning […]

· 5 min read

A Guide to Assessing Your Shared Web Hosting Footprint

When walking customers and prospects through their attack surface, as discovered by the Censys Attack Surface Management (ASM) Platform, one of the biggest surprises tends to be the number of web hosting providers that are affiliated with their organization. Censys can help highlight both the knowns and unknowns of your web hosting footprint. Our research […]

· 4 min read
Research

Assessing Internet-wide Exposure to the SolarWinds Compromise

This blog post was last updated on: February 1, 2021 This will be the last blog update summarizing our visibility of Internet-facing Orion hosts from mid-December through January 2021. Censys has continued to update this blog with the purpose of understanding global trends and impact around Internet-facing Orion hosts. As of January 31, 2021, Censys […]

· 6 min read

Finding Non-Standard Port & Protocol Pairings with Censys ASM

Censys recently released the new Universal Internet DataSet. One of the most important benefits of the dataset is automatic protocol detection. Through this feature, Censys now provides more in-depth data about services running on non-standard ports. As 66% of the services we detect are running on non-standard ports, it’s increasingly important for threat hunters […]

· 4 min read

Our Customer and Community Approach to the SolarWinds Compromise

The SolarWinds Orion compromise has impacted potentially 18,000 customers worldwide, including government agencies and Fortune 500 companies. Censys currently sees 1,336 Orion hosts as of December 29, 2020. The top locations of these hosts are the following:. This is highly concerning due to the fact that these hosts should not be Internet-facing and could potentially be communicating with […]

· 2 min read

Making Attack Surface Management Easier with Python

Censys has deep roots in open source software, originating from the open source project, Zmap. Since then, Censys has continued to support open source projects and contribute to our public repositories which can be found here. One of our most popular open source projects is our censys-python library. The library was originally created for Censys […]

· 3 min read

Advanced Persistent Infrastructure Tracking

Using OSINT services for tracking malicious infrastructure Introduction Most cyber activity by malicious actors requires infrastructure like servers on the internet. The larger the campaign, the more servers are needed. Some APT groups used several thousand Command and Control (C2) servers over the years. For Threat Intelligence this offers unique opportunities for tracking such activities, […]

· 9 min read

Censys Launches Attack Surface Visibility Platform

Automatic Attack Surface Monitoring and Real-time Alerts Protect Against Attackers and Data Breaches ANN ARBOR, Mich. (10/31/19) — — Censys, Inc., the leading provider of continuous digital asset tracking and detection trusted by government departments like The U.S. Department of Homeland Security and over 25% of the Fortune 500 companies, today announced the launch of the […]

· 3 min read

SAP Vulnerability as Severe as it Gets - Time to Patch

Yesterday morning, we read the disclosure of CVE-2020-6287, named “RECON” (Remotely Exploitable Code On NetWeaver) by Onapsis Research Labs, which affects the latest versions of the SAP NetWeaver Java technology stack. Just how severe is RECON? This vulnerability has the maximum CVSS score of 10, indicating that it is quite severe. If an attacker can exploit […]

· 2 min read

Saltstack CVE: Keep Patching

Exposed Salt Servers: How Many Are Left 12 Days In? On May 1, Saltstack announced two critical vulnerabilities, CVE-2020-11651 and CVE-2020-11652. These vulnerabilities allow an attacker to bypass both authentication and authorization controls to effectively take over anything Saltstack is managing; this includes cloud infrastructure, servers, databases, and in some cases even user endpoints like laptops. […]

· 1 min read

Censys Releases Free One-Click Tool To Check Work-From-Home Security

“Home Network Risk Identifier” Finds Exposed Vulnerabilities in Seconds ANN ARBOR, Mich. (May 12, 2020) — Censys, Inc., the leading cybersecurity company trusted by government departments like the U.S. Department of Homeland Security and over 25% of the Fortune 500, today announced the release of a free security tool that allows work from home employees […]

· 2 min read

Critical Saltstack Vulnerability Patching

5 days in: Are people actually patching? A Censys Update Last week, Saltstack announced two critical vulnerabilities, CVE-2020-11651 and CVE-2020-11652. These vulnerabilities allow an attacker to bypass both authentication and authorization controls to effectively take over anything Saltstack is managing; this includes cloud infrastructure, servers, databases, and in some cases even user endpoints like laptops. The […]

· 1 min read

MAYDAY! It’s Time To Patch

Critical Saltstack CVEs Allow For Infrastructure Takeover This week Saltstack announced two critical vulnerabilities, CVE-2020-11651 and CVE-2020-11652. These vulnerabilities allow an attacker to bypass both authentication and authorization controls to effectively take over anything Saltstack is managing; this includes cloud infrastructure, servers, databases, and in some cases even user endpoints like laptops. While it’s not uncommon […]

· 3 min read

Tracking RoamingMantis - Mobile Banking Threat

Originally posted on April 1st, 2020 Let’s go threat hunting in Censys! In this case, we’re hunting for RoamingMantis, a mobile banking threat that affects users by altering local DNS settings for further endpoint abuse. DNS Changer malware isn’t new, but RoamingMantis is a new delivery vehicle. Via a tweet from a Japanese researcher @ninoseki, I started by looking […]

· 2 min read

New Censys Research Report Reveals Healthcare Industry at Greatest Risk of Data Breach

New Censys Research Report Reveals Healthcare Industry at Greatest Risk of Data Breach Report Examines State of Cloud Maturity & Security Risks of Largest Companies in Major Industries; Finds Exposed Databases and Exposed RDP Servers SAN FRANCISCO (Feb. 24, 2020) — Censys, the leading provider of attack surface management and security insights trusted by government departments […]

· 3 min read
Research

Probing the Xiongmai/HiSilicon SoC Vulnerability

News broke this week about a critical vulnerability in the firmware of certain HiSilicon-based devices running software from Xiongmai, including network video recorders, IP enabled cameras, and digital video recorders. HiSilicon is a “system on a chip” (or SoC) manufacturer, and some of its products are intended for use in IP-enabled video equipment. The vulnerability was uncovered by Vladislav […]

· 4 min read

Assessing January 2020's Windows Remote Desktop Web Access Vulnerabilities

This month’s Microsoft security bulletins got a lot of action with the “crypt.dll” ECC validation flaw (aka CurveBall aka ChainOfFools), but the Windows Remote Desktop Gateway (RD Gateway) ones – some remote code execution – warrant your immediate attention, specifically CVE-2020-0609 and CVE-2020-0610. What follows is my thought process of how I investigate these kinds of vulnerabilities with a system […]

· 2 min read

Universal Internet Dataset Gives 20x More Visibility Into IPs Running Torrenting Services

Censys recently released the Universal Internet Dataset, which increases the number of ports scanned from 40 to 1045.  This port coverage expansion provided far more visibility into the less visited areas of the internet. The services running on port 443, 80, and 21 provide valuable information, but are much more sterile compared to some of […]

· 2 min read

Finding Apache Tomcat Servers in Your Network

As hard as we try to forget the Equifax breach, it provides endless lessons for information security professionals and researchers. This was yet another case where security basics and good hygiene would have prevented the attack, or at least slowed it down. In the Equifax case, attackers gained access by exploiting a bug in an […]

· 4 min read

Another Critical Exim Flaw, and How to Determine if You’re Affected

Exim, the widely used, open-source mail transfer agent (MTA), released an urgent security update regarding Exim versions, up to and including 4.92.2.  The vulnerability (CVE-2019-16928) is a heap-based buffer overflow (memory corruption) issue in string_vformat defined in string.c file of the EHLO Command Handler component, allowing hackers to trigger a denial of service on a targeted […]

· 2 min read

Censys To Unveil Attack Surface Visibility Platform at Black Hat

New Enterprise Offering will Provide Automatic Attack Surface Monitoring and Real-time Alerts to Protect Against Attackers and Data Breaches LAS VEGAS — Censys, Inc., the leading provider of Internet security data trusted by the likes of Google and The US Department of Homeland Security, today from Black Hat USA 2019, announced the upcoming launch of its […]

· 3 min read

New MySQL-Related Default Insecurity Affects 7500+ Apps

Posted on August 21st, 2019 Allows for Authentication Bypass & Data Leaks This week, an anonymous researcher discovered and reported an issue with the SphinxSearch application used with MySQL databases: “TL;DR: SphinxSearch comes with a insecure default configuration that opens a listener on port 9306. No auth required. Connections using a mysql client are possible.” […]

· 2 min read

New! Search Censys for Prometheus Endpoints

We’ve recently added a new protocol to our IPv4 data sets that lets you easily search for exposed Prometheus endpoints. Since these applications can lead to data loss if not properly secured, it’s important to find any that are still are the Internet that you and your team are no longer using so you’re not […]

· 4 min read

New Protocol: Find Exposed Kubernetes Components

Posted on August 13th, 2019 Kubernetes (sometimes shortened to K8s) is an open-source container-orchestration system released in 2015 that’s commonly used for automating application deployment, scaling, and management. Kubernetes use is growing in popularity because it saves engineering teams time and work at scale. Since the technology is fairly new and the adoption is so […]

· 5 min read

Announcing Our Attack Surface Management Platform

We’re excited to announce that our new enterprise security platform is in limited, closed beta! We plan to make Censys Platform, our first SaaS product, available to everyone in Fall 2019. Today, we’re working with beta customers to create an automated, streamlined way for businesses to get global visibility about their attack surfaces. We’ve heard […]

· 5 min read

Discover Your Potentially Vulnerable SMB Servers

The Microsoft Server Message Block (SMB) protocol is mostly used for local network file sharing and access to remote services in many businesses who use Windows PCs in their environment. SMB is also a really good example of low-hanging fruit for attackers, because it’s a protocol used across many services and has a lengthy history of […]

· 2 min read

Around 1600 Sharepoint Servers Vulnerable to Attack

Update May 22, 2019 This is an enterprise only search, but querying Censys raw data, we find Sharepoint running on non-standard ports. We analyzed the raw server headers that we collect on our 1000 ports data and searched for the vulnerable version strings, and also the service name Microsoftsharepointteamservices. By including our 1000 port banner data in our […]

· 4 min read

Prevent Unnecessary Risk from pcAnywhere

Posted on May 21st, 2019 Originally released for Windows back in 1993, Symantec’s pcAnywhere enabled the user to access a host computer running pcAnywhere remotely. The concept of remote access makes sense from a usability standpoint, but it presents additional security challenges that we must contend with. Similar to the issues we reported with the remote […]

· 4 min read

How to Make Sure Your Elasticsearch Databases Aren’t Exposed

Most organizations that use Elasticsearch databases use it to store business and customer information. It’s popular for web applications because it allows for easy ingestion and search, making powerful applications easy to develop. Since they often contain a wealth of sensitive data, its critical that those servers be appropriately protected to prevent data leaks. In […]

· 4 min read

Hunting for Threats: Coinhive Cryptocurrency Miner

In this article, we’ll teach you how to think like threat hunters and use the open source tool YARA alongside Censys to find Coinhive, a cryptocurrency miner service. Created to help security analysts, YARA (now managed by VirusTotal) allows users to write complex rules/descriptions to identify and classify malware. Yara is flexible enough to let you iterate over HTML […]

· 5 min read

Update ASAP: Apache HTTP Web Server Patch Fixes Critical Security Issue

Apache HTTP Web Server users should update their servers immediately to prevent critical security flaws for cloud and shared web hosting providers. eWeek provided a great article detailing the critical flaw and how the update fixes it. We definitely recommend you read the full article, but the tl:dr is: Bob Rudis, Chief Data Scientist at Rapid7 […]

· 2 min read

Banners from Top 1,000 Ports Now Available to Enterprise Customers

Over the past year, we spoke with some of our most active customers to determine what other kinds data they would like to see from Censys. The most common request was loud and clear: Scan more ports! Historically, Censys has been known for providing application layer scans of every public IPv4 host across several dozen […]

· 1 min read

How to Find Servers Using MQTT and AMQP Protocols

Posted on March 19th, 2019 How to Find Servers Using MQTT and AMQP Protocols We recently added MQ Telemetry Transport (MQTT) and the Advanced Message Queuing Protocol (AMQP) protocols to our data set. Here’s a quick rundown of what these protocols are used for, what security risks they carry with them, how to search for […]

· 6 min read

Finding and Securing FTP Sites with Censys

Finding and Securing FTP Sites with Censys The File Transfer Protocol (FTP) is one of the most popular traditional methods of moving files from one computer to another. While FTP sites are useful for some businesses to send and receive files, for example designs or even customer data, they also quickly become an easy target […]

· 6 min read

Discover SSL/TLS Protocol in Use in Your Organization

The Internet is built upon its ability to allow devices to communicate with each other and, even back when it was first created, Internet pioneers were thinking about the need for security and privacy. As the Internet continued to grow, the need for “secure” encrypted conversations across the Internet emerged and certain cryptographic standards were […]

· 7 min read

17K Building Control (BACnet) Servers Connected to the Internet

2200+ Potentially Exposed to High Severity Vulnerability Building Automation and Control network (BACnet) is one of the most popular SCADA protocols that building automation and control systems use to operate. Censys searches for five of the most popular SCADA protocol (including Modbus, S7, BACnet, DNP3, Tridium Fox) and a quick search shows that there are 16,899 BACnet […]

· 7 min read

Hunting Mirai Control Servers Using Known Shell Scripts

The Mirai Botnet hit the Internet hard in late 2016, infecting hundreds of thousands of Internet of Things (IoT) devices and attacking several high-profile targets with distributed denial-of-service (DDoS) attacks. Effectively, the botnet made several popular sites like AirBnB, Twitter, Github, Reddit, Netflix, and many others inaccessible for most of the East coast, which led […]

· 4 min read

A Dream of the 90s - Bulletin Board Systems

Do you fondly recall the era where your enthusiasm regarding your Home PC’s modem was met with blank stares or possibly a comment like, “Your computer… has a phone in it?” It was a time before widespread adoption of the Internet, when communities of local Bulletin Board Systems ruled the day in all their ANSI-colored […]

· 4 min read

Playing Defense By Locating Pre-Attacks

Posted on February 5th, 2019 Business email compromise (BEC) caused by phishing attacks are nothing new but they’re still quite effective and require only minimal effort by adversaries. One example is the Anthem Blue Cross breach of 2015. After locating “scam email campaigns targeting current and former Anthem members,” the company sent out a public statement to […]

· 3 min read

The Most Common Protocol You’ve Never Heard Of

Posted on January 29th, 2019 Surprisingly, the most common service that we find in our scans at Censys is CPE WAN Management Protocol (CWMP) — a protocol that many folks have never heard of. CWMP, also known as TR-069, runs on TCP port 7547 using HTTP as an application layer protocol, allowing Internet service providers to […]

· 4 min read

Track & Monitor IPMI Devices

First, a bit of background about IPMI — how it came about and for what purpose, as well as the limitations and risks inherent in those devices. Nearly all modern servers ship with a secondary out-of-band management system that allows administrators to remotely perform basic monitoring and maintenance — even when the server’s operating system […]

· 2 min read

Magecart - Threat Hunting Edition

Magecart was the malware behind the British Airways and Ticketmaster data breaches a few years back and, unfortunately, it’s still alive and well. In fact, the latest victim appears to be OXO, a consumer household goods brand. Magecart injects malicious Javascript onto websites hosted from compromised servers. This Javascript runs in clients’ web browsers whenever they visit the website and skims […]

· 2 min read

Finding and Monitoring RDP and VNC with Censys

Over the holidays, we added data for remote desktop protocol (RDP) and virtual network computing (VNC) to Censys. Now you can search for any RDP or VNC clients that are online and tied to your organization and ensure that they’re locked down appropriately. These remote desktop instances are basically a front door to your organization […]

· 2 min read