Here’s something you may already know – your attack surface has grown significantly in the past few years. There are many reasons this is the case. COVID forced many workplaces to go remote; the push towards digital transformation has encouraged companies to speed up their cloud adoption; and the frequency of mergers and acquisitions have […]
As cybersecurity technology has become more sophisticated, so have threat actors and the tactics used to take advantage of digital weaknesses. The evolution of workplace structures and environments has complicated and magnified the need for advanced cybersecurity protocols. Meanwhile, external attack surfaces are growing and exposing organizations to a myriad of privacy and data risks. […]
Attack Surface ManAttack Surface Managementagement (ASM) is quickly emerging as a critical element of any digital security strategy. Within ASM, a technique called “Attribution” is foundational because it can automatically detect parts of an organization’s external attack surface that they didn’t realize even existed. And when attribution is automated and efficient, it can adapt to […]
Deadbolt, the ransomware attack that just won’t end, appears to be back for a third round. Our Rapid Response Team has been monitoring the QNAP vulnerability since it first appeared in late January 2022. A quick refresh on QNAP Deadbolt ransomware QNAP is a manufacturer of network-attached storage (NAS) devices. In January of this year, […]
The days before announcing an acquisition are heady ones. Your functional diligence teams, along with lawyers, bankers and often consultants, are scrambling through mountains of information provided by the target, getting ready for a “go/no-go” scenario rivaling any NASA launch. The cybersecurity team is a relatively new but very important player in the process. But […]
On May 7, 2021, the FBI was “notified of a network disruption at Colonial Pipeline.” The public later learned, and the FBI confirmed, that this disruption was due to a ransomware attack perpetrated by the Russian-speaking DarkSide ransomware gang, based out of Eastern Europe. A look into the 2021 Colonial Pipeline ransomware attack This attack […]
In 2020, Capital One was fined $80 million when a cloud misconfiguration resulted in the theft of personal data from 106 million customers. In 2018, Amazon S3 (cloud storage service) was responsible for around 30% of all records exposed, which led to high-profile breaches of the U.S. Department of Defense, Dow Jones & Co., […]
Two months ago, in January of 2022, Censys reported on the spread of a new variant of ransomware dubbed Deadbolt. This ransomware targeted a series of network-attached storage devices (NAS) for consumers and small businesses running the QNAP QTS (Linux-based) operating system. What makes this particular variant unique is its communication with the victim. Instead […]
Black History Month (BHM), also known as African American History Month, is an annual celebration of achievements by Black Americans and a time for recognizing their experiences and contributions. Since 1976, every U.S. president has officially designated the month of February as Black History Month. Censys honored the month with events organized by the DandIE […]
Attack surface management was reviewed by Forrester in a recent report to help IT decision makers in security and risk management better understand its function and value as part of the modern security tech stack. It’s no secret that the market for cybersecurity solutions is overflowing with options. How can IT decision makers thoroughly understand which solution […]
Authors: Mark Ellzey, Aidan Holland, Ryan Lindner Updates: Introduction On Jan. 25, 2022, several media outlets reported a ransomware attack targeting the Network Attached Storage (NAS) vendor QNAP. The news circulated soon after QNAP released a warning statement pleading with customers to “fight ransomware together” by disabling features on consumer routers and the QNAP devices […]
When you imagine a sophisticated cyberattack, often events like zero-day exploits, custom rootkits, criminal organizations, and a knack for social engineering come to mind. However, more often than not, a sophisticated attack is a combination of technical experience, a whole lot of patience, persistence, and a spattering of pure luck. Essentially, finding a needle […]
Get organized and make your organization’s attack surface work for you and your priorities with Censys’ ASM feature, Workspaces. Attack surfaces are your company’s biggest (and most unwieldy) threat vector. It’s easy to understand why: Attack surfaces mirror the growth and complexity of companies as companies innovate and adapt to market forces. Cloud adoption, acquisition […]
On October 27, an engineer at SonarSource found that a change made in 2018 to the GoCD Continuous Integration system code completely removed the authentication logic for incoming requests destined to the service’s addon’s directory. It also seems that several addons, which are installed and enabled by default, had some bugs of their own. […]
Issue: The mapping of external Network Address Translations (NATs) to internal infrastructure can be challenging for defenders. Oftentimes requiring complex data joins across multiple disparate logging resources. This gap of visibility presents itself when investigating threat signatures that hit external NATs and are routed to underlying infrastructure. In most cases just knowing if the underlying […]
With the addition of 8 new protocols—bringing our total Operational Technology (OT) protocol count to 16–Censys now discovers more than 100,000 publicly accessible OT services. OT is defined as the systems used to manage industrial operations. This includes Industrial Control Systems (ICS) but also the software and devices used to manage ICS infrastructure. Many protocols […]
Update 2 (2021-09-28) @wvuuuuuuuuuuuuu disclosed how to get execution using this API endpoint. The method simply requires writing to /etc/cron.d. Both the /dataapp and /hyper/send handler RCE PoCs are now fully public. Update 1 (2021-09-23, shortly after publishing) @testanull on Twitter claims that CEIP is not a requirement for execution, which implies there are multiple […]
With new revelations like the Confluence code execution vulnerability, we are reminded how important immediate and accurate information about infrastructure is to security practitioners. Out-of-date software and exposed internal services are unfortunately common and can result in data loss and security breaches when vulnerabilities are uncovered. On-Demand Remediation Validation Now in the Censys ASM Platform, […]
Cloud security company wiz.io recently announced a series of vulnerabilities related to a component that is installed automatically on many Azure Linux virtual machines: The Microsoft Open Management Infrastructure (OMI) agent. One of these vulnerabilities is critical in nature, having a 9.6 CVSS score. The root cause of the vulnerability is a missing check […]
By Derek Abdine and Mark Ellzey Introduction On August 29, a category four hurricane named Ida made landfall in Louisiana, where several news organizations reported winds of more than 150 miles per hour (241 km/h). Hurricanes can do tremendous damage to utility infrastructures, such as power, cable, DSL/telephony, and fiber networking, creating catastrophic failures that […]
