One of the hot new security trends in 2021 is managing your attack surface. But how did this become a thing? Well simple, security trends are born out of hindsight. It is through forensic investigation and response that we learn what methodology a threat actor uses. Armed with this information, we identify how we can […]
Censys recently released the new Universal Internet DataSet. One of the most important benefits of the dataset is automatic protocol detection. Through this feature, Censys now provides more in-depth data about services running on non-standard ports. As 66% of the services we detect are running on non-standard ports, it’s increasingly important for threat hunters […]
Attack Surface Management (ASM) is the continuous process of discovery, inventory, prioritization, and resolution of risk impacting your Internet-facing assets. Organizations are constantly reshaping their Internet-facing attack surface, whether they know it or not. Services, and the data those services utilize, are being developed, deployed and re-configured across the Internet, many times a week. Whether […]
The SolarWinds Orion compromise has impacted potentially 18,000 customers worldwide, including government agencies and Fortune 500 companies. Censys currently sees 1,336 Orion hosts as of December 29, 2020. The top locations of these hosts are the following:. This is highly concerning due to the fact that these hosts should not be Internet-facing and could potentially be communicating with […]
Censys has deep roots in open source software, originating from the open source project, Zmap. Since then, Censys has continued to support open source projects and contribute to our public repositories which can be found here. One of our most popular open source projects is our censys-python library. The library was originally created for Censys […]
Using OSINT services for tracking malicious infrastructure Introduction Most cyber activity by malicious actors requires infrastructure like servers on the internet. The larger the campaign, the more servers are needed. Some APT groups used several thousand Command and Control (C2) servers over the years. For Threat Intelligence this offers unique opportunities for tracking such activities, […]
Automatic Attack Surface Monitoring and Real-time Alerts Protect Against Attackers and Data Breaches ANN ARBOR, Mich. (10/31/19) — — Censys, Inc., the leading provider of continuous digital asset tracking and detection trusted by government departments like The U.S. Department of Homeland Security and over 25% of the Fortune 500 companies, today announced the launch of the […]
Yesterday morning, we read the disclosure of CVE-2020-6287, named “RECON” (Remotely Exploitable Code On NetWeaver) by Onapsis Research Labs, which affects the latest versions of the SAP NetWeaver Java technology stack. Just how severe is RECON? This vulnerability has the maximum CVSS score of 10, indicating that it is quite severe. If an attacker can exploit […]
Exposed Salt Servers: How Many Are Left 12 Days In? On May 1, Saltstack announced two critical vulnerabilities, CVE-2020-11651 and CVE-2020-11652. These vulnerabilities allow an attacker to bypass both authentication and authorization controls to effectively take over anything Saltstack is managing; this includes cloud infrastructure, servers, databases, and in some cases even user endpoints like laptops. […]
“Home Network Risk Identifier” Finds Exposed Vulnerabilities in Seconds ANN ARBOR, Mich. (May 12, 2020) — Censys, Inc., the leading cybersecurity company trusted by government departments like the U.S. Department of Homeland Security and over 25% of the Fortune 500, today announced the release of a free security tool that allows work from home employees […]
5 days in: Are people actually patching? A Censys Update Last week, Saltstack announced two critical vulnerabilities, CVE-2020-11651 and CVE-2020-11652. These vulnerabilities allow an attacker to bypass both authentication and authorization controls to effectively take over anything Saltstack is managing; this includes cloud infrastructure, servers, databases, and in some cases even user endpoints like laptops. The […]
Critical Saltstack CVEs Allow For Infrastructure Takeover This week Saltstack announced two critical vulnerabilities, CVE-2020-11651 and CVE-2020-11652. These vulnerabilities allow an attacker to bypass both authentication and authorization controls to effectively take over anything Saltstack is managing; this includes cloud infrastructure, servers, databases, and in some cases even user endpoints like laptops. While it’s not uncommon […]
Have you ever Googled yourself? This is kind of like that, but, as with everything at the moment, we are looking at it with a COVID-19 lens. In March/April, nearly all of America’s non-essential workers up and walked out of their offices, many of them with their connected devices. In the same mass exodus, workers […]
Originally posted on April 1st, 2020 Let’s go threat hunting in Censys! In this case, we’re hunting for RoamingMantis, a mobile banking threat that affects users by altering local DNS settings for further endpoint abuse. DNS Changer malware isn’t new, but RoamingMantis is a new delivery vehicle. Via a tweet from a Japanese researcher @ninoseki, I started by looking […]
New Censys Research Report Reveals Healthcare Industry at Greatest Risk of Data Breach Report Examines State of Cloud Maturity & Security Risks of Largest Companies in Major Industries; Finds Exposed Databases and Exposed RDP Servers SAN FRANCISCO (Feb. 24, 2020) — Censys, the leading provider of attack surface management and security insights trusted by government departments […]
News broke this week about a critical vulnerability in the firmware of certain HiSilicon-based devices running software from Xiongmai, including network video recorders, IP enabled cameras, and digital video recorders. HiSilicon is a “system on a chip” (or SoC) manufacturer, and some of its products are intended for use in IP-enabled video equipment. The vulnerability was uncovered by Vladislav […]
This month’s Microsoft security bulletins got a lot of action with the “crypt.dll” ECC validation flaw (aka CurveBall aka ChainOfFools), but the Windows Remote Desktop Gateway (RD Gateway) ones – some remote code execution – warrant your immediate attention, specifically CVE-2020-0609 and CVE-2020-0610. What follows is my thought process of how I investigate these kinds of vulnerabilities with a system […]
Censys recently released the Universal Internet Dataset, which increases the number of ports scanned from 40 to 1045. This port coverage expansion provided far more visibility into the less visited areas of the internet. The services running on port 443, 80, and 21 provide valuable information, but are much more sterile compared to some of […]
As hard as we try to forget the Equifax breach, it provides endless lessons for information security professionals and researchers. This was yet another case where security basics and good hygiene would have prevented the attack, or at least slowed it down. In the Equifax case, attackers gained access by exploiting a bug in an […]
Exim, the widely used, open-source mail transfer agent (MTA), released an urgent security update regarding Exim versions, up to and including 4.92.2. The vulnerability (CVE-2019-16928) is a heap-based buffer overflow (memory corruption) issue in string_vformat defined in string.c file of the EHLO Command Handler component, allowing hackers to trigger a denial of service on a targeted […]
