1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services

Research on global Internet security posture found endpoints leaving Microsoft SMB file-sharing systems wide open online, a finding that explains the rapid spread of WannaCry, Rapid7 says.

More than one million global endpoints are exposed on the public Internet via Microsoft file-sharing services - 800,000 of which are confirmed Windows systems spanning nearly all product and release versions.
Security firm Rapid7 recently released its second annual National Exposure Index, which digs into Internet exposure around the world. Researchers scanned more than three billion IP addressable servers on the public Internet, and 30 ports on each device, for exposed services.
Researchers discovered 160 million devices (computers, servers, IoT products) had open ports exposed to the public Internet. Their results shed light on the rapid spread of WannaCry, the large-scale ransomware attack that hit global machines in May 2017, as well as exposure of Telnet ports and individual security exposure of countries around the world.
The study was conducted in March and April 2017, prior to WannaCry, explains chief data scientist Bob Rudis. The attack prompted researchers to a deeper dive and probe the Internet for any Microsoft servers running the SMB protocol that WannaCry exploited.
We found around 800,000 Windows systems on the Internet exposing SMB, says Rudis. A good chunk of those were susceptible, and are still susceptible, to WannaCry ransomware.
The file-sharing port 445, which enabled WannaCry, was actively sought out in May 2017. SMB port scan results increased by 17%, from 4.7 million to 5.5 million nodes, in that timeframe. Blocking port 445 would block attacks like this,
the report indicates
.
There were two themes throughout this research: the idea that broad Internet exposure makes an environment attractive to threat actors and accidental breaches; and the idea that technical leadership can protect users by reducing exposure.
Good News
More positive findings came from scanning port 23, or the Telnet port, which enabled the Mirai botnet that hit IoT devices in October 2016. Compromised devices were exposed on port 23, explains Rudis, and many IoT products use the same one.
Researchers predicted they would see less use of port 23 in 2017, which proved true. The Telnet scan returned nearly 10 million responsive nodes, a 33% drop from 14.8 million responses in 2016. This finding spans all devices and is a sign people are more frequently encrypting communication from their desktops and other endpoints.
[Mirai] had an impact and created visibility about the weakness of the IoT, Rudis explains. Its great that we saw a reduction in one of the worst ports on the Internet right now.
On a geographical level, researchers found the most exposed nations include Zimbabwe, Samoa, Hong Kong SAR, Romania, Ireland, Congo Republic, Tajikistan, Lithuania, Estonia, and Australia.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the
conference schedule
and
to register.

Belgium, the most exposed nation in 2016, cut the number of exposed services by 250,000 and fell off the top 50 ranking. The US has relatively low exposure in relation to its IPv4 space and isnt on the list of 50 most exposed nations.
Businesses should be aware of their exposure, especially as they move to the cloud and begin to do orchestration, says Rudis. Unfortunately, this isnt a very mature or robust space and there isnt much historical data on how to keep things secure on the Internet.
Security teams can start by being mindful of what theyre deploying, and only deploy things they intend to expose.
People should be watching what theyre deploying and watching their exposures out there, he continues. We look at these things, and were the good guys. It doesnt take a whole lot of effort for the bad guys to scan the Internet and look for these things, too.
Related Content:
Malware Incidents at US SMBs Spiked 165% in Q1
Microsoft Security Updates Include Windows XP, Server 2003
How End-User Devices Get Hacked: 8 Easy Ways
Relentless Attackers Try Over 100,000 Times Before They Breach a System

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services