1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services

More than one million global endpoints are exposed on the public Internet via Microsoft file-sharing services - 800,000 of which are confirmed Windows systems spanning nearly all product and release versions.

Security firm Rapid7 recently released its second annual National Exposure Index, which digs into Internet exposure around the world. Researchers scanned more than three billion IP addressable servers on the public Internet, and 30 ports on each device, for exposed services.

Researchers discovered 160 million devices (computers, servers, IoT products) had open ports exposed to the public Internet. Their results shed light on the rapid spread of WannaCry, the large-scale ransomware attack that hit global machines in May 2017, as well as exposure of Telnet ports and individual security exposure of countries around the world.

The study was conducted in March and April 2017, prior to WannaCry, explains chief data scientist Bob Rudis. The attack prompted researchers to a deeper dive and probe the Internet for any Microsoft servers running the SMB protocol that WannaCry exploited.

"We found around 800,000 Windows systems on the Internet exposing SMB," says Rudis. "A good chunk of those were susceptible, and are still susceptible, to WannaCry ransomware."

The file-sharing port 445, which enabled WannaCry, was actively sought out in May 2017. SMB port scan results increased by 17%, from 4.7 million to 5.5 million nodes, in that timeframe. Blocking port 445 would block attacks like this, the report indicates.

There were two themes throughout this research: the idea that broad Internet exposure makes an environment attractive to threat actors and accidental breaches; and the idea that technical leadership can protect users by reducing exposure.

Good News

More positive findings came from scanning port 23, or the Telnet port, which enabled the Mirai botnet that hit IoT devices in October 2016. Compromised devices were exposed on port 23, explains Rudis, and many IoT products use the same one.

Researchers predicted they would see less use of port 23 in 2017, which proved true. The Telnet scan returned nearly 10 million responsive nodes, a 33% drop from 14.8 million responses in 2016. This finding spans all devices and is a sign people are more frequently encrypting communication from their desktops and other endpoints.

"[Mirai] had an impact and created visibility about the weakness of the IoT," Rudis explains. "It's great that we saw a reduction in one of the worst ports on the Internet right now."

On a geographical level, researchers found the most exposed nations include Zimbabwe, Samoa, Hong Kong SAR, Romania, Ireland, Congo Republic, Tajikistan, Lithuania, Estonia, and Australia.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Belgium, the most exposed nation in 2016, cut the number of exposed services by 250,000 and fell off the top 50 ranking. The US has relatively low exposure in relation to its IPv4 space and isn't on the list of 50 most exposed nations.

Businesses should be aware of their exposure, especially as they move to the cloud and begin to do orchestration, says Rudis. Unfortunately, this isn't a very mature or robust space and there isn't much historical data on how to keep things secure on the Internet.

Security teams can start by being mindful of what they're deploying, and only deploy things they intend to expose.

"People should be watching what they're deploying and watching their exposures out there," he continues. "We look at these things, and we're the good guys. It doesn't take a whole lot of effort for the bad guys to scan the Internet and look for these things, too."

Related Content: