Canada third most exposed country to possible cyber attacks, says vendor study

After hours of thankless work on their systems every day infosec pros in this country are among the best in securing their systems, right? Not according to a new report.

Canada ranks third on a list of worst countries whose organizations and users have unsecured Internet services open to cyber attacks, says a security vendor survey.

The National Exposure Index, released Thursday by Rapid7, rates the United States first and China second as the countries with the biggest exposure to likely attack, exposure to pervasive monitoring and exposure to amplification abuse.

After Canada comes South Korea, Great Britain, France, the Netherlands, Japan, Germany and Mexico.

Countries are ranked based in part on a scan of open ports to certain services (see below) relative to the number of allocated IPv4 addresses, So, for example, a country that has 1,000 computers and 100 per cent of them are exposing old versions of Windows SMB (server message block) it won’t score as high in the exposure rankings as a country with a million computers where only 10 per cent are exposing SMB.

There is also some weighing. A country with a higher percentage of exposed services in relation to its total allocated IP address space will tend to score higher. In addition, countries that have confirmed Microsoft SMB exposed to the internet are weighted even higher.

As a result Russia ranks 14th.

Among other findings:

• There are 13 million exposed endpoints associated with direct database access, half of which are associated with MySQL. Along with millions of exposed PostgreSQL, Oracle DB, Microsoft SQL Server, Redis, DB2, and MongoDB endpoints, this exposure presents significant risk of crucial data loss to a co-ordinated attack;
• While the number of exposed Microsoft SMB Servers dropped considerably after the WannaCry attack of 2017, there remain about a half a million targets today, primarily in the U.S., Taiwan, Japan, Russia, and Germany.
• Amplification-based distributed denial of service (DDoS-A) remains a powerful technique for harming enterprises and providing cover for more sophisticated attacks. While the number of exposed UDP-based memcached servers is less than 4,000, there are about 40,000 unpatched, out-of-date memcached servers, which are at risk of being drafted into the next record-breaking DDoS attack.

Memcached is an open source high-performance, distributed memory object caching system originally intended for use in speeding up dynamic web applications by alleviating database load. But in March hackers leveraged misconfigured or unprotected memcached servers to launch huge distributed denial of service (DDoS) attacks.

“Globally, we continue to see some disturbing trends in Internet exposure,” the report says, “the most significant being that even headline-grabbing attacks against inappropriate services such as Windows SMB, database services, and powerful amplification services are not enough to truly zero out their ongoing risk to attack and misuse. Even as there are engineering efforts to bolster the domain name system and bring it to modern levels of encryption and security, we still see millions of poorly maintained, misconfigured computers, ready to be abused by intelligence and espionage agencies, sophisticated criminal organizations, and casual, unsophisticated threat actors.”

Attack exposure was captured by looking for TCP/IP services that are wrongly open on the Internet such as Windows SMB (server message block), Remote Desktop Protocol, or HP JetDirect, as well as seven common database ports (such as MySQL, PostgreSQL, Oracle DB, Microsoft SQL Server).

Pervasive monitoring exposure was measured by presence of cleartext (unencrypted) protocols including telnet, FTP, IMAPv4, SIP on UDP port 5060, which can be used for man-in-the-middle attacks.

Amplification exposure to things that could be used in DDoS attacks measured the availability of  protocols such as memcached, SSDP and chargen,

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now