After hours of thankless work on their systems every day infosec pros in this country are among the best in securing their systems, right? Not according to a new report.
Canada ranks third on a list of worst countries whose organizations and users have unsecured Internet services open to cyber attacks, says a security vendor survey.
The National Exposure Index, released Thursday by Rapid7, rates the United States first and China second as the countries with the biggest exposure to likely attack, exposure to pervasive monitoring and exposure to amplification abuse.
After Canada comes South Korea, Great Britain, France, the Netherlands, Japan, Germany and Mexico.
Countries are ranked based in part on a scan of open ports to certain services (see below) relative to the number of allocated IPv4 addresses, So, for example, a country that has 1,000 computers and 100 per cent of them are exposing old versions of Windows SMB (server message block) it won’t score as high in the exposure rankings as a country with a million computers where only 10 per cent are exposing SMB.
There is also some weighing. A country with a higher percentage of exposed services in relation to its total allocated IP address space will tend to score higher. In addition, countries that have confirmed Microsoft SMB exposed to the internet are weighted even higher.
As a result Russia ranks 14th.
Among other findings:
• There are 13 million exposed endpoints associated with direct database access, half of which are associated with MySQL. Along with millions of exposed PostgreSQL, Oracle DB, Microsoft SQL Server, Redis, DB2, and MongoDB endpoints, this exposure presents significant risk of crucial data loss to a co-ordinated attack;
• While the number of exposed Microsoft SMB Servers dropped considerably after the WannaCry attack of 2017, there remain about a half a million targets today, primarily in the U.S., Taiwan, Japan, Russia, and Germany.
• Amplification-based distributed denial of service (DDoS-A) remains a powerful technique for harming enterprises and providing cover for more sophisticated attacks. While the number of exposed UDP-based memcached servers is less than 4,000, there are about 40,000 unpatched, out-of-date memcached servers, which are at risk of being drafted into the next record-breaking DDoS attack.
Memcached is an open source high-performance, distributed memory object caching system originally intended for use in speeding up dynamic web applications by alleviating database load. But in March hackers leveraged misconfigured or unprotected memcached servers to launch huge distributed denial of service (DDoS) attacks.
“Globally, we continue to see some disturbing trends in Internet exposure,” the report says, “the most significant being that even headline-grabbing attacks against inappropriate services such as Windows SMB, database services, and powerful amplification services are not enough to truly zero out their ongoing risk to attack and misuse. Even as there are engineering efforts to bolster the domain name system and bring it to modern levels of encryption and security, we still see millions of poorly maintained, misconfigured computers, ready to be abused by intelligence and espionage agencies, sophisticated criminal organizations, and casual, unsophisticated threat actors.”
Attack exposure was captured by looking for TCP/IP services that are wrongly open on the Internet such as Windows SMB (server message block), Remote Desktop Protocol, or HP JetDirect, as well as seven common database ports (such as MySQL, PostgreSQL, Oracle DB, Microsoft SQL Server).
Pervasive monitoring exposure was measured by presence of cleartext (unencrypted) protocols including telnet, FTP, IMAPv4, SIP on UDP port 5060, which can be used for man-in-the-middle attacks.
Amplification exposure to things that could be used in DDoS attacks measured the availability of protocols such as memcached, SSDP and chargen,