Skip to main content

Censys Rapid Response

Discuss emerging threats identified by the Censys Rapid Response team

  • 3 Topics
  • 0 Replies
3 Topics
HimajaM_Censys
HimajaM_CensysCensys Team
posted in Censys Rapid Response
Measuring the Impact of the DigiCert DCV Bug

We recently dug into the DigiCert Domain Control Verification compliance issue to try and quantify its real-world impact and determine how many public-facing web entities are using an affected certificate. As of two days ago over 26,000 certificates are still active on public websites across ~3.5 million physical and virtual hosts -- although almost 99% of those certs have already been revoked. We also analyzed registered domains to identify the most impacted companies and industries. You can read more about our findings in our blog published yesterday: The DigiCert DCV Bug: Implications and Industry Impact. Organizations have until this Friday at 20:30 UTC to replace these certificates according to DigiCert.If you're looking to find affected certificates, you can use this Censys Search query: labels=digicert-revoked-dcv  and filter on your domains (by appending and services.tls.certificates.leaf_data.names=*.yourdomain.com). Keep in mind that results will continue to roll in over the

0
HimajaM_Censys
1 month ago
HimajaM_Censys
HimajaM_CensysCensys Team
posted in Censys Rapid Response
Rapid Response Advisory: Exim MTA Bug Could Allow Malicious Email Attachments (CVE-2024-39929)

 This week the Censys Rapid Response team published an advisory on the recently disclosed Exim vulnerability tracked as CVE-2024-39929.In Exim versions through 4.97.1, a bug in the parsing of multiline RFC 2231-encoded headers leads to incomplete parsing of attachment filenames. Remote actors could exploit this to bypass malicious file extension blocking measures and potentially send malicious attachments such as .exe executables undetected to users' email inboxes.This bug is concerning due to how widespread Exim is on public-facing mail servers. Censys identifies around 1.5 million Exim servers online that are potentially vulnerable to this exploit.However, exploiting this vulnerability alone is unlikely to fully compromise a server. Users need to actively click and execute attachments to trigger any embedded malicious code.Check out the post for more information. The team has provided the following Censys queries to track affected devices:Censys Search Query for Potentially Vulnerabl

0
HimajaM_Censys
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Rapid Response
Advisory: regreSSHion RCE Vulnerability in OpenSSH Server (CVE-2024-6387)

The Censys rapid response team has released its rapid response advisory on the recently disclosed RCE vulnerability in OpenSSH. Check out the post for full information on exploitation details and potential impact. The team has provided the following queries to use related to this vuln: Censys ASM Risk query: risks.name=”Vulnerable OpenSSH [CVE-2024-6387]” If you have any questions about this vuln or have suggestions for detecting with Censys, leave them here!

0
MattK_Censys
2 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings