Skip to main content

General security topics

Talk about general security topics, using Censys and other tools to discover and investigate potential threats, and more

21 Topics
MattK_Censys
MattK_CensysCensys Community Manager
posted in Security news
Explore the attack surface of industrial control systems in the 2024 State of the Internet Report

In their third annual State of the Internet Report, the Censys Research Team is back with fresh insights into the state of internet security and its implications for organizations and their security teams.This year, the team focuses specifically on the security of Industrial Control Systems (ICS) to understand the extent of exposures across these Internet-connected devices, many of which are relevant to critical infrastructure operations.Check out the report here. If you have any questions for the research team, feel free to ask them here!

190
MattK_Censys
12 days ago
AidanH_Censys
AidanH_CensysCensys Team
posted in Threat hunting
Join Censys and Greynoise for an in-person threat hunting workshop in Washington, DC!

Hey everyone! On October 29, 2024 we are holding an in-person threat hunting workshop in Washington, D.C. I want to extend an invite to the folks here in the Censys Community. The workshop will provide an opportunity to learn from industry experts and other Censys users through hands-on exercises and discussions, offering insights and strategies to get the most from your security technology. I will be leading the workshop alongside Andrew Morris from Greynoise. We will cover… Malicious Infrastructure Discovery and Fingerprinting Deceptive Services/Honeypot Detection If you work in the threat intel and response world, are a security engineer, or are more broadly in the cybersecurity analyst industry, this workshop will be perfect for you.You can request an invite to the event here. Hope to see you there!

390
AidanH_Censys
1 month ago
HimajaM_Censys
HimajaM_CensysCensys Team
posted in Other security topics
New: Censys Internet of Healthcare Things (IoHT) Research

Hi folks, We just published a report examining the most commonly exposed types of assets belonging to the Internet of Healthcare Things (IoHT) 🏥 in Censys data.Ransomware and data breaches in healthcare continue to rise, and effective exposure management in this sector is more critical than ever. Healthcare organizations often have sprawling, decentralized infrastructure and under-resourced IT departments, which create significant challenges.We examined the global external attack surface of publicly accessible medical devices and IoHT applications and found legacy protocols, unauthenticated medical image databases, and data platforms with histories of exploited vulnerabilities.You can read the full report here: https://censys.com/state-of-internet-of-healthcare-things/ 

150
HimajaM_Censys
1 month ago
FawnaT_Censys
FawnaT_CensysCensys Team
posted in Censys Rapid Response
Censys Rapid Response: Exposed DrayTek Vigor Routers - CVE-2024-41592

A total of 14 vulnerabilities affecting DrayTek Vigor routers were disclosed yesterday in a report by Forescout. The vulnerabilities were scored as follows: 2 critical severity, 9 high severity, and 3 medium severity. Most of these vulnerabilities are found in DrayTek VigorConnect, the web control interface for Vigor routers.Let’s examine the most severe vulnerability, CVE-2024-41592, which has been assigned the maximum CVSS score of 10.0. It’s a buffer overflow in the GetCGI() function of the VigorConnect Web UI that can be triggered by sending a specially crafted, excessively long query string to any of the CGI pages.When exploited individually, CVE-2024-41592 allows a threat actor to potentially cause a Denial of Service. However, if chained with CVE-2024-41585—the second-most severe vulnerability, which is an OS command injection flaw—it is possible to gain remote root access to the host operating system. This exploit chain only affects Vigor router models 3910 and 3912.If a router

930
FawnaT_Censys
2 months ago
R
Ronan_CensysCensys Team
posted in Censys Rapid Response
Censys Rapid Response: Vulns in the Common Unix Printing Service (CUPS)

BackgroundYesterday, September 26, after significant anticipation and dramatic drum rolling on social media, a series of vulnerabilities were disclosed in the Common Unix Printing Service (CUPS), a widely used printing utility found on many Linux distributions (specifically these ones, according to the original researcher’s writeup). These vulnerabilities are summarized below: Source: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/#SummaryThe most buzzy of these vulnerabilities is CVE-2024-47176, which affects cups-browsed. After a Red Hat security forum discussion, this was initially unofficially associated with a CVSS score of 9.9, but GitHub recently assigned it a score of 8.3 (High).Understanding CUPS and IPPCUPS is found on many Linux and other Unix systems for managing printing jobs and queues. It is used in conjunction with the Internet Printing Protocol (IPP) for network communication between computers and printers. IPP was designed to allow device

680
R
2 months ago
R
Ronan_CensysCensys Team
posted in Censys Rapid Response
Censys Rapid Response: CVE-2024-8963 [Ivanti Cloud Services Appliance (CSA) Path Traversal]

Date of Disclosure: September 19, 2024CVE-ID and CVSS Score: CVE-2024-8963 is a critical vulnerability with a CVSS score of 9.4.Issue Name and Description: Ivanti Cloud Services Appliance (CSA) If successfully exploited it allows a remote unauthenticated attacker to achieve restricted access. As noted in Ivanti’s security advisory, if chained with CVE-2024-8190 (OS command injection) an attacker can gain admin privileges and achieve RCE. Censys PerspectiveAt the time of writing, Censys observes 2,017 exposed Ivanti CSA instances online, mostly concentrated in the U.S. Note that not all of these are necessarily vulnerable – as specific device versions are not available. This vulnerability affects CSA versions 4.6.0 and earlier.To identify potentially exposed Ivanti Cloud Services Appliance instances, the following Censys queries can be used:Censys Search Query: services.http.response.html_title=`Ivanti(R) Cloud Services Appliance` Censys ASM Query: host.services.http.response.html_title

590
R
2 months ago
glennt
glenntNew Member
posted in Threat hunting
ICYMI: A mysterious and increasingly concerning phenomenon since January 2020: massive waves of spoofed traffic, known as “Noise Storms.”

We (GreyNoise) are investigating a long-standing mystery and reaching out to anyone who may have thoughts, theories, or insights! https://www.greynoise.io/blog/greynoise-reveals-new-internet-noise-storm-secret-messages-and-the-china-connection 

260
glennt
2 months ago
L
Lembright_CensysCensys Team
posted in Threat hunting
Analysis Uncovers Hidden Infrastructure of Iranian Fox Kitten Group

 “at the end of the day, it’s not actually computer-to-computer, right?” he said. “The technology is a vector for human beings. Behind the connection is a person." - Nate Fick,  US State’s ambassador for cyber.Using this mentality, and the fact that humans have patterns, I dug into IOCs from the Joint Cybersecurity Advisory on Iranian threat actor group “Fox Kitten” to uncover hosts that shared either identical IOCs or similar patterns (ports, software, certificates, DNS, etc) and therefore, are likely part of their infrastructure that wasn’t mentioned in the report. Check out the analysis here.Specifically, a search for domain IOCs from the Advisory yielded the following IPs with those IOCs in their DNS and certificate records. These IPs were not listed in the Advisory yet share Autonomous Systems/networks with host IOCs that are listed in the Advisory, further linking them to the group.“Host M” - 64.176.165[.]17 “Host N” - 70.34.218[.]77 “Host O” - 18.130.251[.]165What does this mean

691
MattK_Censys
2 months ago
M
MrTiTiNew Participant
asked in Threat hunting
Ogre Routing - Hunting for Nodes of Ogre Nodes

Hello! We are trying to map IPs in our address space to OGRE router nodes and TOR nodes. Do you know of any way to investigate this through Censys or do you know of any sources of information related to this?Here are some links on the subject of Ogre Routing, with some similarities to TOR Routing:-https://github.com/NthMetal/ogre-router/blob/master/README.md-https://github.com/NthMetal/ogre-router-server Thanks!

411
MattK_Censys
2 months ago
RachelH_Censys
RachelH_CensysCensys Team
posted in Other security topics
Manufacturing Use Case Queries for Search & ASM

Hi there! Censys recently published a blog about the prevalence of ransomware attacks on manufacturing firms, based on new research from GRF. Within the blog, our team included some manufacturing use case queries you can run in Censys Search and Censys ASM to identify and monitor relevant protocols, like those for building automation, PLC communication, HMI/SCADA, and more. Examples: Building Automation ProtocolsBACnetSearch Query: services.service_name:BACNET ASM Query: host.services.service_name:BACNETHMI/SCADARed Lion CrimsonSearch Query: services.service_name:REDLION_CRIMSON or services.software:(vendor=”Red Lion” and product=”Crimson”) ASM Query: host.services.service_name:REDLION_CRIMSON or host.services.software:(vendor=”Red Lion” and product=”Crimson”) You can check out the full article here: https://censys.com/top-targets-the-impact-of-ransomware-on-manufacturing/

90
RachelH_Censys
3 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Security news
Censys in the news: ICS research covered in Bloomberg

Some of the work our research team has conducted about industrial control systems (ICS) recently got some love in Bloomberg, check it out here!Our team has published an initial blog about the research on our site as well. There’s more we will be able to share about ICS infra later this year - stay tuned!

190
MattK_Censys
3 months ago
HimajaM_Censys
HimajaM_CensysCensys Team
posted in Censys Rapid Response
Measuring the Impact of the DigiCert DCV Bug

We recently dug into the DigiCert Domain Control Verification compliance issue to try and quantify its real-world impact and determine how many public-facing web entities are using an affected certificate. As of two days ago over 26,000 certificates are still active on public websites across ~3.5 million physical and virtual hosts -- although almost 99% of those certs have already been revoked. We also analyzed registered domains to identify the most impacted companies and industries. You can read more about our findings in our blog published yesterday: The DigiCert DCV Bug: Implications and Industry Impact. Organizations have until this Friday at 20:30 UTC to replace these certificates according to DigiCert.If you're looking to find affected certificates, you can use this Censys Search query: labels=digicert-revoked-dcv  and filter on your domains (by appending and services.tls.certificates.leaf_data.names=*.yourdomain.com). Keep in mind that results will continue to roll in over the

370
HimajaM_Censys
3 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Security news
New MOVEit auth bypass vulnerabilities and tracking MOVEit exposures over time

The Censys Research Team published an article yesterday about new auth bypass vulnerabilities affecting MOVEit Transfer and Gateway products, examining the state of exposed services roughly a year on from publication of a different SQL injection vulnerability associated with MOVEit Transfer.Check out the team’s dashboard exploring exposed MOVEit services over time here and learn more in the article here. The dashboard utilizes this Hosts Search query to identify exposed services: services.software.product: "MOVEit Transfer" and not labels: {tarpit, honeypot, truncated} If you have questions about this research, let us know and we’ll tag in the Censys team!

502
MattK_Censys
3 months ago
M
Matthew Embee ResearchNew Participant
posted in Threat hunting
Sharing Techniques For Hunting Open Directories

Hey All, I recently published a guide to hunting open directories alongside Censys.It dives into ways you can use queries to find open directories with Malware, and shows how you can find things like ransomware files and cobalt strike. If anyone has any questions or needs any guidance trying it out, feel free to post a comment and I’ll help out where I can :) https://censys.com/a-beginners-guide-to-hunting-open-directories/

1442
B
3 months ago
AidanH_Censys
AidanH_CensysCensys Team
posted in Threat hunting
Stumbling Upon XehookStealer C2 Instances

While reevaluating the VIPER C2 fingerprint after reading this topic. (Shout out @fopwn)  I started checking the logic of Agniane Stealer which could be discovered with the following query. services: (http.response.favicons.md5_hash="ef05ae61e6cfce0f261635b68bacd524" and http.response.body: "https://t.me/agniane") Historical Virtual Host - Running on Cloudflare We haven’t seen any Agniane Stealer in some time so I decided to look at hosts with the string "https://t[.]me/agniane" in the HTTP body. I got 11 results but none of them were labeled as Agniane Stealer.    However, only one was a raw host that wasn’t behind Cloudflare, 193.149.190[.]2.  Looking at the Markdown preview I am able to see there is a header “xehook.stealer” and the same Telegram channel /agniane. XehookStealer is a piece of known malware as a service infostealer that targets Windows systems. It also uses SmokeLoader binaries for distribution. It has overlapping code with Agniane Stealer, that I now confidently can

1422
B
3 months ago
F
fopwnNew Participant
posted in Threat hunting
Hunting VIPER C2 Instances on Censys

man viper-huntHey all, this just serves as a quick way to hunt down some VIPER C2 instances if this is something you’re interested in tracking. I’ve tweeted about this previously so this will be a recap/update with some new hosts. Hunt.io also has a really good blog on their site about hunting on their platform, but I posted my tweet two months before their article so… take that VC investors. IntroductionFor some background, VIPER C2 is a framework primarily used by Asian TAs and is rarely hosted in any NATO/FVEY countries. Using IP geolocation alone can already help narrow down some more interesting hosts to look at without the need for any deep pivoting. A notable APT that has historically used VIPER is NAIKON/Lotus Panda, especially in combination with Asset Reconnaissance Lighthouse. So, how can we track VIPER instances? Very easily, we abuse TA laziness. The Basic PathBased on the Hunt article and maybe some cursory manual glances, you could easily come up with a basic query based

3270
F
4 months ago
MorganP_Censys
MorganP_CensysCensys Team
posted in Security news
Recently Issued (probably not) Crowdstrike Certs 👀 🐟

https://search.censys.io/search?resource=certificates&q=crowdstrike+and+ct.entries.va[…]+and+not+parsed.issuer.organization%3D%60CrowdStrike+Inc.%60

851
MorganP_Censys
4 months ago
TheGift73
TheGift73New Participant
asked in Threat hunting
EASM Threat Hunting Best Practices

Hi,I was wondering what is the best way to start doing some External Attack Surface threat hunting for a specific organisation using Censys using the free community account type. Are there good way to start doing this whilst reducing any potential false positives, such as looking for a specific version of PHP seen on a server/machine rather than just PHP as a whole?

1021
MattK_Censys
4 months ago
HimajaM_Censys
HimajaM_CensysCensys Team
posted in Censys Rapid Response
Rapid Response Advisory: Exim MTA Bug Could Allow Malicious Email Attachments (CVE-2024-39929)

 This week the Censys Rapid Response team published an advisory on the recently disclosed Exim vulnerability tracked as CVE-2024-39929.In Exim versions through 4.97.1, a bug in the parsing of multiline RFC 2231-encoded headers leads to incomplete parsing of attachment filenames. Remote actors could exploit this to bypass malicious file extension blocking measures and potentially send malicious attachments such as .exe executables undetected to users' email inboxes.This bug is concerning due to how widespread Exim is on public-facing mail servers. Censys identifies around 1.5 million Exim servers online that are potentially vulnerable to this exploit.However, exploiting this vulnerability alone is unlikely to fully compromise a server. Users need to actively click and execute attachments to trigger any embedded malicious code.Check out the post for more information. The team has provided the following Censys queries to track affected devices:Censys Search Query for Potentially Vulnerabl

420
HimajaM_Censys
4 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Rapid Response
Advisory: regreSSHion RCE Vulnerability in OpenSSH Server (CVE-2024-6387)

The Censys rapid response team has released its rapid response advisory on the recently disclosed RCE vulnerability in OpenSSH. Check out the post for full information on exploitation details and potential impact. The team has provided the following queries to use related to this vuln: Censys ASM Risk query: risks.name=”Vulnerable OpenSSH [CVE-2024-6387]” If you have any questions about this vuln or have suggestions for detecting with Censys, leave them here!

280
MattK_Censys
5 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Other security topics
Tracking the TellYouThePass Ransomware Campaign

The recently disclosed CVE-2024-4577 PHP vulnerability has been rapidly weaponized by the TellYouThePass ransomware gang to breach servers and encrypt files since around June 7, 2024. Censys published a live dashboard tracking publicly exposed infected hosts, observing around 1,000 as of June 13, primarily geolocated in China. The Censys Research Team first wrote about this issue in an advisory published on June 10, 2024: https://censys.com/cve-2024-4577/. This latest blog expands upon the evolving exploitation of the vulnerability, the TellYouThePass campaign, and the team’s observations regarding compromised hosts. Read it here.

140
MattK_Censys
5 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us