General security topics

I am having trouble topping up my credits, I kept getting the error message "Verify your account information and payment method, then try again.". Can I get your team's help on this urgently?

Hello! I want add 100$ to my balance, but I can't pay with my CreditCard in United States, I see error "Transaction FailedVerify your account information and payment method, then try again."Please fix this or help me with top up! 

Can anyone recommend a search that I can use to check if I have any instances of NetWeaver in my environment?

If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for) in the new research team blog: https://censys.com/blog/the-persistent-threat-of-salt-typhoon-tracking-exposures-of-potentially-targeted-devices

Hello, I need to do a historical search of the open ports of one of our public IPs, I wanted to know if by buying Censys credits I can do this historical search and how far back I can go.Thanks

Last week, the Censys research team set out to test the existence of ICS protocols on port tweaks. Instead of picking one ICS protocol as a proof-of-concept analysis, we set out to investigate all of them. 🕵️ Read part 2 here.

merci pour le groupe censys

At Censys, our goal is to capture an accurate representation of the Internet at any given time. However, not only is the Internet large, but our investigations and prior research show that many of the services on the Internet do not respond on their standard port. While you would expect Modbus to be found only on port 502, the reality is that there is a plethora of Modbus on other, non-standard ports.Our research team put together a new blog about how we use independent measurement and research to verify where to scan in a more focused manner, concentrating on ICS protocols as a case study. You can check it out here. 

Recently, our cybersecurity system detected an IP owned by Censys trying to connect to our SMA on port 443.  Censys has lots of posts about SonicWall vulnerabilities recently.I'm wondering if Sonicwall has engaged with Censys for some sort of penetration testing? Or if Censys is just doing blanket pen tests on public IP addresses to find vulnerable Sonicwall products?

Good morning, We have been seeing intermittent failures with the Censys Search API all weekend, with a further stream of 500 failures this morning. A number of searches via the GUI are also returning 0 results.  We have checked the Censys status board, which does not suggest that there are availability issues with the API. Please can you investigate. 

In their third annual State of the Internet Report, the Censys Research Team is back with fresh insights into the state of internet security and its implications for organizations and their security teams.This year, the team focuses specifically on the security of Industrial Control Systems (ICS) to understand the extent of exposures across these Internet-connected devices, many of which are relevant to critical infrastructure operations.Check out the report here. If you have any questions for the research team, feel free to ask them here!

Hey everyone! On October 29, 2024 we are holding an in-person threat hunting workshop in Washington, D.C. I want to extend an invite to the folks here in the Censys Community. The workshop will provide an opportunity to learn from industry experts and other Censys users through hands-on exercises and discussions, offering insights and strategies to get the most from your security technology. I will be leading the workshop alongside Andrew Morris from Greynoise. We will cover… Malicious Infrastructure Discovery and Fingerprinting Deceptive Services/Honeypot Detection If you work in the threat intel and response world, are a security engineer, or are more broadly in the cybersecurity analyst industry, this workshop will be perfect for you.You can request an invite to the event here. Hope to see you there!

Hi folks, We just published a report examining the most commonly exposed types of assets belonging to the Internet of Healthcare Things (IoHT) 🏥 in Censys data.Ransomware and data breaches in healthcare continue to rise, and effective exposure management in this sector is more critical than ever. Healthcare organizations often have sprawling, decentralized infrastructure and under-resourced IT departments, which create significant challenges.We examined the global external attack surface of publicly accessible medical devices and IoHT applications and found legacy protocols, unauthenticated medical image databases, and data platforms with histories of exploited vulnerabilities.You can read the full report here: https://censys.com/state-of-internet-of-healthcare-things/ 

A total of 14 vulnerabilities affecting DrayTek Vigor routers were disclosed yesterday in a report by Forescout. The vulnerabilities were scored as follows: 2 critical severity, 9 high severity, and 3 medium severity. Most of these vulnerabilities are found in DrayTek VigorConnect, the web control interface for Vigor routers.Let’s examine the most severe vulnerability, CVE-2024-41592, which has been assigned the maximum CVSS score of 10.0. It’s a buffer overflow in the GetCGI() function of the VigorConnect Web UI that can be triggered by sending a specially crafted, excessively long query string to any of the CGI pages.When exploited individually, CVE-2024-41592 allows a threat actor to potentially cause a Denial of Service. However, if chained with CVE-2024-41585—the second-most severe vulnerability, which is an OS command injection flaw—it is possible to gain remote root access to the host operating system. This exploit chain only affects Vigor router models 3910 and 3912.If a router

BackgroundYesterday, September 26, after significant anticipation and dramatic drum rolling on social media, a series of vulnerabilities were disclosed in the Common Unix Printing Service (CUPS), a widely used printing utility found on many Linux distributions (specifically these ones, according to the original researcher’s writeup). These vulnerabilities are summarized below: Source: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/#SummaryThe most buzzy of these vulnerabilities is CVE-2024-47176, which affects cups-browsed. After a Red Hat security forum discussion, this was initially unofficially associated with a CVSS score of 9.9, but GitHub recently assigned it a score of 8.3 (High).Understanding CUPS and IPPCUPS is found on many Linux and other Unix systems for managing printing jobs and queues. It is used in conjunction with the Internet Printing Protocol (IPP) for network communication between computers and printers. IPP was designed to allow device

Date of Disclosure: September 19, 2024CVE-ID and CVSS Score: CVE-2024-8963 is a critical vulnerability with a CVSS score of 9.4.Issue Name and Description: Ivanti Cloud Services Appliance (CSA) If successfully exploited it allows a remote unauthenticated attacker to achieve restricted access. As noted in Ivanti’s security advisory, if chained with CVE-2024-8190 (OS command injection) an attacker can gain admin privileges and achieve RCE. Censys PerspectiveAt the time of writing, Censys observes 2,017 exposed Ivanti CSA instances online, mostly concentrated in the U.S. Note that not all of these are necessarily vulnerable – as specific device versions are not available. This vulnerability affects CSA versions 4.6.0 and earlier.To identify potentially exposed Ivanti Cloud Services Appliance instances, the following Censys queries can be used:Censys Search Query: services.http.response.html_title=`Ivanti(R) Cloud Services Appliance` Censys ASM Query: host.services.http.response.html_title

We (GreyNoise) are investigating a long-standing mystery and reaching out to anyone who may have thoughts, theories, or insights! https://www.greynoise.io/blog/greynoise-reveals-new-internet-noise-storm-secret-messages-and-the-china-connection 

 “at the end of the day, it’s not actually computer-to-computer, right?” he said. “The technology is a vector for human beings. Behind the connection is a person." - Nate Fick,  US State’s ambassador for cyber.Using this mentality, and the fact that humans have patterns, I dug into IOCs from the Joint Cybersecurity Advisory on Iranian threat actor group “Fox Kitten” to uncover hosts that shared either identical IOCs or similar patterns (ports, software, certificates, DNS, etc) and therefore, are likely part of their infrastructure that wasn’t mentioned in the report. Check out the analysis here.Specifically, a search for domain IOCs from the Advisory yielded the following IPs with those IOCs in their DNS and certificate records. These IPs were not listed in the Advisory yet share Autonomous Systems/networks with host IOCs that are listed in the Advisory, further linking them to the group.“Host M” - 64.176.165[.]17 “Host N” - 70.34.218[.]77 “Host O” - 18.130.251[.]165What does this mean

Hello! We are trying to map IPs in our address space to OGRE router nodes and TOR nodes. Do you know of any way to investigate this through Censys or do you know of any sources of information related to this?Here are some links on the subject of Ogre Routing, with some similarities to TOR Routing:-https://github.com/NthMetal/ogre-router/blob/master/README.md-https://github.com/NthMetal/ogre-router-server Thanks!

Hi there! Censys recently published a blog about the prevalence of ransomware attacks on manufacturing firms, based on new research from GRF. Within the blog, our team included some manufacturing use case queries you can run in Censys Search and Censys ASM to identify and monitor relevant protocols, like those for building automation, PLC communication, HMI/SCADA, and more. Examples: Building Automation ProtocolsBACnetSearch Query: services.service_name:BACNET ASM Query: host.services.service_name:BACNETHMI/SCADARed Lion CrimsonSearch Query: services.service_name:REDLION_CRIMSON or services.software:(vendor=”Red Lion” and product=”Crimson”) ASM Query: host.services.service_name:REDLION_CRIMSON or host.services.software:(vendor=”Red Lion” and product=”Crimson”) You can check out the full article here: https://censys.com/top-targets-the-impact-of-ransomware-on-manufacturing/

Some of the work our research team has conducted about industrial control systems (ICS) recently got some love in Bloomberg, check it out here!Our team has published an initial blog about the research on our site as well. There’s more we will be able to share about ICS infra later this year - stay tuned!

We recently dug into the DigiCert Domain Control Verification compliance issue to try and quantify its real-world impact and determine how many public-facing web entities are using an affected certificate. As of two days ago over 26,000 certificates are still active on public websites across ~3.5 million physical and virtual hosts -- although almost 99% of those certs have already been revoked. We also analyzed registered domains to identify the most impacted companies and industries. You can read more about our findings in our blog published yesterday: The DigiCert DCV Bug: Implications and Industry Impact. Organizations have until this Friday at 20:30 UTC to replace these certificates according to DigiCert.If you're looking to find affected certificates, you can use this Censys Search query: labels=digicert-revoked-dcv  and filter on your domains (by appending and services.tls.certificates.leaf_data.names=*.yourdomain.com). Keep in mind that results will continue to roll in over the

The Censys Research Team published an article yesterday about new auth bypass vulnerabilities affecting MOVEit Transfer and Gateway products, examining the state of exposed services roughly a year on from publication of a different SQL injection vulnerability associated with MOVEit Transfer.Check out the team’s dashboard exploring exposed MOVEit services over time here and learn more in the article here. The dashboard utilizes this Hosts Search query to identify exposed services: services.software.product: "MOVEit Transfer" and not labels: {tarpit, honeypot, truncated} If you have questions about this research, let us know and we’ll tag in the Censys team!

Hey All, I recently published a guide to hunting open directories alongside Censys.It dives into ways you can use queries to find open directories with Malware, and shows how you can find things like ransomware files and cobalt strike. If anyone has any questions or needs any guidance trying it out, feel free to post a comment and I’ll help out where I can :) https://censys.com/a-beginners-guide-to-hunting-open-directories/

While reevaluating the VIPER C2 fingerprint after reading this topic. (Shout out @fopwn)  I started checking the logic of Agniane Stealer which could be discovered with the following query. services: (http.response.favicons.md5_hash="ef05ae61e6cfce0f261635b68bacd524" and http.response.body: "https://t.me/agniane") Historical Virtual Host - Running on Cloudflare We haven’t seen any Agniane Stealer in some time so I decided to look at hosts with the string "https://t[.]me/agniane" in the HTTP body. I got 11 results but none of them were labeled as Agniane Stealer.    However, only one was a raw host that wasn’t behind Cloudflare, 193.149.190[.]2.  Looking at the Markdown preview I am able to see there is a header “xehook.stealer” and the same Telegram channel /agniane. XehookStealer is a piece of known malware as a service infostealer that targets Windows systems. It also uses SmokeLoader binaries for distribution. It has overlapping code with Agniane Stealer, that I now confidently can