Attackers are looking for openings.
They look for environments they can connect to, gather clues from responses, and work out which attacks could work.
Following the attacker’s decisions shows the openings you need to reduce.
Even if you are not high-profile, you can be found.
Access that broadly searches for exposed devices and services has been observed. In this kind of searching, environments reachable from outside become clues, regardless of whether the company is well known.
Attackers find targets that respond and make them candidates for investigating what is running.
Observation report on searches for exposed devices (in Japanese) ↗An illustrative diagram modeled on a scanning attacker. It is not an actual traffic record.
Piecing small bits of information together.
The software and versions in use. Test environments left behind. Admin screens that can be reached from outside.
Even information that looks unrelated gives attackers material to decide “where to look next.” They combine several clues to work out entry points and attack methods that might work.
Read about environments that slipped out of managementSoftware information appears in responses
The type and version can be seen
An old test environment remains
It may have slipped out of everyday management
The admin screen can be reached from outside
It becomes a target for further checks
that might work on this environment.
Probing for usable weaknesses.
What attackers want to know is not just the information itself.
From that information, they think about what they can try next.
Software type and version
Do published vulnerabilities apply to this environment?
Public files and admin screens
Is there a place to get information or somewhere to try connecting?
State of communications and certificates
Are the conditions in place for attacks on communications?
Email authentication settings
Is there protection against email claiming to be from this domain?
State of domains and DNS
Are there inconsistencies or gaps in settings or management?
Where there is an opening, the attempts continue.
Delayed updates or neglected environments are found. From there, the attacker thinks “there may be other openings too” and finds reason to look for other entry points and methods.
It gives them reason to keep searching and trying while changing entry points and methods.
Find an opening
Old software or neglected environments are visible.
Look further
Search other environments and entry points for usable openings.
Keep trying
Change entry points and methods, and keep probing for places to attack.
An example explaining the decisions of a scanning attacker.
Fewer openings mean fewer ways to attack.
Attackers are looking for entry points and conditions they can use. Update, stop exposing, restrict where connections can come from. Remediation can reduce the footholds and routes they were trying to use.
Vulnerability in an old version
Check whether a known problem can be used.
Unneeded test environment
Investigate an environment that slipped out of management.
Admin screen anyone can reach
A target for connection attempts.
Review the clues available from outside, such as versions and settings, one at a time.
Leave no openings to attack.
To avoid leaving a state that suggests “there are probably other openings here,” address the shortcomings you find one at a time. Review exposure, updates, and connection restrictions to make it harder for attackers to take their next step.
There are probably
other openings to use.
Look for the next entry point or method and keep trying.
Usable entry points and next clues
are hard to find.
It becomes harder to put together an attack and take the next step.
An illustration of what remediation means, seen from the attacker’s decisions.
Do not leave even small shortcomings unaddressed—check them and reduce them. Step by step, this reduces the reasons to keep attacking.
So where will you
start reviewing?
From checking what is exposed, to priorities, owners, and checking after remediation.