In the ever-evolving landscape of cybersecurity, the battle against hackers is an ongoing war of wits. While zero-day vulnerabilities and advanced malware often grab the headlines, the simple yet insidious problem of exposed services remains a significant threat. These are the silent sentinels that can open the door to attackers, providing them with the keys to your digital kingdom. And as the Intruder team's analysis of 3,000 attack surfaces reveals, the problem is far from trivial.
The Hidden Attack Surface
What's striking is not just the prevalence of these exposures but also the fact that many of them are services that have no business being internet-facing. For instance, 60% of organizations had at least one HTTP panel exposed, which is like leaving the front door of your house wide open. Similarly, nearly half had a risky port or service exposed, and 42% had a database reachable directly from the internet. These are not just numbers; they represent potential entry points for hackers, who can exploit these vulnerabilities to gain unauthorized access, steal data, or even take control of systems.
The Top 10 Exposures
The ten most common exposures affecting organizations in the past 12 months are a sobering reminder of the most vulnerable areas. Databases dominate the top two spots, with MySQL and Postgres exposed in over a quarter of organizations. This is not surprising, given the history of opportunistic attackers targeting internet-facing databases. For instance, the PLEASEREADME ransomware campaign in 2020 compromised over 250,000 MySQL databases by brute-forcing weak credentials. Similarly, API documentation, which ranked third, can turn otherwise hard-to-find vulnerabilities into documented attack paths, making it a significant concern.
The Surprising and the Expected
What surprised me was the ranking of API documentation ahead of RDP (Remote Desktop Protocol). While some API docs are intentionally public, organizations frequently overlook documentation tied to private or admin-side APIs that were never meant to be discoverable. This oversight can turn a seemingly secure system into a honeypot for attackers. RDP, on the other hand, remains a concern given its history as an initial access vector in ransomware attacks. The BlueKeep vulnerability in 2019 left nearly a million systems immediately exploitable, and credential guessing against exposed RDP remains one of the most reliable ways ransomware operators get in.
The Legacy Services Problem
The remainder of the list, including SNMP, UPnP, NTP, and RPC, are legacy services designed for internal networks that were never meant to be internet-facing. These services, while essential for certain operations, can become significant attack vectors if not properly secured. For instance, SNMP (Simple Network Management Protocol) is often used for network management but can be exploited by attackers if not properly secured.
The Way Forward
Most teams treat patching as the priority, but for a lot of what's on this list, the better question is why these services are reachable at all. Attack surface reduction is where the focus should be, and for most organizations, it's not getting the same attention as vulnerability management. By addressing the underlying issues that make these services accessible, organizations can significantly reduce their attack surface and mitigate the risk of breaches.
In conclusion, while the Intruder team's findings highlight the prevalence of exposed services, they also offer a roadmap for improvement. By addressing the root causes of these exposures and implementing robust attack surface reduction strategies, organizations can fortify their defenses and protect their digital assets from the ever-present threat of hackers.
