Exposed and Vulnerable: The Alarming Presence of Internet-Connected Devices in US Agencies

Risk Management: Hundreds of Devices With Internet-Exposed Management Interface Found in US Agencies

Introduction

Censys, an attack surface management firm, has identified a concerning vulnerability within US federal agencies’ networks. They have discovered hundreds of devices that have internet-exposed management interfaces, putting these agencies at risk of cyberattacks. The analysis conducted by Censys focused on more than 50 federal civilian executive branch organizations and sub-organizations, revealing over 13,000 distinct hosts across 100 autonomous systems. These findings highlight the urgent need for improved internet security measures and risk management protocols within government agencies.

The Scope of the Issue

Censys’ analysis specifically examined a subset of roughly 1,300 hosts that were accessible through IPv4 addresses. Within this subset, they found hundreds of devices that expose their management interfaces to the public internet. This issue falls within the scope of the Cybersecurity and Infrastructure Security Agency’s (CISA) Binding Operational Directive (BOD) 23-02, which aims to guide federal agencies in securing remotely accessible interfaces that are susceptible to malicious attacks.

CISA emphasizes the risk posed by threat actors, who specifically target devices that support network infrastructures. These threat actors exploit inadequate security measures, misconfigurations, and out-of-date software to gain unauthorized access to a network. The situation is further exacerbated when device management interfaces are directly connected to the public internet, heightening the risk of exploitation.

The devices that were searched for by Censys include access points, firewalls, routers, VPNs, and other remote server management appliances. The analysis revealed over 250 hosts with exposed interfaces running remote protocols such as SSH and Telnet. Among the devices identified were various Cisco network devices with exposed Adaptive Security Device Manager interfaces, enterprise Cradlepoint router interfaces that exposed wireless network details, and popular firewall solutions such as Fortinet Fortiguard and SonicWall appliances.

Additionally, Censys found exposed remote access protocols (FTP, SMB, NetBIOS, and SNMP), out-of-band remote server management devices, managed file transfer tools (including MOVEit, GoAnywhere, and SolarWinds Serv-U), HTTP services exposing directory listings, Nessus vulnerability scanning servers, physical Barracuda Email Security Gateway appliances, and more than 150 instances of end-of-life software. All these vulnerabilities have been targeted by threat actors in the past, leading to dire consequences for numerous organizations.

The Consequences of Vulnerabilities

The vulnerabilities identified by Censys have been exploited in several high-profile cyberattacks, demonstrating the seriousness of the issue. In particular, the SolarWinds, GoAnywhere, and MOVEit attacks have all taken advantage of vulnerabilities in devices that were targeted in Censys’ analysis. Additionally, Barracuda, Fortinet, SonicWall, and Cisco appliances have been frequent targets for malicious attacks.

These attacks have had far-reaching consequences, compromising the security and privacy of sensitive data held by the affected organizations. The potential for data breaches, intellectual property theft, and disruption of critical infrastructure highlights the urgency of addressing these vulnerabilities.

Recommendations for Government Agencies

In light of these findings, it is imperative for government agencies to take immediate action to enhance their internet security and risk management protocols. The following recommendations should be considered:

1. Implement Strong Security Measures

Government agencies should prioritize the implementation of robust security measures to protect their internet-exposed management interfaces. This includes ensuring that adequate security configurations and up-to-date software are in place to minimize vulnerabilities. Regular security audits and vulnerability assessments are essential to identify and address any weaknesses in the network infrastructure.

2. Follow CISA’s Binding Operational Directive (BOD) 23-02

Compliance with CISA’s BOD 23-02 is crucial for government agencies to mitigate the risks associated with internet-exposed management interfaces. This directive provides guidance on securing remotely accessible interfaces and offers best practices to prevent malicious attacks. Agencies should carefully review and implement the recommendations outlined in BOD 23-02 to protect their networks effectively.

3. Update and Patch Vulnerable Devices

Government agencies must promptly update and patch devices that are vulnerable to exploitation. This includes regularly monitoring for software updates and security patches released by device manufacturers and promptly applying them to prevent known vulnerabilities from being exploited.

4. Invest in Employee Training and Awareness

Human error can often lead to security breaches. Therefore, government agencies must prioritize ongoing employee training and awareness programs to educate staff on best practices for internet security. This includes training on how to detect and report potential cyber threats, as well as guidance on avoiding phishing attempts and practicing safe browsing habits.

5. Collaborate with Cybersecurity Experts

Government agencies should consider partnering with cybersecurity experts and conducting regular security audits to identify vulnerabilities and receive recommendations for improvement. Engaging with experts who specialize in risk management and attack surface management can provide valuable insights and help agencies stay ahead of emerging cyber threats.

Conclusion

The discovery of hundreds of devices with internet-exposed management interfaces within US federal agencies’ networks is a significant cause for concern. The vulnerabilities exposed by Censys’ analysis pose a serious risk to the security and integrity of sensitive data held by these agencies. Urgent action is needed to improve internet security measures and risk management protocols to safeguard against potential cyberattacks. By implementing robust security measures, following best practices outlined in CISA’s directives, and collaborating with cybersecurity experts, government agencies can strengthen their defenses and mitigate the risks associated with internet-exposed management interfaces.