CSIRT-IE Reports on Internet Accessible Protocols that should not be exposed in an uncontrolled manner.
Objective
CSIRT-IE primary focus, in regard to the following reports, is to report internet accessible protocols that should not be exposed in an uncontrolled manner. These internet accessible protocols may be exploited or abused to gain access to computer networks or systems. CSIRT-IE seek to identify internet accessible protocols emanting from the IP address ranges of the jurisdiction which are exposed in an uncontrolled manner, and to inform responsible network operators and constituents, based upon the IP address of the affected server or system, by email, and to provide advice and recommendations on how to reduce the threat posed by an internet accessible protocol exposed in an uncontrolled manner.
Source of Information
The Shadowserver Foundation is a Non-Governmental Organisation and one of the world's leading resources for internet security reporting and malicious activity investigation. The Shadowserver Foundation works with national governments, network providers, enterprises, financial and academic institutions, law enforcement agencies, and others, to reveal security vulnerabilities, expose malicious activity and help remediate victims. The Shadowserver Foundation performs a scan of the entire IPv4 internet every day for Internet accessible servers and services and reports the security vulnerabilities found. In 2022, the Shadowserver Foundation began to systematically rolling out IPv6 scanning of services. Information on the Shadowserver Foundation Reports and the data contain therein can be found at:- Shadowserver Foundation Reports
Event Severity Levels
On the 12th Oct 2023, the Shadowserver Foundation introduced a new system of categorising events in their reports called Event Severity Levels, making it possible for recipients of their reports to filter events based upon the severity of the actual event reported. The Shadowserver Foundation have also commenced applying a default severity level to their reports.
| No. | Level | Description |
|---|---|---|
| 1. | Critical. | Highly critical vulnerabilities that are being actively exploited, where failure to remediate poses a very high likelihood of compromise. For example, a pre-authorisation Remote Code Execution (RCE) or modification or leakage of sensitive data. |
| 2. | High. | End of life systems, systems that you can log into with authentication that are meant to be internal (SMB, RDP), some data can be leaked. Sinkhole events end up in this category. |
| 3. | Medium. | Risk that does not pose an immediate threat to the system but can over time escalate to a higher severity. For example, risk of participating in DDoS, unencrypted services requiring login, vulnerabilities requiring visibility into network traffic (Man-in-the-Middle (MITM) attack without being able to manipulate the traffic) to exploit, an attacker will need to know internal systems/infrastructure in order to exploit it. |
| 4. | Low. | Deviation from best practice - little to no practical way to exploit, but setup is not ideal. Vulnerabilities requiring MITM (including manipulating the traffic) to exploit. |
| 5. | Info. | Informational only. Typically no concerns. However, this category includes the Device Identification report, which may include information on device types that should not be accessible on the public Internet, in which case the individual events in the report may be assigned higher severity levels. Review in accordance with the organisation security policy. |