CSIRT-IE: Special Reports released by the Shadowserver Foundation
Objective
CSIRT-IE primary focus, in regard to the following Special Reports released by the Shadowserver Foundation, is to inform responsible network operators and constituents, based upon the IP address of the host(s) identified in the reports, for the reason stated in the reports, by email and to provide advice and recommendations on how to mitigate the reported vulnerabilities or possible malicious activity for which the reports were released. The Special Reports, while having a timestamp for a given date & time, do not cover a specific daily twenty four (24) hour time period, instead they are based upon a high value dataset.
Source of Information
The Shadowserver Foundation is a Non-Governmental Organisation and one of the world's leading resources for internet security reporting and malicious activity investigation. The Shadowserver Foundation works with national governments, network providers, enterprises, financial and academic institutions, law enforcement agencies, and others, to reveal security vulnerabilities, expose malicious activity and help remediate victims. The Shadowserver Foundation performs a scan of the entire IPv4 internet every day for Internet accessible servers and services and reports the security vulnerabilities found. In 2022, the Shadowserver Foundation began to systematically rolling out IPv6 scanning of services. Information on the Shadowserver Foundation Reports and the data contain therein can be found at:- Shadowserver Foundation Reports
Event Severity Levels
On the 12th Oct 2023, the Shadowserver Foundation introduced a new system of categorising events in their reports called Event Severity Levels, making it possible for recipients of their reports to filter events based upon the severity of the actual event reported. The Shadowserver Foundation have also commenced applying a default severity level to their reports.
| No. | Level | Description |
|---|---|---|
| 1. | Critical. | Highly critical vulnerabilities that are being actively exploited, where failure to remediate poses a very high likelihood of compromise. For example, a pre-authorisation Remote Code Execution (RCE) or modification or leakage of sensitive data. |
| 2. | High. | End of life systems, systems that you can log into with authentication that are meant to be internal (SMB, RDP), some data can be leaked. Sinkhole events end up in this category. |
| 3. | Medium. | Risk that does not pose an immediate threat to the system but can over time escalate to a higher severity. For example, risk of participating in DDoS, unencrypted services requiring login, vulnerabilities requiring visibility into network traffic (Man-in-the-Middle (MITM) attack without being able to manipulate the traffic) to exploit, an attacker will need to know internal systems/infrastructure in order to exploit it. |
| 4. | Low. | Deviation from best practice - little to no practical way to exploit, but setup is not ideal. Vulnerabilities requiring MITM (including manipulating the traffic) to exploit. |
| 5. | Info. | Informational only. Typically no concerns. However, this category includes the Device Identification report, which may include information on device types that should not be accessible on the public Internet, in which case the individual events in the report may be assigned higher severity levels. Review in accordance with the organisation security policy. |
Secure Information Sharing Sensor Delivery Event Network
The Secure Information Sharing Sensor Delivery Event Network seeks to improve the cyber security posture of EU organisations and citizens through the development of increased situational awareness and the effective sharing of actionable information.
Special Reports released by the Shadowserver Foundation
- Compromised-SSH Host Special Report
- Loop DoS Special Report
- Qlik-Sense Special Report
- SystemBC Historical Bot Infections Special Report