Canada third most exposed country to possible cyber attacks, says vendor study

After hours of thankless work on their systems every day infosec pros in this country are among the best in securing their systems, right? Not according to a new report.

Canada ranks third on a list of worst countries whose organizations and users have unsecured Internet services open to cyber attacks, says a security vendor survey.

The National Exposure Index, released Thursday by Rapid7, rates the United States first and China second as the countries with the biggest exposure to likely attack, exposure to pervasive monitoring and exposure to amplification abuse.

After Canada comes South Korea, Great Britain, France, the Netherlands, Japan, Germany and Mexico.

Countries are ranked based in part on a scan of open ports to certain services (see below) relative to the number of allocated IPv4 addresses, So, for example, a country that has 1,000 computers and 100 per cent of them are exposing old versions of Windows SMB (server message block) it won’t score as high in the exposure rankings as a country with a million computers where only 10 per cent are exposing SMB.

There is also some weighing. A country with a higher percentage of exposed services in relation to its total allocated IP address space will tend to score higher. In addition, countries that have confirmed Microsoft SMB exposed to the internet are weighted even higher.

As a result Russia ranks 14th.

Among other findings:

• There are 13 million exposed endpoints associated with direct database access, half of which are associated with MySQL. Along with millions of exposed PostgreSQL, Oracle DB, Microsoft SQL Server, Redis, DB2, and MongoDB endpoints, this exposure presents significant risk of crucial data loss to a co-ordinated attack;
• While the number of exposed Microsoft SMB Servers dropped considerably after the WannaCry attack of 2017, there remain about a half a million targets today, primarily in the U.S., Taiwan, Japan, Russia, and Germany.
• Amplification-based distributed denial of service (DDoS-A) remains a powerful technique for harming enterprises and providing cover for more sophisticated attacks. While the number of exposed UDP-based memcached servers is less than 4,000, there are about 40,000 unpatched, out-of-date memcached servers, which are at risk of being drafted into the next record-breaking DDoS attack.

Memcached is an open source high-performance, distributed memory object caching system originally intended for use in speeding up dynamic web applications by alleviating database load. But in March hackers leveraged misconfigured or unprotected memcached servers to launch huge distributed denial of service (DDoS) attacks.