Sponsored Analysis Warns Newly Exposed Assets Can Be Probed Within Minutes
Summary
A Sprocket Security-sponsored article describes how public assets may be scanned and probed soon after exposure, citing a study in which 80% of 320 honeypots were compromised within 24 hours and a company-reported unauthenticated API exposure.
Key points
- The article says automated scanners can discover newly public assets within an hour, followed by enumeration and active probing.
- It describes credential stuffing, directory brute-forcing, and probes for unauthenticated database access as examples of automated activity.
- A Unit 42 study deployed 320 honeypots; the article reports that 80% were compromised within 24 hours.
- Sprocket Security reports finding a public API reference in a website’s JavaScript bundle; its testers say the API required no credentials.
- According to Sprocket, testers accessed customer information, cleartext customer credentials, default device credentials, internal network information, and employee details.
- The article advocates continuous external attack surface discovery followed by human-led testing, while promoting Sprocket’s ASM product.
Article Details
- Topic
- The rapid discovery and probing of newly exposed internet-facing assets, and the role of continuous attack surface management in identifying unknown exposures.
MITRE ATT&CK
T1046 · Network Service DiscoveryAttackers enumerate exposed services and ports, including management ports such as RDP and SSH.T1110.004 · Credential StuffingThe article describes credential stuffing against SSH and RDP services.T1595.001 · Scanning IP BlocksAttackers are described as automatically sweeping the public internet to find newly exposed hosts.T1595.003 · Wordlist ScanningThe article describes directory brute-forcing against exposed web services.