Finding flaws in the system

State governments sometimes get a bad rap for not doing much to help their constituents protect their data. But in Missouri, there is a cybersecurity effort afoot to apprise organizations of the flaws in their computer systems that could lead to breaches and malfeasance.

The Missouri Office of Cyber Security (OCS) has been working on a “public data vulnerability program” for more than a year, where the state’s data security team scans the systems of companies, universities and other government agencies throughout Missouri for known vulnerabilities, according to state Chief Information Security Officer Michael Roling.

Partnering with the University of Michigan -- which in turn has been working with Google on an internet “indexer” dubbed Censys.io -- the state’s cybersecurity team has been able to scour the internet to find operating systems, devices, open ports and services at various organizations that contain long-standing vulnerabilities that could be exploited through a malware or attack. Roling’s team then notifies organizations about these discovered vulnerabilities, according to an interview with Roling at the recent ISC(2) Congress in Austin, where he discussed the program.

The Missouri OCS launched its first scan in May 2016, aimed specifically at finding organizations that might be using the once-popular but now out-of-date II6, the Windows Server 2003 web server, which often contains a well-documented and critical vulnerability. Microsoft ended support for its Windows Server 2003 in July 2015, and “no longer offers patches,” Roling pointed out. After working with experts at the University of Michigan to fine-tune their initial query, the Missouri OCS was able to effectively reach out and scan for this flaw at government and non-government networks alike throughout the state.

Given that this vulnerability sits in a common if outdated operating system, Roling admitted that he and his team expected to find at least some small and mid-sized enterprises in his state would still contain the vulnerability. But the results they uncovered were “eye-opening,” Roling told GCN.

The program was able to uncover more than 9,000 cases of this one common and long-known vulnerability at 177 organizations throughout Missouri, Roling pointed out. “While many of the 177 organizations involved were state, local and educational entities, quite a few of the hosts belonged to Fortune 500 companies,” Roling wrote in a June 2017 blog post outlining the results. “In spot-checking the data for accuracy, many of the hosts appeared to have been forgotten about or overlooked.”

Perhaps even more surprising was that identifying this major exploitable flaw on thousands of statewide enterprise systems was “the easy part,” Roling said. The more difficult part was identifying the appropriate contacts at these organizations and encouraging them to fix the flaws. The OCS took the raw data it had reviewed to find the vulnerable systems and cross-referenced it against the American Registry for Internet Numbers.  The gave OCS the contact information at all the organizations where vulnerable systems had been identified, and the agency sent out automated notifications explaining the program and listing the impacted systems, Roling said.

“The primary business goal of this program is to protect the critical infrastructure belonging to governments, businesses, utilities, and academic institutions across the state of Missouri,” Roling explained in the blog description of the program.

At first, Roling admitted, people at the affected organizations had a “mixed initial response,” with some welcoming the program and the information it provided, and others upset that their internal vulnerabilities were being pointed out to them. “Some of the reactions were even a little irate at first. That’s the initial human response when you’re told something bad,” Roling said. “But when we explained that this was not an audit or playing a game of ‘gotcha’ with them, the tone changed completely. They were happy with the actions we were taking.”

In the year since notifying affected Missouri organizations about their vulnerable servers, OCS has seen the number of Windows Server 2003 hosts drop by 16 percent at the affected organizations.

In early August 2016, OCS followed up its first effort by using the public data vulnerability program to identify devices accepting connections through telnet, “an antiquated protocol typically used for administration that offers no protection from eavesdroppers,” per Roling’s blog. Telnet does not encrypt the transmission of data or credentials, and it does not offer non-repudiation. Over the years, multiple critical vulnerabilities have been identified within common telnet daemons, and attackers can penetrate vulnerable telnet systems with distributed denial of service or remote code execution attacks. Missouri OCS identified and notified 161 entities -- which had a combined 10,300 telnet devices -- about the vulnerabilities, according to Roling.

Roling, who has worked for the state of Missouri for nearly 15 years, said the inspiration for the program came when he and his team heard how black hat hacker Andrew Auernheimer, known as “Weev,” early last year admitted to using a port scanner to find and hijack vulnerable internet-connected printers across the country and make them print out racist and anti-Semitic flyers. “He was able to identify all these open printer ports, all these vulnerabilities, Roling said. “We thought, ‘How could we do something similar, but for good?’”