Skip to content

Code security and safety tips when writing guidelines

Better safe than sorry! That is my motto and the motto of any person practicing web application security!

Preventing cyber-attacks starts at the very beginning of the development of the application by writing secure code.

Following secure coding standards helps developers to prevent common vulnerabilities in the code. Secure coding standards are a set of best practices and guidelines.

It is essential to have secure code standard implementation from the beginning because it will reduce future costs resulting from an exploit or the leak of sensitive data.

In this article, I wrote some practical tips you can use when creating your security code guideline for a simple web application. 

When creating the guideline, it is best to check out as much eligible documentation on the internet about the secure code topic. The complexity of the guideline will, of course, depend on your web application’s complexity and requirements.

You can check out these links: OWASP guidelines and/or OWASP Security Knowledge Framework, SEI CERT, Microsoft-Writing Secured Code, and many more. 

I would divide this topic into two parts. One would be about choosing a framework and programming language for your application, and the second would be error handling, logging, and monitoring.  

As for the second part, you can check out the Error handling article I wrote. And I will not cover logging and monitoring topics because I plan to cover them in my future articles. After all, they are essential topics that would need special attention.

 

Selecting a framework for the application

There are two cases when you would need to choose the framework and programming language: when starting development of the application and when rewriting the application.

When starting to plan the application development and choosing the framework, this decision is often based on the experience of the team who will work on the product. 

The final decision is often to use some old framework because of developers’ lack of knowledge and time to learn a new one. Also, when choosing an old framework, its vulnerabilities are not checked. 

I will not focus on that case because the management team probably made a decision. I will focus on developers’ decisions, and I will mention that you should choose the framework that is the latest one or one of the latest. That would be the best practice because you will not need to migrate when you have a lot of source code already written. You will have the support of the new framework because it will not be deprecated (that is good because the framework will be tested for the latest vulnerabilities, and new updates with patches will be available). You will be in sync with the technologies!

If you have some older web applications, you can scan them with SCA tools and find all older versions if they have security vulnerabilities. You can check out one article which compares Software Composition Analysis Tools in 2022. This approach will help you with the migrations. You can create a grid of all insecure versions of SCA (Software Composition Analysis) found and suggest the newer versions without vulnerabilities. SCA tools should also be used to scan the repository weekly and in your pipeline on every build.

All frameworks have integrated security features, and it is important to check them out to see if they cover all the security features you want in your product. And keep in mind that by using fewer types of technologies, frameworks, languages, libraries, components, etc., you are reducing the maintenance of systems and the attack surface, which is always good. 

 

List of security steps

 

Handling of data

  • Validate input: type, size, format, source.

  • Verification is performed on the server side. If the input is invalid, reject it and give the user an error message with a description of what you expect.

  • If you must accept special characters, you must escape them.

  • If an input triggers some CRUD operations such as add, delete, update, verify this is not a CSRF attack by checking the token, captcha, or some other re-authentication

  • If the input is presented to the user, input needs to be output encoded.

  • If the input is part of the query in the DB, use parametrized queries. So, use parameterized queries (place input in them) with stored procedures to prevent DB injection attacks.

  • If you need redirection to a different site in the app, create a list of pre-approved links and check the link when redirecting

 

HTTP verbs

Most web applications only use GET, POST, OPTIONS, and HEAD. All unused are unrequired and should be disabled to reduce the attack surface.

For more info on how to disable dangerous HTTP methods, you can check out this link.

 

Identity

 

You should never create your own system for identity. Always buy a pre-made system unless you have unique business requirements that force you to create your own—in which case, use a well-established protocol such as OAuth. If it is a system within a network, you can use the most common network identity system, Active Directory. Many other identity systems on the market can also perform this functionality, such as some public cloud providers.

 

Session management

 

If your chosen programming framework has session management features, use them. Do not write your own from scratch.  

  • Session IDs should be at least 128 characters long.

  • Use unpredictable IDs.

  • Use the built-in session management implementation in your framework,

  • The session ID should have an expiration date and/or time.

  • The session ID should only be passed over encrypted channels.

  • The session should be destroyed after a user logs out.

  • Web applications must never accept a session ID they have never generated. 

I already covered all the best practices in session management series parts one and two. Check them out!

 

Memory safe code

 

If you are using a programming language that is not memory safe:

  • Migrate to the new memory-safe language. The Rust programming language is an example of a memory-safe alternative to C and C++. Examples of memory-safe languages include Java, .Net (VB and C#), and Ruby on Rails.

  • Perform bounds and type-checking on every input every single time.

  • If your language has a framework overlay available or dependency you can add that can test bounds for you, use it.

  • Create unit tests for your bounds checking to make a regressive testing system run on every new code check-in.

  • Perform a code review and verify every input has proper testing.

  • If available, add compilation options to detect these types of issues.

 

Authentication

You shouldn’t write your own authentication system from scratch. A lone software developer on a project team should always use existing tried-and-true systems. That system can be eighter pre-existing internet identity online service from a third party to verify your users or a free library or software system to become part of your system to perform the identity functionality for you.

 

Authorization

 

Role Based Access Control, or RBAC for short is the most popular methodology for determining access. It means “determine someone’s access based on the role assigned in your system.”

 

There are three other widely accepted access control models:

  • Discretionary Access Control (DAC)

  • Mandatory Access Control (MAC)

  • Permission Based Access Control (PBAC)

 

Based on the requirement of the system, you would choose the access control model.

 

Conclusion

I hope I have given you some direction on creating your own secure coding standard. There are plenty of tips on best practices on the internet regarding secure coding, so you should gather as much as possible before developing your own model. 

You should take initiative to create your secure coding standard and if it was not required to explain to others why it is important to have one.

Cover photo by Matthew Waring

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

How we won over hackers

At the beginning of October, our company faced a serious hacker attack.To ensure the operability of our services for all of our clients all around the world, we have several nodes – in different data centers across the globe. It was one of these nodes that was attacked and completely disabled.

How is this possible? All of our servers are well protected and accept management requests only from addresses known to us, and the authentication by username and password is generally prohibited, which makes it impossible to log on using brute force or a directory attack. However, this attack turned out to be successful. The reason is that the hackers were not trying to get access to our system, they got access to the hardware. They used vulnerabilities in the Supermicro software, a US manufacturer of server motherboards. It is a very large and well known manufacturer of server hardware with a good reputation. For the sake of convenience of remote server administration, the manufacturer has a hardware and software complex called “Supermicro IPMI”, which allows you to remotely connect to the I / O system of the motherboard and thus directly control the hardware. Naturally, it provides protection against unauthorized access. However, several critical vulnerabilities have been discovered in recent years. Access to this utility on all our servers is also restricted to addresses known to us. However, on one single server, due to uncoordinated actions of the technical support of the data center, no such restrictions were set. Due to this set of circumstances (lack of access restrictions and presence of vulnerabilities) intruders were able to get access to our equipment.

What were the consequences? As a result of malefactors’ actions all the information on one of the servers was destroyed. But it didn’t affect our clients in any way. The load of serving our customers was taken by neighboring nodes. No customer data was stolen (it was never there), no customer statistics or settings were lost, since they were copied on all other nodes. After a few days the situation was completely normalized: we examined the problem, restored the functionality of the node and ensured its further security.

But why were we attacked? Most likely, because we have some data to steal. Just like any other company, large or small, IT-related or not at all. Bear this in mind when you underestimate a hacker’s interest in your data.

In any case, the hackers did not manage to do any damage to our clients and no tangible damage to ourselves. However, it certainly added to our experience. Usually, everyone keeps a close eye on vulnerabilities in the OS, software code, libraries used, and so on. Rarely does anyone think about the fact that it is important to keep an eye on updating the motherboard firmware (BIOS) or its individual components (IPMI) for security in general. Especially since technically it is quite a complicated process. Hopefully, our story has reminded you to do both.

To prevent yourself & your company from similar cases, trust SafeDNS to provide you with DNS Security. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Monitor Sensitive Assets Using “Read Only” Agent Mode

Starting from agent version 4.1.1 , you can set the Topia agent to run in “Read Only” mode. This will ensure that your sensitive assets will not receive any changes and/or updates initiated from the Topia dashboard. For more information, please refer to https://customer-portal.vicarius.io/read-only-agent.

Please note that agent 4.1.1 was not released to all customers. Please contact support if you wish to receive Topia agent right away.

#topia_updates

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Back Disk Encryption

Intro

 

I will go over what is disk encryption, why you should care about it, what are some of the implementations, attacks, as well as what options you can choose from aside from Bitlocker/Filevault.

 

What is disk encryption

 

You know this already, but I will mention it, nonetheless as a sanity check of sorts.

Disk encryption is protection of a logical part of a disk such as a folder and/or partition, or a whole disk with the use of cryptography.

That Disk can be internal or external, a USB flash drive, an SD card, a DVD/CD, an ISO image, and most storage mediums/filesystems/blobs, etc.

 

Software Disk Encryption

 

Disk encryption can be implemented with software. Some of those solutions include:

And many more.

 

Hardware Disk Encryption

 

Disk encryption can also be implemented in hardware. This is usually implemented in modern SSDs and is called self-encrypting drives a.k.a. SEDs.

 

Whole disk encryption

 

Important thing to note here is that this type of encryption encompasses the whole OS and files/data. Even though the name implies that all of the bits found on that disk are encrypted, this is not necessarily true in all cases.

It mostly won’t be true for software-based disk encryption because the boot/swap partitions, MBR (Master Boot Record)  can happen to be non-encrypted. When it comes to hardware-based disk encryption, there are some self-encrypting drives that actually can do a full disk encryption.

On the other hand, just a partition or a container can be encrypted, in which case, the data selected within the partition/container ends up encrypted instead of the entire system.

 

What does disk encryption protect from and how?

 

It is quite important to understand what types of threats can disk encryption mitigate, as well as to not misunderstand the purpose of disk encryption.

First and foremost, disk encryption protects your data in case someone was to obtain physical access to your device. In cases such as you are losing your device, or it being stolen, seized, or if its left unguarded (prevents tampering/accessing the device) … other potential cases where disk encryption can protect you is if the hardware is sent to the repair, or is being shipped, as well as if you want to get rid of your hardware securely.

It’s important to note that disk encryption also protects the integrity of your files/OS, due to built in integrity controls. This prevents a slew of nastiness, such as Keyloggers, Rootkits, and other malware.

Simply put, disk encryption protects you by rendering the files on the disk unreadable without the correct key/password (password, in most cases, actually creates that key). To read the files on your encrypted disk your OS needs to be running, and you have to enter your key.

Remember, even a (complex) password on your OS (lock screen), without disk encryption doesn’t protect you from a case in which someone has physical access to your device. They can simply bypass your password by booting it into another system to explore it. Or they can remove the hard drive and plug it in into another device. This is also where disk encryption comes into play – they can not go through your filesystem if it has full disk encryption.

 

What is not protected with disk encryption?

 

This is important to understand, and, in fact, disk encryption won’t protect you from a wide array of threats, however, it protects against physical access-based attacks against your device. Your traffic can still be observed, malware can still get inside your device, etc.

This is because of the way it works, and after you’ve entered your key (password) and your OS is running, you won’t have any protection. Thus, any malware that slips inside can in theory get access to your data and do whatever it was designed for (it can even steal your key – from memory, or by installing keyloggers, etc).

This is due to the fact that when you punch your password in to decrypt your drive, the key will reside in memory. If someone can access your memory, they can also find your key, thus can decrypt your drive.

You’ve probably heard of the Cold Boot Attack… this is possible because the key can remain in memory for a short period of time after you’ve switched your device off.

There is also something called key disclosure law, you can also check out this site to read a summary of how a specific country handles encryption.

 

Attacks

 

I want to go over some potential attacks against (whole) disk encryption. There’s the breaking of crypto algorithms and brute force attacks, as you might imagine… let’s try and figure out how effective can those be.

Those will usually involve ciphers (like AES, Blowfish, etc.) and a cipher is considered strong as long as a there isn’t any method for breaking it that exists. However, this doesn’t guarantee that in the future we might not develop methods that could break them. Bear that in mind, AES might be strong today, but there’s a realistic chance it will stop being useful for us in the future. AES, Blowfish, and such ciphers should be good for the next decade or two, though, from what we know through our studies of these ciphers.

If we’re talking about (potentially) mitigating these, some encryption systems allow us to combine encryption algorithms – for example, you can have AES(Twofish(Serpent)). This could imply that the attacker would have to devise a method per algorithm so they can break that encryption.

Basically, the only practical attacks (currently) against crypto algorithms are brute force attacks – dictionary/hybrid.

 

What does the future hold? Quantum computers

 

As we all know, quantum computers will become a thing at some point in the future, and there’s been much fuss about how that will bring the end of the world because of their ability to crack all currently used crypto algorithms with ease – such as AES.

The truth is that they will effectively half the strength of symmetric keys, which implies we would have to double the size of our key to get the approximate level of protection as we currently have. This implies that 128-bit keys could be broken with a quantum computer.

However, 256-bit keys would still provide protection from quantum computers. Asymmetric algorithms would need to be replaced, though. Asymmetric encryption isn’t used in disk encryption, by the way.

The reason why 256-bit keys could still hold up against the quantum computer is the fact that if you were to attack the 256-bit key space, you’d have to go against the laws of nature themselves… and in this particular case it means checking for  keys, and even if your computer could check for billions keys per second, it would still take an unimaginable amount of time. It’s just the way it is. This is another interesting article on the topic. Quantum anything really, is always somewhat of a mystery… even though today’s smartphone batteries and the whole advance in that field owes tremendeous debt to Fermi’s levels/Fermi’s energy (part of solid state physics) we still don’t fundamentally understand the topic, as Feynmann so succintly pointed out.

Quantum weirdness is not out of the question and we might uncover something that will indeed be game changing, but 256-bit will still be decently strong, if not totally unbreakable, for a decent period of time to come…

Thus, if you’d like to future proof for a bit, go for more than 128-bits, 156 or more, ideally 256 – why not, if you can? Of course, since passwords are used to generate encryption keys so you would also want to use strong passwords here.

 

Hardware and software encryption systems – implementations vulnerabilities

 

Implementation and configuration vulnerabilities are generally your weakest link. When it comes to these crypto systems, since they can be either open source or closed source, depending on their origin they might rely more on the scrutiny from the community, or on the trust from its creator, for the latter.

Generally, these systems should be audited well, if one were to place actual trust into that specific product, but since this is what we have, I just wanted to mention that so you can take it into consideration, adjust your threat/risk model, and go on about your day!

They could also have implementation weaknesses/backdoors that have been introduced by an adversary (usually of the 3-letter agency level of skill, regardless if it’s a govt or a criminal group… )

Lastly, there are also unknown risks that stem from the features that are unknown, whatever it is that we haven’t accounted for. These aren’t something you can fully prepare against, but you can try and adjust your model so you have some sort of compensating controls, in case something like that ever happens.

 

Conclusion

I hoped you enjoyed my short encryption-themed article and some of the considerations I’ve laid out in the article for you. It’s an exciting topic, as we all know how much our digital world relies on cryptography; while it can also be used by some (maybe not intentionally) to scare people, which is why I included the What does the future hold? paragraph, in hopes of providing a sort of disambiguation on that topic.

Stay tuned!

 

Cover image by Maximal Focus

#encryption #aes #full-disk-encryption #attacks #quantum-computers

Tags

  • #encryption

  • #attacks

  • #vicarius_blog

  • #aes

  • #full-disk-encryption

  • #quantum-computers

” alt=”users/photos/cl09w23tf2efa0mpf8sov0k5q.jpg” data-v-5bf3e860=”” data-v-85c4bf60=”” data-v-0bbc59dc=”” />

Written by

acephale 4w

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

runZero 3.3: Unmatched visibility into your Google ecosystem

What’s new with runZero 3.3?

  • Extended visibility into Google Workspace
  • Queries for Google Workspace users and groups
  • Fingerprinting for Google assets
  • Identification of OpenSSL services
  • Improvements to the runZero Console

Extended visibility into Google Workspace
runZero 3.3 furthers the visibility into your Google ecosystem through a new integration with Google Workspace. runZero Professional+ users will be able to sync Google Workspace asset details from mobile devices, endpoints, and managed Chrome systems, while runZero Enterprise users will also be able to sync Users and Groups. Once the integrations are configured, users can view, search, analyze, export, and alert on attributes from both Google Workspace and Google Cloud Platform.

One of the key reasons to leverage the runZero integrations is to get better insight into the scope of your environment and completeness of coverage since MDM and IAM platforms can’t provide any insights into devices that haven’t been onboarded. To identify assets on your network that aren’t onboarded to Google Workspace, use the query source:runZero AND NOT source:googleworkspace. Conversely, use this query to find assets from Google Cloud Platform or Google Workspace that have not been scanned by runZero yet: (source:gcp OR source:googleworkspace) AND NOT source:runzero. These queries can help you keep pace with unmanaged and disconnected assets.

The integration also pulls in many Google Workspace attributes to give you comprehensive asset visibility. This could include attributes like when a device was last synced, whether a device has a password enabled or is encrypted, or whether it supports the use of a work profile. The Recent Users list in the asset details can also provide insight into device ownership and usage. You can filter for a specific user by using the @googleworkspace.mobile.email attribute for mobile devices or the @googleworkspace.chromeos.recentUsers attribute for ChromeOS devices. To find mobile devices that aren’t locked with a password try the query @googleworkspace.mobile.devicePasswordStatus:=”Off”, or use @googleworkspace.mobile.encryptionStatus:=”Not Encrypted” to find ones without encryption enabled. The wildcard operator also lets you find results with a range of OS versions, such as using @googleworkspace.endpoint.osVersion:=”MacOS 12.% to find Google Workspace assets running macOS Monterey.

runZero offers unmatched active network scanning, while also integrating with an ever-growing list of data sources so that you have a complete asset inventory at your fingertips. To get started, set up a connection to Google Workspace or Google Cloud Platform.

Queries for Google Workspace users and groups
runZero Enterprise users can leverage the new queries tailored for the Google Workspace integration to quickly find and alert on accounts that match particular parameters, in addition to being able to run searches in the Users and Groups inventories. Identify administrator accounts, suspended accounts, and accounts without MFA to improve IAM efforts and better protect your environment. These queries are included in the Query Library and can also be used to create alerts.

Run queries about Google Workspace users or create an alert rule to find assets of interest.

Fingerprinting for Google assets
runZero includes fingerprints for the metadata returned by the Google integrations, including Google Cloud Platform and Google Workspace. This will help provide the most accurate operating system and hardware data about the assets in your inventory.

In addition to Google fingerprints, runZero has also improved fingerprinting coverage of Microsoft 365 Defender assets and SNMP devices. Additional support was added or improved for products by Apache, Aruba, Avaya, Axon, Cisco, CyberPower, Debian, Eaton, Epson, Fortinet, Fujifilm, Geist, Hikvision, Lexmark, Oracle, Sato, Sony, Vivi, and VMware.

Identification of OpenSSL services
In preparation for the OpenSSL vulnerability announcement, runZero released remote, unauthenticated fingerprinting for OpenSSL 3 services, allowing our users to get ahead of the mitigation process prior to the vulnerability details becoming public. This capability has since expanded to detect even more TLS implementations and track the TLS stacks in use on each asset. runZero users can find OpenSSL endpoints using the query product:openssl, in the assets, services, and software inventories.

The server-side exposure only applies to services that process client certificates. runZero already performs checks for this, even though it is not a common configuration. To identify services running OpenSSL 3.0.x variants that may be vulnerable to exploitation, use the following query in the service inventory search: _service.product:”OpenSSL:OpenSSL:3″ AND tls.requiresClientCertificate:”true”.

Improvements to the runZero Console
The 3.3 release includes several changes to the user interface to improve the performance of the runZero console. The tables on the Explorers, Sites, Organizations, and Your team pages now perform and load faster. This will let users query and sort the results in tables more efficiently, getting to the answers they need faster.

The release also extends the availability of the All Organizations view. All users now have a view that will show them the results from all of the organizations that they have access to. The available permissions in that view reflect their per-organization permissions so that they can manage resources just like they would when viewing a single organization.

Release notes
The runZero 3.3 release includes a rollup of all the 3.2.x updates, which includes all of the following features, improvements, and updates.

New features

  • runZero Professional and Enterprise customers can now sync assets from Google Workspace.
  • runZero Enterprise customers can now sync users and groups from Google Workspace.
  • The “All Organizations” view is now available to restricted users with a filtered scope.
  • User interface tables were revamped for Organizations,
  • Sites, Explorers, and Teams.
  • Live validation is no longer required for Qualys VMDR and InsightVM credentials.
    Fingerprint updates.

Product improvements

  • The subnet utilization report now supports filtering by site.
  • CSV export of assets now includes the same hostname information as the inventory view.
  • Up-to-date ARM64 builds of the standalone scanner are now available.
  • The account API endpoint for creating organizations now accepts the argument types documented.
  • Merging two assets now correctly updates the date of the newest MAC address for the resulting asset.
  • Disabling all scan probes now disables the SNMP probe.
    Service Provider information is now displayed with a default domain before SSO settings are configured.
  • Explorers are now ordered alphabetically on the scan configuration and connector configuration pages.
  • runZero users logging in via SSO are now presented with the terms and conditions acceptance dialogue.
  • A new tls.stack attribute that tracks the TLS software provider and version has been added for assets and services.
  • A new canned query for OpenSSL 3.0.x with client certificate authentication has been added.
  • The scanner now reports OpenSSL versions via TLS fingerprinting.
    The scanner now reports Tanium agent instances on the network.
  • The scanner now reports additional detail for SSLv3 services.
  • The search keywords has_os_eol and has_os_eol_extended are now supported on the Assets and Vulnerabilities inventory pages.
  • The “last seen” link to the most recent scan details has been restored on the asset details page.

Performance improvements

  • Improved performance when scanning from macOS hosts that have certain EDR solutions installed.
  • Improved performance of Intune integration when importing a large number of users and devices.
  • Scan task processing speed has been improved for SaaS and self-hosted customers.
  • The baseline memory usage of Explorers has been reduced.
  • Error handling of misconfigured fingerprints has been improved to reduce Explorer and scanner crashes.

Fingerprinting changes

  • Improved fingerprinting coverage of Microsoft 365 Defender for Endpoints assets.
  • Improved fingerprinting coverage of SNMP devices.
  • Tanium agent detection now sets the edr.name attribute.
  • Added fingerprinting of OpenSSL, GnuTLS, and Windows TLS stacks, including version when possible.
  • Apple ecosystem OS fingerprint updates.
  • Additional support added-or-improved for products by Apache, Aruba, Avaya, Axon, Cisco, CyberPower, Debian, Eaton, Epson, Fortinet, Fujifilm, Geist, Hikvision, Lexmark, Oracle, Sato, Sony, Vivi, and VMware.

Integration improvements

  • The AWS integration now includes an option to delete AWS-only assets that were not seen in the most recent import.
  • The Qualys integration now includes an option to import unscanned assets and is disabled by default.
  • Processing speed for large Qualys imports has been improved.
  • GCP credentials can now be configured to import assets from multiple projects.
  • The error message indicating that an AWS integration credential has insufficient permissions has been improved.

Bug fixes

  • A bug that could prevent the use of third-party credentials when using TLS thumbprints or the insecure connection option with a public URL has been resolved.
  • A bug which sometimes prevented GCP imports from completing has been fixed.
  • A bug in how Service Inventory searches were launched from the
  • Asset details page had been resolved.
  • A bug that could prevent TLS probes from completing has been resolved.
  • A bug that could prevent updating site metrics has been resolved.
  • A bug that could prevent the Intune integration from completing long-running tasks has been resolved.
  • A bug that could prevent the GCP integration from returning all assets has been resolved.
  • A bug that could result in a recurring integration running again before the previous task finished has been resolved.
  • A bug that could prevent importing assets from Microsoft Intune has been resolved.
  • A bug that could prevent importing assets from Microsoft 365 Defender has been resolved.
  • A bug that could prevent importing assets from Microsoft 365 Defender has been resolved.
  • A bug that could cause broken asset links has been resolved.
  • A bug that could cause missing service data for services with conflicting virtual hosts has been resolved.
  • A bug that could cause inaccurate user counts for imported directory groups has been resolved.
  • A bug that affected tooltip display has been resolved.
  • A bug that prevented “open in new tab” navigation using middle/right click has been resolved.
  • A bug that could prevent Azure AD imports has been resolved.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Need help? Our team is just a message away