Skip to content

runZero 3.7: Custom integrations and SDK

What’s new with runZero 3.7?

  • Custom integrations and Python SDK
  • ServiceNow Service Graph Connector for runZero
  • Protocol improvements
  • New and improved fingerprints

Custom integrations and Python SDK

runZero Enterprise customers can now import assets from custom sources using the runZero SDK. The new Python SDK supports runZero’s custom integration API functions for ease of automation and use for those familiar with Python. These custom integrations allow for creating and importing asset types not previously supported within runZero, along with assigning the integration a name, description, and custom icon. Once imported, you can manage these custom integration sources from the runZero UI, and remove them from assets if desired. This will allow you to build new integrations and further enrich the asset data within runZero.

ServiceNow Service Graph Connector for runZero

The runZero Service Graph connector is now available in the ServiceNow marketplace. The connector can automatically pull your runZero asset data into your CMDB, merging with your ServiceNow data to improve asset visibility and accuracy. This connector does not replace the ServiceNow IntegrationHub ETL integration; both the connector and integration are available to Enterprise customers. ServiceNow Service Graph connector for runZero

Protocol improvements

The 3.7 release includes improved support for the Checkmk host agent. Checkmk is an open source host monitoring service and is deployed as part of many solutions and network appliances. Customers with Checkmk in their environment will benefit from improved software inventory and EDR detection for these assets. The accuracy of operating system fingerprinting has also been improved using available Checkmk data. The scanner now supports the Steam In-Home Streaming Discovery Protocol, allowing for identification of devices running the Steam client from Valve Software.

New and improved fingerprints

A number of fingerprints and fingerprint capabilities have been improved in this release. These improvements include fingerprinting of TLS stacks, better coverage of Roku devices based on AirPlay responses, and improved OS fingerprinting of devices speaking the BACnet protocol. New fingerprints were added for products by Abbott, Aruba, Audioscan, Bayer, Canon, Ciena, Cisco, Crestron, FloLogic, GE HealthCare, GE MDS, Google, H3C, Huawei, IBM, Keyence, Meross, Logitech, NetApp, Panduit, Proofpoint, Roku, Quantum, Raritan, Roku, Shelly, SonicWall, Tesla, TP-Link, and VMware.

See runZero 3.7 in action

Watch the video to see a preview of some of the newest features in runZero, including the ServiceNow connector, Checkmk protocol parser, and custom integrations leveraging the Python SDK.

Release notes

The runZero 3.7 release includes a rollup of all the 3.6.x updates, which includes all of the following features, improvements, and updates.

New features

  • Customers with an enterprise license can now create custom integrations and import assets from any external asset data source using the runZero Python SDK.
  • Improved performance and reliability of metrics calculations.
  • Improved performance of the vulnerabilities inventory.
  • AWS permission errors are now more detailed to make troubleshooting easier.
  • A bug where the asset ownership tag was not able to be changed successfully has been resolved.
  • A bug where email addresses were case sensitive on sign in has been resolved.
  • A bug where the “Create Organization” button appeared disabled but was still clickable has been resolved.
  • A bug preventing the Asset Ownership goals toggle from being clickable has been resolved.
  • Upgraded npcap to version 1.73
  • Fingerprint updates.

Security fixes

  • A bug that could show cross-tenant Queries and their associated author email addresses was resolved. This issue only applied to a cloud-hosted version of the runZero platform that was live for slightly more than two hours on March 29th, 2023. Any customers affected by this issue received a detailed notice. This affected version 3.6.14.
  • A bug that could allow an organization admin to see the names of other organizations in the tenant, even without explicit access, has been resolved. This affected versions 3.6.0 to 3.6.5.
  • A bug that could expose limited information about an organization to cross-tenant users has been resolved. This issue could have allowed an attacker that guessed the v4 UUID of an organization to view the name, description, and top-level statistics (asset count, service count, task count, etc.) without appropriate authorization. This affected versions 3.6.0 to 3.6.4.

Product improvements

  • Improved quality of errors reported by the CLI Scanner.
  • Improved user experience of user management.
  • Improved user experience of organization management.
  • Packets sent/received are now visible from the tasks preview.
  • Enterprise customers can now scan all ports and up to a /8 at a time using the hosted scan engines.
  • Attribute searches and reports are now faster in large organizations.
  • It is now possible to download the task log for a failed scan.
  • Hosted scans no longer ignore responses from common firewalls.
  • Daily asset expiration now records an assets-expired event with the count.
  • The task-failed event now includes information about the associated Explorer.
  • Scans can now configure specific probes for Subnet and Host pings.
  • Asset queries can now surface overlaps in asset names, IP addresses, and MAC addresses across inventory.
  • Behavior around parent/child organizations has been improved.
  • A change to Chrome which caused web screenshots to fail has been addressed.
  • Alert rules now support software and vulnerability queries.
  • Asset ownership now supports references to runZero users and groups.
  • Vulnerability inventory now includes an Exploit status, indicating whether the vulnerability is known exploitable. The Exploit status will only be populated for vulnerabilities imported after this release.
  • Datagrids across the UI no longer use the incorrect theme.
  • Task WLAN listing functionality has been improved to enforce a timeout if the underlying utility is slow or unresponsive.
  • The maximum time to complete an SNMP walk is now configurable.
  • The default maximum time to complete an SNMP walk has been increased to 5 minutes from 1 minute.
  • The maximum results for an SNMP walk have been increased to 8k from 4k.
  • Assets owned by a runZero user will now be displayed on the user details page.
  • The Reason column in the failed tasks table will now properly persist the hidden state between page loads.
  • Saved queries can now be created for software, vulnerabilities, and screenshots.
  • Attribute reports now group unique values within a single key.
  • The View More link is now accessible for in-progress tasks.
  • Asset owner names now suggest auto-complete options.
  • Accessibility improvements.
  • Client-side timezone updates.
  • Improved performance of the organization details page.

Integration improvements

  • The AWS integration now supports the GovCloud partition for assumed roles.
  • Validation warnings for internal IPs when using LDAP and InsightVM integrations has been improved.
  • Filtering of non-unique MAC addresses has been improved to better support Cisco virtual MAC addresses.
  • Cisco virtual MAC addresses are now handled more consistently.
  • Increased timeouts for the Tenable integration.
  • Improved reliability of CrowdStrike credentials verification.
  • The API response for a PUT request to /org/sites now returns the details of the new site.
  • Improved reliability of the Tenable integration.
  • API requests to apply tags to one or more assets now complete much faster.

Bug fixes

  • A race condition that could occur during self-hosted installation has been resolved.
  • A bug that could cause the Tenable connector to fail intermittently for some customers has been resolved.
  • A bug that could cause task details not to render on the task overview screen has been resolved.
  • A bug that could prevent organization administrators from creating new projects has been resolved.
  • A bug that could prevent some CrowdStrike software from importing successfully has been resolved.
  • A bug that caused misaligned values when exporting assets to CSV has been resolved.
  • A bug that could cause the SSO page to render off screen has been resolved.
  • A bug that could prevent asset modifications triggered by alert rules has been resolved.
  • A bug that could prevent the dashboard from loading successfully has been resolved.
  • A bug that caused misaligned values when exporting assets to CSV has been resolved.
  • A bug that could cause assets to incorrectly merge has been resolved.
  • A bug that could prevent validation of hostname scan targets has been resolved.
  • A bug that could lead to inaccurate asset correlation has been resolved.
  • A bug which could result in runZero attributes being removed from Offline assets has been resolved.
  • A bug that could prevent subnet stats from being exported has been resolved.
  • A bug that could prevent analysis queries from running for directory users and groups has been resolved
  • A bug that prevented match counts from being displayed on the queries page has been resolved
  • A bug that could prevent updating assets with a large number of vulnerabilities has been resolved
  • A bug that prevented access to runZero canned Queries has been resolved.
  • A bug that could lead to the self-hosted installer not removing temporary files has been resolved.
  • A bug that led to slow SNMP scans of specific Cisco switches has been resolved.
  • Addresses bug where recurring tasks that are “Removed” were still showed in the tasks page after the associated site is deleted
  • A bug preventing asset owners from being updated has been resolved.
  • A bug that could result in inaccurate vulnerability counts for assets has been resolved.
  • A bug that could prevent a subset of vulnerabilities from being saved for multi-source assets has been resolved.
  • A bug that caused errors for Crowdstrike integrations with large amounts of applications has been resolved.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Introducing runZero’s new ServiceNow Service Graph integration: Get greater data accuracy for your CMDB

Big news: runZero now integrates with ServiceNow Service Graph. The runZero Service Graph integration offers a robust solution for organizations who need to get a comprehensive and up-to-date view of asset data across IT (information technology), OT (operational technology), cloud, and remote environments. This new integration will quickly and easily enrich CMDBs with high-fidelity, contextualized asset details, superseding the existing ETL integration.

The importance of data quality in CMDBs

According to Gartner, nearly one third of CMDB challenges stem from data completeness or quality concerns, which highlights the importance of prioritizing data quality in an organization’s configuration management database (CMDB). This is not just a theoretical concern: Gartner also notes that 99% of organizations using CMDB tooling who do not address configuration item data quality gaps will experience visible business disruption. This makes sense when you consider that IT infrastructure and services are critical components of most modern businesses. Without accurate information about these assets, it becomes difficult to make informed decisions related to security, compliance, risk management, and more.

To deliver better and complete visibility across your environment, the Service Graph Connector brings your runZero asset inventory into your ServiceNow CMDB. With better data quality in your CMDB, you can ensure they get managed in accordance with your organization’s policies. By leveraging runZero’s ServiceNow Service Graph integration, you can improve your CMDB accuracy and reduce the likelihood of costly disruptions caused by inaccurate data. You can be confident that you’re operating on every asset–even the ones your CMDB didn’t know about.

Eliminate data quality gaps and improve IT/IoT/OT asset visibility with runZero’s ServiceNow Service Graph integration

Many organizations are turning to Cyber Asset Management (CAM) solutions to gain better visibility into IT, IoT, and OT assets. These solutions can help proactively identify unmanaged devices and uncover security risks within networks. By using both API data sources and unauthenticated active scanning, runZero is one of the few solutions capable of discovering unmanaged IT, IoT, and OT devices. This approach is especially valuable in OT environments, where visibility may be limited.

runZero’s ServiceNow integration provides you with a powerful tool to improve your asset inventory and cyber asset management. With this integration, you can gain better visibility into IT, IoT, and OT assets, as well as identify and address data quality gaps. This can help you reduce the cost of downtime, improve labor productivity, and get more value from your CMDB investments. In addition, runZero’s active scanner is safe to use in OT environments, ensuring that you can get the most out of your cyber asset management solutions without compromising the safety of your systems. Dozens of organizations are using runZero’s combination of integrations and active discovery, including those in manufacturing, healthcare and utilities, to achieve full asset inventory.

How Capgemini helped their client get better quality data for their CMDB

Let’s take a look at the real world implications of not having a dedicated cyber asset management solution in place.

Capgemini, a global IT consulting firm, was contracted by a French manufacturer and retailer of luxury products to deploy an asset discovery solution and set up the integration with the new CMDB to store the company’s IT asset inventory. However, they were struggling to get the data they needed using MID Servers–especially for managed assets such as routers and switches. They knew they had to explore other asset discovery options.

One of the primary requirements established for the project was unauthenticated asset discovery. The IT department, part of the holding company, was having a hard time collecting credentials for service accounts for many parts of the business. Without credentials, ServiceNow was struggling to inventory most assets. As Capgemini looked into other solutions, they discovered runZero, which delivered everything their client needed: speed, accuracy, a rich API, and unauthenticated scans. runZero’s asset discovery was fast, efficient, and worked without credentials. With runZero, they found 2.5x as many devices as ServiceNow.

After seeing the results with runZero, Capgemini has other ideas for capitalizing on its capabilities. As they work with clients in future projects, runZero will give them an accurate picture of their client’s asset inventory enabling them to provide precise project plans with known scope, schedule, and cost estimates.

Ready to get better results from your CMDB investments? To get started, sign up for runZero and then get the ServiceNow Service Graph integration on the SNOW marketplace.

Be confident in your CMDB’s data quality

runZero is a cyber asset management solution that delivers full asset inventory–quickly, easily, and safely. The solution enriches CMDBs with detailed asset and network data from a purpose-built unauthenticated active scanner. Discover every asset–even the ones your CMDB didn’t know about.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

runZero 3.6: Introducing organizational hierarchies

What’s new with runZero 3.6?

Organizational hierarchies

Organizational hierarchies help streamline user and permission management. When creating and editing organizations, you can define an organizational hierarchy that allows for inherited user permissions.

The users assigned to the selected parent organization will maintain the highest assigned permission in the child organization unless specified in their user permissions. For instance, if a user is a viewer in the parent organization, but an administrator in the child organization, they will maintain their admin status in the child organization when the parent-child relationship is created.

Organization hierarchies can be three levels deep, and user permissions in a child organization can be upgraded, not downgraded, from the currently set permissions in the parent organization.

CrowdStrike integration improvements

The CrowdStrike integration now populates asset software information from Falcon Discover. Additionally, IP addresses imported by CrowdStrike are now considered primary addresses and will be used for correlation, and the CrowdStrike credential verification is now seperated by service.

Operating system CPE assignment

The operating system Common Platform Enumeration (CPE) field is a string describing detected operating system software aligned to the CPE naming scheme. This field is queried using the syntax os.cpe23:<text>. In cases where runZero was able to fingerprint the operating system but the NIST database does not contain an official matching entry, an unofficial CPE will be generated and include r0_unofficial in the other field of the CPE.

New protocols and fingerprints

The runZero scanner now reports legacy RDP authentication, decodes additional ISAKMP/IKEv2 fields, and improves the fingerprinting of AirPlay devices.

Additional fingerprints were added for products by 2N, Aastra, Alien Technology, AMI, Arista, Asterisk, Avaya, Canon, Cisco, D-Link, Dell, Eaton, Echelon, Fortnet, FreePBX, GAI-Tronics, Grandstream, Hillrom, Honeywell, HP, HPE, Intel, Jenkins, Lantronix, Lenovo, LG, Logic Controls, Logitech, Meinberg, Mitel, Moxa, Netgear, NetApp, Quantum, Palo Alto Networks, Panasonic, Poly, QNAP, Samsung, Sierra Wireless, SoundCom, Spectralink, STARFACE, Tektronix, Thomson, Ubiquiti, VTech, Wahsega, Yealink, ZTE, Zultys, and Zyxel.

New Rapid Response queries

A new query was added to quickly identify OpenSSH 9.1 Servers affected by a memory double-free vulnerability.

See runZero 3.6 in action

Watch the video to see a preview of some of the newest features in runZero, including organizational hierarchies, research updates, software inventory from CrowdStrike, and OS CPE information.

Release notes

The runZero 3.6 release includes a rollup of all the 3.5.x updates, which includes all of the following features, improvements, and updates.

New features

  • Organizational hierarchies are available allowing for permissions to be inherited by child organizations based on an established parent.
  • runZero now identifies the CPE associated with fingerprinted assets and assigns an unofficial CPE where an official match is not found in the NIST database.

Product improvements

  • A new query was added for OpenSSH 9.1 servers affected by a memory double-free vulnerability.
  • Improved SNMP fingerprint coverage capabilities and added new attributes for SNMP protocol version (at the asset level) and authentication details (at the service level).
  • Improved handling of invalid multi-valued subjectAlternativeNames on x.509 certificates.
  • The scanner now supports identifying RDP authentication methods, including legacy and NLA, supported by target hosts.
  • The scanner now supports the ability to decode ISAKMP/IKEv2 replies
  • A new canned query for OpenSSH 9.1 servers which contain a memory double-free vulnerability has been added.
  • Performance of the Active Directory (LDAP), Azure AD, and Google Workspace integrations has been improved.
  • SNMP protocol versions are now tracked at the asset level.
  • SNMP services will now keep track of how they authenticated and using what protocols.
  • Hostname extraction from malformed subjectAlternativeNames on TLS certificates has been improved.
  • Site scopes with subnets ending in /32 (for IPv4) and /128 (for IPv6) are no longer parsed to single IPs and will appear as CIDR entries in the subnets list.
  • Improved error validation UX around email addresses when setting up an email alert channel.
  • Services, Screenshots, and Software inventory pages now include associated site subnet tags.
  • runZero now identifies the CPE associated with fingerprinted assets and assigns an unofficial CPE where an official match is not found in the NIST database

Integration improvements

  • Improved fingerprinting of operating systems imported via the LDAP and VMware integrations.
  • Stability and performance of VMware asset correlation has been improved.
  • VMware assets are now merged across sites.
  • The Intune integration has been improved to better handle Intune API rate limiting.
  • IP addresses reported by CrowdStrike are now considered primary addresses, and will be used for asset correlation.
  • CrowdStrike credentials verification is now separated by service

Bug fixes

  • A bug that could prevent automatic metric calculations from completing has been resolved.
  • A bug that could prevent stale assets from being automatically removed on subsequent task runs has been resolved.
  • Several minor bug fixes and UX improvements have been made to the redesigned task page.
  • A bug that prevented OS fingerprinting and information extraction over RDP has been resolved.
  • A bug preventing users from copying or editing connector and analysis tasks has been resolved.
  • A bug causing new recurring tasks to display an incorrect first run date has been resolved.
  • A bug causing the dashboard asset trends graph tooltips to appear away from the graph has been resolved.
  • A bug causing task page inspection cards to automatically collapse has been resolved.
  • A bug that could result in build-up of frequently recurring tasks has been resolved.
  • A bug that could cause extremely large tasks to remain queued for processing indefinitely has been resolved.
  • A bug that could prevent export of service attribute reports has been resolved.
  • A bug preventing license requirement indicators from being visible on some pages has been resolved.
  • A bug preventing saving of credentials due to bad org-access settings has been resolved.
  • A bug preventing recalculation of the next scheduled run time for a scan has been resolved.
  • A bug that could cause inaccurate asset counts in the Organization Overview report has been resolved.
  • A bug that could cause site import to fail when missing optional fields has been resolved.
  • A bug that could prevent the VMWare connector task page from loading has been resolved.
  • A bug that could cause duplicate MSDefender attributes on an asset has been resolved.
  • A bug where firewalls (and similar devices) responding to many non-asset IP addresses during scanning would lead to unexpected assets in inventory has been resolved.
  • A bug preventing the active scans dashboard widget from navigating to the associated task on click has been resolved.
  • A bug preventing site subnet tags from appearing in the dashboard Asset tags widget has been resolved.
  • A bug that could cause CrowdStrike tasks to fail when missing software permissions has been resolved.
  • A bug that could prevent bogus services from certain firewalls from being completely filtered has been resolved
  • A bug that could lead to a browser crash in the latest release of Chromium based browsers on MacOS has been circumvented.
 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

How to streamline user permissions with organizational hierarchies

A common challenge for many businesses is efficiently managing user permissions as new solutions are deployed and adopted. How do you ensure that the right people have the right permissions to access the data they need for their jobs? Missteps on provisioning permissions can lead to unauthorized access to data, creating major headaches for IT and security teams. One way around this challenge is to start with solid user and permission management practices that help you assign access to your users, such as role-based access control (RBAC). RBAC is a security approach that authorizes and restricts users’ access based on their roles within an organization. While RBAC is an effective way to manage user access control at scale, you can add extra layers of protection to ensure that the right roles are being assigned. A good example of this would be using hierarchies to propagate the inheritance of permissions. Let’s take a look at how you can use runZero organizations for data segmentation and hierarchies to streamline user permission management.

The role of organizations

Organizations are a powerful feature that allow you to create separate entities for your assets and control what users can do with the organizational data. In runZero, you can use organizations to group and manage asset data, Explorers, tasks, sites, and scan configurations. The flexibility of organizations allows you to segment your data by company, department, customers, or however you like. For example, you might want to set up different organizations for each environment you have – such as development and production – because you want to segment the data. Or if you’re a service provider, you may have an organization for each one of your customers. In some cases, your business may want to set up multiple organizations to manage asset data as well as streamline permissions management. Imagine having to review and assign organizational access for each user. That’s time-consuming and prone to user error. So how can you ensure consistent provisioning of user permissions throughout your organizations?

Introducing organizational hierarchies

runZero 3.6 introduces organizational hierarchies, which enables you to create parent-child relationships between organizations. This approach is based on a top-down permissions distribution model, where the child organizations inherit the permissions configured within the parent organization. The parent organization sets the minimum permission level a user has to that organization and any children. Child organizations with lower permissions than the parent organization will inherit the effective higher permission. For example, if the parent organization has a user’s permissions set to annotator, then the child organizations can be upgraded to user or administrator, but downgraded permissions won’t have any effect. Imagine you have a parent organization called Mom Org that has a child organization called Baby Org. Within Mom Org, a user named Chris has been assigned an administrator role. As a result, Chris can access the Baby Org organization as an administrator. Let’s take a look at how you can set up organizational hierarchies in runZero.

How to set up organizational hierarchies in runZero

To set up an organizational hierarchy, you can either create a new organization or modify an existing one. You can always edit your organizations and assign a new parent (or no parent at all). Here’s how you can assign a parent organization:
  1. Create a new organization or edit an existing organization.
  2. Make sure to provide a name and description for the organization. This information captures context about the organization and the type of data it contains.
  3. Make sure to set any expiration dates for stale assets, offline assets, and scan data. This determines how long these data types are stored by runZero.
  4. Under parent settings:
    • If you want to add the organization under a parent organization, choose an organization to assign as the parent. You can choose a child organization to be a parent as well – runZero supports up to three levels of nesting.
    • If you don’t want to assign a parent to the organization, choose None. You can add child organizations later, if needed.
  5. Save your organization.
After you save your changes, the new hierarchical permissions will take effect. From the Organizations page, you can see how many children each organization has. Additionally, you can view the details page for a specific organization to see the parent hierarchy.

How to view user permissions

To see what a user’s permissions look like, you can view a user’s details to see their role for each organization.
  1. Go to your Users page and click the name of the user whose permissions you want to view.
  2. The user details page shows a table that contains all of the organizations that the user has access to and the role that they are assigned.
If the role is listed in the Assigned role column, then it was explicitly configured for the user. If the role is listed in the Inherited role column, then the permissions were set by the default role or parent organization. The higher level of the two columns will be the effective access that the user has to that organization.

Simplify the complexities of user access management with organizational hierarchies

As your business continues to grow and scale, so does the need for control over complexity. To protect and secure your data, you need to have the right systems and measures in place for effective user access management. Once you have solid RBAC practices in place, you can add extra layers of protection, such as organizational hierarchies, to ensure that the right roles are being propagated to users. Ready to get a stronger handle on user and permission management in runZero? Try out organizational hierarchies today.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Finding OpenSSH servers

The OpenSSH team surfaced a security issue earlier this month that specifically affects OpenSSH server version 9.1p1 (a.k.a. version 9.1). This version contains a memory double-free vulnerability (tracked as CVE-2023-25136) that can be reached pre-authentication by a remote attacker. Researchers, including JFrog and Qualys, have been investigating and providing proof-of-concepts of a denial-of-service scenario and remote code execution for the attacker.

What is the impact?

OpenSSH is a popular open source implementation of the SSH protocol and is available on many operating systems. While the installation base for OpenSSH is quite large (Shodan currently reports ~48k public-facing instances of OpenSSH servers running version 9.1), the potential impacts of this vulnerability are not yet fully understood and are still being investigated.

The denial-of-service attack vector may be successful against a number of operating systems running OpenSSH 9.1. However, it yields limited results because it only crashes the forked daemon instance that was spun up to handle the attacker’s SSH connection (leaving the parent ssh daemon still running to handle other incoming connections).

Exploitation of this vulnerability for remote code execution (RCE) is more complex, with a current proof-of-concept that only targets OpenBSD 7.2 without memory protections in place (such as ASLR, NX, or ROP defenses) and with code execution still contained within the ssh daemon’s sandbox. As researchers continue investigating RCE exploitation, other operating systems with attacker-bypassable memory malloc and double-free protections may be discovered. So, the ability to fully execute attacker-controlled code outside of the ssh daemon sandbox -even with memory protections in place– may be achieved.

Are updates available?

OpenSSH version 9.2p1 (a.k.a version 9.2) was released earlier this month and patches this vulnerability (CVE-2023-25136). For systems currently running OpenSSH 9.1, admins are encouraged to update to OpenSSH 9.2 or later.

How do I find vulnerable OpenSSH services with runZero?

To locate OpenSSH servers running the vulnerable 9.1/9.1p1 version in your network, use the following prebuilt query in your Service Inventory:

_asset.protocol:ssh AND protocol:ssh AND (_service.product:="OpenBSD:OpenSSH:9.1" OR _service.product:="OpenBSD:OpenSSH:9.1p1")
OpenSSH query

To local all OpenSSH servers in your network, use the folloing prebuilt query in your Asset Inventory:

product:”OpenSSH”
OpenSSH query

As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.