Skip to content

How to find MegaRAC BMCs

This week, Eclypsium Research published findings on critical vulnerabilities discovered in AMI MegaRAC baseboard management controller (BMC) firmware. Adding to the portfolio of “BMC&C” vulnerabilities that Eclypsium has been discovering and surfacing since late 2022, these two new vulnerabilities (tracked as CVE-2023-34329 and CVE-2023-34330) can be exploited and chained together to yield unauthenticated remote code execution on vulnerable targets. These vulnerabilities could impact many devices, as MegaRAC BMCs are popular across a number of manufacturers and appear in products from AMD, Asus, Dell EMC, Gigabyte, HPE, Lenovo, Nvidia, and more. 

What is an A MI MegaRAC BMC?

MegaRAC baseboard management controllers (BMCs) provide “lights out” management capabilities for remotely monitoring and managing servers. Manufactured by American Megatrends International (AMI), MegaRAC BMCs include a service processor and network connection that operate separately from the server they are connected to. Modern MegaRAC BMC firmware includes support for the Redfish API.

What is the impact?

These two newly disclosed vulnerabilities involve the Redfish service running on the MegaRAC:

  • Authentication Bypass via HTTP Header Spoofing (CVE-2023-34329; CVSS score 9.1 – “critical”)
  • Code injection via Dynamic Redfish Extension (CVE-2023-34330; CVSS score 8.2 – “high”)

CVE-2023-34329 can be exploited with specially crafted HTTP headers to trick the Redfish service into believing the request is coming from an interface that does not require authentication, such as USB0. On systems which have the No Auth option enabled, these spoofed headers will allow attackers to access and interact with any Redfish API endpoints.

CVE-2023-34330 can be exploited via an HTTP POST action to execute arbitrary code on the MegaRAC processor. While this code-execution-via-POST was an intentional design choice by AMI, it likely was intended for internal development only. However, it is enabled by default in vulnerable versions of the firmware, making it available to a broader audience.

Chaining exploitation of the two above vulnerabilities together can provide attackers with unauthenticated remote code execution and full control over a vulnerable MegaRAC target. Following successful exploitation, attackers can establish persistence, perform data exfiltration, perform lateral movement in the network, deploy malware, and more. Attackers can also perform a denial of service by forcing the server into a reboot loop or even bricking the system so it will no longer properly function.

Are updates available?

AMI has made patched firmware available in versions SPx_12.4 and SPx_13.2. Admins should update MegaRAC BMCs to the newer firmware as soon as possible.

Eclypsium Research also shared mitigations to help reduce the chance of a successful attack, including:

  • Ensuring all remote server management network interfaces are NOT exposed externally and operate on networks dedicated to management traffic only.
  • Ensuring access to remote server management network interfaces is restricted to administrative users via ACLs or firewalls per Zero Trust Architecture principles.

Additionally, U.S. government agencies and contractors legally required to comply with CISA’s Binding Operational Directive 23-02 should note required guidance to follow (similar to the aforementioned mitigation steps).

How do I find potentially vulnerable MegaRAC BMCs with runZero?

From the Asset inventory, use the following prebuilt query to locate MegaRAC BMC instances in your network:

hw:megarac

Results from the above query should be triaged to verify if those assets are running updated firmware versions.

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

The best free network scanners for security teams in 2023

Knowing what’s connected to a network is important for securing your organization. There are a fair amount of free and commercial options out there. We see security teams using a mix of runZero, Nmap (sometimes with Zenmap), Angry IP and Masscan. 

In this article, we compare and contrast several free tools and provide our take on why we believe runZero is best suited for corporate security teams – particularly teams that are looking to gain continuous visibility into their asset inventory for risk management, incident response, and penetration testing purposes.

Best free network scanners compared (2023) #

 runZero
(Recommended)		Nmap & ZenmapAngry IPMasscan
Best forContinuous and scalable cyber asset managementAd-hoc network discovery and security auditingEasy scan of a local network to see which IPs are upResearch scans of the entire Internet
Graphical user interface•••○
Internal database•◐◐○
Scalable deployment (distributed architecture)•○○○
Scan by IP range (internal & external)••••
Scan by domain•○○○
Scan by ASN•○○○
Identifies hardware platform•○○○
Covers managed on-premise assets••••
Covers unmanaged / IoT assets•◐◐◐
Safely scans OT assets•○○○
Covers cloud assets•◐◐◐
Covers remote assets•○○○
On-premise deployment••••
SaaS deployment•○○○
Free option available••••
Paid option available•◐○○
Supported platformsWindows, Linux,
macOS, BSD		Windows, Linux, macOS, BSDJVMWindows, Linux, macOS, BSD
Programming languageGoCJavaC

runZero

runZero was founded in 2018 by HD Moore, the creator of Metasploit, to help solve the problem of discovering both managed and unmanaged devices on the network. The product has grown to a full cyber asset management solution that covers managed and unmanaged IT/IoT, OT environments, cloud assets, and remote devices. runZero offers a free enterprise trial that downgrades to the free Starter Edition, which is used by more than 20,000 individuals and organizations.

runZero is enterprise grade in terms of its user interface, query language, and ability to collect an inventory even in highly distributed environments without having to write scripts or maintain a custom database. Like all of the other scanners in this article, its scans are unauthenticated but yield a surprising amount of depth of information, such as fully searchable attributes for all services, hardware and firmware details, as well as layer 2 and 3 network topologies. In addition, the solution can use SNMP credentials as well as integrations with vulnerability scanners, EDR, MDM, directories and other solutions to provide deeper insights into cyber assets and their security posture. runZero also provides integrations with CMDB and SIEM solutions to enrich asset inventory on other platforms.

runZero’s scanning technology is safe to use in many OT environments, making it an ideal passive discovery option for critical infrastructure OT environments.

Best for
  • Continuous and scalable cyber asset management
Advantages
  • Easy to deploy and scalable for larger organizations
  • Free Starter Edition for up to 256 assets (including commercial use)
  • Safe to use on fragile OT & IoT devices
  • Accurate OS & hardware fingerprinting
  • Paid editions offers integrations with security and IT infrastructure as well as coverage of cloud & remote assets in addition to on-premise devices
Drawbacks
  • Use above 256 assets requires paid license (free trial available)

Nmap and Zenmap

Nmap has been around for 25 years and is the gold standard for ad-hoc network scanning. The free and open source utility is most often used for network discovery and security auditing. It integrates with many other security auditing tools, such as Metasploit.

Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap).
The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful and flexible features. It allows users to write simple scripts for network discovery, more sophisticated version detection, and vulnerability detection. NSE can even be used for vulnerability exploitation.

Best for
  • Ad-hoc network discovery and security auditing
  • Security researchers that want to write nmap scripts for custom projects
Advantages
  • Very well known and documented
  • Most flexible option of all tools due to configurability
  • Extensible through the Network Scanning Engine
  • Free for private and commercial use
Drawbacks
  • Command line can be complex to use
  • Can disrupt fragile OT/IoT devices
  • Paid license required for hardware and software vendors that wish to distribute Nmap with their solution
  • Must be scripted for continuous use

Angry IP

Angry IP Scanner is an open-source network scanner designed to be fast and simple to use. It scans IP addresses and ports. It is widely used by network administrators.

Angry IP is a good solution for teams that are looking for the fastest and easiest way to see which IPs are in use on a network. However the solution doesn’t provide a lot of information about each device, limited to IP, ping time, hostname, ports, TTL, MAC address, filtered ports, NetBIOS.

Best for
  • Easy scan of a local network to see which IPs are up
Advantages
  • Very quick and easy to get going for an an ad-hoc scan
Drawbacks
  • Little information about each asset
  • Not scalable for larger or distributed environments
  • Can disrupt fragile OT/IoT devices

Masscan

Masscan is a port scanner that can cover the entire Internet in under 5 minutes by using asynchronous transmission, sending 10 million packets per second from a single machine. It is purely a command-line tool and its usage is similar to Nmap. While Nmap is more often used to scan individual machines and smaller IP ranges, Masscan is primarily used for very large IP ranges.

Best for
  • Research scans of the entire Internet on a small handful of ports
Advantages
  • Lightning-fast scans of large IP ranges
Drawbacks
  • Command-line only
  • Very little information on each asset
  • Not suitable for internal asset inventory
  • Can disrupt fragile OT/IoT devices
  • Must be scripted for continuous use

Most free network scanners don’t scale easily out of the box, often requiring custom databases and scripts to make them suitable for continuous monitoring and collecting inventory from multiple segments or sites. Out of the mix of tools, only runZero comes with a central repository and a distributed system of Explorers to scan all parts of a network, from inside and outside the firewall.

While all of the scanners we looked at are robust and suitable for their specific use cases, runZero is the best option for corporate security teams. runZero wins on flexibility of deployment, ease of use, and scalability for larger organizations. If your security team consists of more than one person or your organization operates at more than one physical location, runZero is for you.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

How to find Citrix NetScaler

Earlier this week, Citrix alerted customers to three vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Surfaced by researchers at Resillion, these vulnerabilities include a critical flaw currently being exploited in the wild to give attackers unauthenticated remote code execution on vulnerable NetScaler targets (CVE-2023-3519). Compromised organizations include a critical infrastructure entity in the U.S., where attackers gained access last month and successfully exfiltrated Active Directory data. And at the time of publication, there appear to be over 5,000 public-facing vulnerable NetScaler targets. 

What are Citrix NetScaler ADCs and Gateways? #

NetScaler Application Delivery Controller (ADC), formerly known as Citrix ADC, acts in a number of capacities to ensure reliable application delivery to users. This can include load balancing across application servers, off-loading of certain operations, security protections, and policy enforcement.

NetScaler Gateway, formerly known as Citrix Gateway, provides single sign-on (SSO) from any device to multiple applications through a single URL.

What is the impact? #

The three reported vulnerabilities affecting NetScaler ADC and Gateway products are of various types, and each include different preconditions required for exploitation:

  • Unauthenticated remote code execution (CVE-2023-3519; CVSS score 9.8 – “critical”)
    • Successful exploitation requires the NetScaler target be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or “authentication, authorization, and auditing” (AAA) virtual server.
  • Reflected cross-site scripting (XSS) (CVE-2023-3466; CVSS score 8.3 – “high”)
    • Successful exploitation requires the victim to be on the same network as the vulnerable NetScaler target when the victim loads a malicious link (planted by the attacker) in their web browser.
  • Privilege escalation to root administrator (nsroot) (CVE-2023-3467; CVSS score 8.0 – “high”)
    • Successful exploitation requires an attacker having achieved command-line access on a vulnerable NetScaler target.

U.S.-based CISA has reported attackers exploiting CVE-2023-3519 to install webshells used in further network exploration and data exfiltration, causing CVE-2023-3519 to be added to CISA’s Known Exploited Vulnerabilities Catalog. Other common attacker goals, like establishing persistence, lateral movement, and malware deployment, are potential outcomes following successful exploitation.

Are updates available? #

Citrix has made patched firmware updates available. Admins should update older firmware on vulnerable NetScaler devices as soon as possible.

CISA has also made additional information available around indicators of compromise and mitigations.

How do I find potentially vulnerable NetScaler instances with runZero? #

From the Asset inventory, use the following prebuilt query to locate NetScaler instances in your network:

hw:netscaler or os:netscaler

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are running updated firmware versions.

You can also use the following query in your Software and Services inventory pages to locate NetScaler software:

product:netscaler

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are updated versions.

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Why NACs are inadequate for cyber asset management

Asset inventory is foundational to security: before you protect a device, you must know about it. You may rely on data from your network access control (NAC) and associated network aggregation tools to provide your asset inventory. However, if you’ve found compromised assets but can’t find them in your asset inventory, you may have realized that NACs aren’t the best at asset discovery. Allowing or denying access to the network on Layer 2 is their primary function, but finding everything on your network is a different problem. Let’s examine why.

NACs have limited visibility to endpoints on the network #

Cyber asset management aims to maintain a complete inventory of everything connected to your network, from IT to OT, cloud to remote devices. NACs, such as ISE, FortiNAC, CounterACT, and Portnox, employ discovery methods that miss and mis-fingerprint devices.
  1. Listening to broadcasts NACs listen for endpoint attributes directly via a couple of broadcast protocols: CDP/LLDP and DHCP. Cisco Discovery Protocol (CDP) and its vendor-agnostic cousin Linked Layer Discovery Protocol (LLDP) primarily provide information about networking devices or phones only. The standard Dynamic Host Control Protocol (DHCP) only provides information about an endpoint’s IP address, operating system, and MAC addresses.
  2. Direct network calls NACs collect attributes from individual hosts rather than a network-wide scan. They use many protocols: DNS, HTTP, RADIUS, and SNMP. Remote Authentication Dial-In User Service (RADIUS) also provides low-level information like MAC, IP address, and location information. Domain Name System (DNS) only provides information about hostnames and IP addresses. If a web service exists, Hypertext Transfer Protocol (HTTP) can provide additional details like application type, operating system, software vendor, and software revision. DNS and HTTP must work alongside other discovery methods since NACs require IP-to-MAC mappings for each endpoint.
  3. Nmap Nmap is the gold standard for ad-hoc network scanning. Network discovery and security auditing are frequent use cases for this free and open-source utility. However, it has some challenges for general asset discovery at scale.
  4. Passive network monitor Deploying one or more appliances on a network to eavesdrop on network traffic is a common technique. To make it work, you must send network traffic to the appliance(s) through switch reconfiguration or tap insertions. It’s important to note that network location matters. Eavesdropping at a network “choke point” is ideal since it ensures visibility into all traffic. However, the fingerprints lack precision and accuracy if an asset rarely talks on the network or is terse. As more devices encrypt traffic, the fingerprinting accuracy gets worse.
  5. NetFlow NetFlow is a (marginally) cheaper and easier alternative to a passive network monitor. It collects and stores only Layer 2-4 information, such as source and destination IP and ports, as well as MAC address.
  6. Agent All NAC vendors provide agents (e.g., AnyConnect, FortiNAC agent, SecureConnector, AgentP). Even NAC solutions that claim to be agentless include them. Running software on the endpoint provides a wealth of details that help NACs apply granular policies, which works well for managed devices if IT can install the agent.
  7. Credentialed queries Some NAC will log in to a device via Windows Management Instrumentation (WMI) to profile it. Similar to agents, this approach gives a lot of details. Unfortunately, you need to know the credentials first, which means this only works well for managed IT devices.
Note: Organizations rarely use CDP and Nmap in production for NACs, but I’ve included them here for completeness.

Incomplete asset inventory: why NACs fall short #

The current methods of discovery may overlook assets and incorrectly identify them. Broadcasts aren’t propagated over the network and don’t give a broad view of assets. Direct network calls and Nmap (as used by NACs) only provide additional details about devices already known to the NAC. Passive network monitors and NetFlow collectors, despite the effort invested, provide limited detail. Agents are great, but only for managed IT devices.
  1. Unmanaged IT machines NACs do not cover these servers, laptops, and desktops. Either the installation got missed, or nobody knew that these machines existed. The other methods won’t tell you much more than an IP address, MAC address, and operating system.
  2. Corporate IoT Offices contain many IoT devices that can’t install an NAC agent because the platform is not supported. The NAC uses alternative discovery methods to identify a device only as a Linux machine or an IoT platform device (such as Espressif or Raspberry Pi). But they could be anything. Think of your printer, IP phone, video conferencing device, thermostat, surveillance camera, and door controller that lets you in when you swipe your access badge. Knowing the hardware matters in a security investigation.
  3. OT equipment Usually, industry-specific operational technology (OT) includes warehouse technology, production lines, biomedical equipment, and energy transmission. A programmable logic controller (PLC) that controls the production-line robot does not support installing an agent.
Here’s an example of device details detected by a leading NAC:
  • Hostname: dev
  • Operating system: Windows 7 SPI1
  • VLAN: 77
  • Current switch: 1.1.1.1
  • Connection: Up
  • Location: Office
  • First Seen: 05/24/2023 at 10:39 AM
  • Last Seen: 05/24/2023 at 10:39 AM
  • IPv4 Address: 192.168.40.248
  • MAC Address: 00:0c:29:59:c4:65
Asset information from leading NAC includes the IP and MAC addresses and the network location of the discovered device.
By contrast, runZero provides a great deal of detail by default:
runZero shows much richer information about networked devices than NAC profiling (without agents).

Asset detail comparison: Leading NACs vs. runZero #

Let’s compare and contrast what each solution found:
Leading NACs (without agents or credentialed queries) runZero
First seen ⏺ ⏺
Last seen ⏺ ⏺
IP address ⏺ ⏺
Secondary IPs ○ ⏺
MAC address ⏺ ⏺
Seen by sensor/scanner ⏺ ⏺
Device type ◐ ⏺
Operating system ⏺ ⏺
Hardware ○ ⏺
Risk ○ ⏺
Outlier score ○ ⏺
Vulnerabilities ○ ⏺
Hostnames ⏺ ⏺
Domain names ○ ⏺
Ownership ○ ⏺
Recent user ○ ⏺
Open ports ○ ⏺
Searchable banners ◐ ⏺
Protocols ○ ⏺
Software products ◐ ⏺
Upstream switches & ports ⏺ ⏺
Location ◐ ⏺
Missing devices or mis-fingerprinting them become even more problematic when using NACs for enforcement. Suppose a NAC incorrectly identified an IP camera as a Linux server. Your NAC is applying policy to a camera when it’s clearly not.

Underutilizing NAC features to handle all types of devices #

Allowing and denying access to individual endpoints is a central selling point for NACs and an essential control as part of a larger zero-trust networking strategy. Organizations do one of two things to meet the challenge of partial asset inventory and vague fingerprinting regarding their NAC.
  1. Partial enforcement Without a full and accurate asset inventory, you risk booting legitimate, business-critical assets off the network. Many organizations selectively enforce based on the relative number of unmanaged devices. Enforcement is commonplace on wireless segments, more miss than hit on wired IT segments, and rare on OT segments.
  2. Exclude MAC addresses Organizations that attempt enforcement at scale must maintain a list of MAC addresses that bypass enforcement control. Keeping that list up to date is time-consuming and error-prone without a bespoke tool, which accents the depth of the problem, especially in OT environments.

NAC focuses on the LAN #

The security posture of a device viewed by the attacker is not in the scope of a NAC. They adjudicate network access which worked well in a time when most of an organization was in the corporate office. A cyber asset management solution, on the other hand, provides an inside-out and outside-in view of the inventory. This view includes the external attack surface of an asset, which can be valuable information, such as when RDP is active on a public IP.

Risks and slowdowns due to missing devices #

If you are missing assets in your inventory, you can’t actively manage your security posture. You can only successfully find EOL devices, insecure configurations, and vulnerabilities if you know about all your network’s devices. Asset inventory gaps can impede quick action by causing delays when identifying potentially compromised devices on specific IP addresses. Still, you can’t figure out what that device is. You lose valuable hours while the bad guys get deeper into your network. An accurate, complete cyber asset inventory is crucial.

A cyber asset management solution that covers assets from IT to OT, cloud to remote devices #

runZero is a cyber asset management solution that includes CAASM functionality. It combines integrations with EDR and other sources with a proprietary network scanner that is fast and safe even on fragile IoT and OT networks. runZero scales up to millions of devices, but it’s easy to try. The free 21-day trial even downgrades to a free version for personal use or organizations with less than 256 devices. Find out what’s connected to your network in less than 20 minutes.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

runZero 3.10: New integrations page, UX improvements, Black Hat 2023!

What’s new in runZero 3.10: #

  • Integrations page and menu updates
  • Redesigned Explorer detail page
  • Coming soon!

Integrations page and menu updates #

Previously, runZero customers used the Connect and Export menus to find and utilize integrations in the runZero console. As of 3.10 the Connect drop-down menu has been renamed to Integrate, and a new page has been added to the left menu bar titled Integrations. The integrations page displays all available integrations for runZero, with direct links to documentation and configuration pages where applicable. The integrations page shows not only the inbound integrations for runZero but our outbound and custom integrations as well, all in one place. We hope this change makes it easier for new and existing customers to configure integrations. It also showcases how runZero can work with other products and technologies in your ecosystem.

Redesigned Explorer detail page #

Officially released in 3.9.6, a redesign of the Explorer detail page refreshes the view of all existing details, and allows runZero users to view Explorer tasks and their status from the details page. Additionally, you can now edit Explorer details directly from the details page.

Coming soon: Want to see what we’ve been devOTing ourselves to lately? #

We have a new feature coming in August to assist with discovering fragile devices in OT environments and beyond. Our R&D teams have worked hard these past few months to make this a reality, and we’re excited to introduce it! Are you curious about our new OT capabilities? Are you going to Black Hat? Reach out to us to schedule an appointment and hear all about it.

Protocol improvements #

Through this release the research team has added or improved the following items:
  • Improved discovery of SSDP services providing visibility into devices that may need those services disabled
  • Added additional data extraction capabilities to our SSDP and UPnP probes
  • Added detection of SOCKS proxies
  • Improved our detection and handling of spoofed/invalid NTLMSSP versions in the SMB probe

Fingerprint improvements #

New fingerprints were added for products by Debian, DW, FRRouting Project, Google, Huawei, IADea, IBM, IndigoVision, ISC, Lexmark, MiniDLNA Project, Netgear, Nokia, ONVU Technologies Group, OpenBSD, Palo Alto Networks, QSI, ServerTech, Siemens, Siqura, Sony, StarSat, Tycho, and Ubiquiti.

Rapid response #

The research team published a blog post about finding vulnerable instances of the Fortinet SSL VPN in response to the publication of a critical vulnerability that could allow remote unauthenticated exploitation.

Release notes #

The runZero 3.10 release includes a rollup of all the 3.9.x updates, which includes all of the following features, improvements, and updates.

New features #

  • An integrations page has been added to improve visibility and simplify configuration.
  • An update to the Trends tab of Attack Surface Management graphs has been added to show enhanced date and time data.

Product improvements #

  • Assets with hostnames starting with a numeric prefix are now allowed to merge.
  • Inventory searches using keyword organization properly warn that it cannot be used unless either that specific organization or the All Organizations option are chosen from the drop-down in the upper right of the console.
  • Improved detection of various printer models.
  • The Explorer details page has been redesigned.
  • Improved database performance for asset, site, and organization delete operations.
  • Improved database performance for outlier and vulnerability processing.
  • Improved database performance for concurrent integration processing.
  • Additional MAC address detection through SSDP and UPnP services.
  • Improved operating system and hardware fingerprinting of Palo Alto Networks devices.
  • Trial accounts can now create Custom Integrations.
  • Discovery of SSDP services has been improved.
  • Improved handling of email send errors.
  • Asset correlation has been improved for switches with overlapping MAC addresses.
  • Improved detection of AIX systems.
  • Reduced OS fingerprinting false positives against assets with non-Microsoft SMB stacks.
  • Improved handling of login tokens.

Integration improvements #

  • Improved import of assets from Azure Active Directory.

Bug fixes #

  • A bug that could cause the MDNS probe to panic in limited scenarios has been resolved.
  • An issue that could result in the old Explorer details pages being shown has been resolved.
  • A bug preventing Microsoft 365 Defender OAuth Client Credential tokens from accessing Azure government environments has been resolved.
  • A bug that could result in invalid Last Seen values for Rapid7 assets has been resolved.
  • A bug that could lead to stale service entries has been resolved.
  • A bug causing some goals to return an error has been resolved.
  • An issue that could prevent alert rule actions from modifying asset ownership based on software, service, or vulnerability query results is resolved.
  • An issue where dynamic content did not have the header Cache-Control: no-store has been resolved.
  • A bug has been fixed that could cause scans to be dropped with explorer failed to queue task when the Explorer was already handling the configured maximum number of simultaneous scans.
  • A bug causing the task start time to be shown for the scan start time has been resolved.
  • A bug that could prevent the creation of new goals has been resolved.
  • A bug that could prevent those with the annotator role from viewing or modifying Asset Ownership has been resolved.
  • An issue that could prevent navigation to the Account settings page has been resolved.
  • A bug causing JavaScript errors to be thrown when adding or editing Google Workspace connector tasks has been resolved.
  • A bug with thumbprint validation for the LDAP integration has been resolved and the related error messages have been improved.
  • A bug where the link to help for query syntax led to a missing page has been resolved.
  • A bug preventing the Explorer interface and addresses from being populated has been addressed.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.