-
Notifications
You must be signed in to change notification settings - Fork 25
Home
Project Sonar is a community effort to improve security through the active analysis of public networks. This includes running scans across public internet-facing systems, organizing the results, and sharing the data with the information security community.
Project Sonar gathers data by scanning all IPv4 addresses for a specific service and subsequently extracting certain pieces of information from these services. For example, with SSL, this means identifying all computers on the internet with a public IP address that have TCP port 443 open. Once a computer is identified as meeting these criteria, we attempt to negotiate the SSL protocol with this computer and record the SSL certificates presented.
At no point does Sonar bypass any technical barriers or otherwise access non-public-facing computers. We are doing everything possible to reduce impact on remote networks and we follow best practices as already outlined by the ZMap developers.
All Project Sonar scans are sourced from one subnet, which can be whitelisted or blacklisted at your preference:
- 71.6.216.32/27 (Hosted by CARI.net)
Sonar collects all SSL certificates visible on public IPv4 HTTPS web servers. This data can be used to detect changes such as malicious replacement of certificates or reveal the revocation of a compromised previous certificate. This data is complementary to the Electronic Frontier Foundation's SSL Observatory project. Other purposes include detection of insecurely reused or still actively used revoked certificates. In addition, with the Sonar data one can see all IP addresses / services that claim to represent a particular domain - which in turn can be used for asset identification and detection of malicious certificate usage. Also the certificate fields can be used for soft- and hardware identification in specific situations. The SSL work is being expanded to encompass non-HTTP services, such as STARTTLS-enabled SMTP and IMAP servers.
Sonar collects the HTML content of the index page ("/") of all public IPv4 web servers (TCP port 80), similar to what search engines do, except that Sonar does not crawl the servers beyond the initial root website. One of the potential uses of this data set is the identification of compromised web servers and injected malicious HTML snippets such as "iframes" to non-advertisement web servers. We found several instances of Javascript and direct IFrames pointing to so-called "exploit kits" that try to infect client computers. We also use this data to identify vulnerable embedded devices through fingerprinting the content and headers of the HTTP response Sonar gathers the reverse DNS records for all IPv4 addresses. This data enables organizational asset discovery and can help identify misconfigurations and possibly DNS hijacking attempts.
Sonar uses the domain names gathered from the above processes as well as certain TLD zone files to conduct DNS "ANY" record requests. This data is also useful for asset discovery and the identification of phishing portals, as well as new malicious domains matching algorithmic patterns.
Sonar scans a growing number of UDP services. These include NetBIOS, DNS, NTP, IPMI, NAT-PMP, BACNet, SIP, SNMP, MDNS, and quite a few others. We use this data to identify large-scale misconfigurations and vulnerabilities in consumer, enterprise, and critical infrastructure systems.
All data sets gathered are post-processed and published in compressed form for public use in cooperation with the University of Michigan. You can find the data on Scans.IO.
Project Sonar employs a range of open-source tools, most notably the ZMap software developed by Zakir Durumeric, Eric Wustrow, and J. Alex Halderman at the University of Michigan. We publish a few of our own tools as well, including DAP and Recog, both of which are used in the processing stage of our scanning system.
Feel free to contact research[at]rapid7.com regarding further questions. We also appreciate any community analysis results and hope for your collaboration.
In case you would like to be excluded from some or all of our probes please let us know at research[at]rapid7.com - make sure to mention your CIDR blocks / list of IP addresses and affiliation.