KRI Rating

1. Storage Technologies

MongoDB
Redis
ElasticSearch
Memcached
MQTT
MySQL
PostgreSQL
MsSQL
We've selected 8 storage technologies that could expose data if not properly configured. Therefore, if an IP address has one of these technologies without authentication, its level of exposure (storage_score) is automatically considered extreme.

2. Remote Management Services

Use of telnet
RDP without proper firewalling
VNC without authentication
X11 without authentication
If an IP address is using telnet instead of SSH or has RDP, VNC and X11 without the correct configurations (proper firewalling of authentication for instance), one can consider that the level of exposure (rms_score) of that IP address is extreme.

3. Encryption

The use of unencrypted services, use of algorithms that are not recommended by security guidelines are only a few examples of what contributes to increase the vulnerability level of an IP address when it comes to encryption.

SSH insecure configuration (ssh_score)

Presence of Debian Weak Keys
Keys with key length inferior or equal to 1024 bytes
Kex Algorithms sha1
Mac Algorithms sha1, md5, md4, md2
Encryption Algorithms 3des-cbc, 'blowfish-cbc', 'cast128-cbc'
Weak SSL Configuration (ssl_score)

Expired certificates
Self-signed certificates
No support for OCSP Stapling
Signature Algorithm md5withRSAEncryption or sha1withRSAEncryption
Vulnerable to Heartbleed
Vulnerable to CCS Injection
Vulnerable to logjam
Vulnerable to drown
Vulnerable to poodle
Vulnerable to crime
No support for Renegotiation
Weak Email Configuration (wec_score)

Use of POP3 instead of POP3S
Use of IMAP instead of IMAPS
Use of SMTP instead of SMTPS
FTP (ftp_score)

Use of FTP instead of FTPS
Lack of HTTPS across all services (http_score)

Lack of HTTPS across all services
When it comes to encryption, if an IP address is using Debian Weak Keys, has any of the vulnerabilities listed for SSL, has weak email configurations, uses FTP instead of FTPS or lacks HTTPS across all services, then its level of exposure is classified as extreme. For all the other parameters analysed in this category, the level of exposure of an IP address will increase with the number of times one of those is present.

4. CVE

Common Vulnerabilities and Exposures (CVE) is measured by adding the values of CVSS -Common Vulnerability Scoring System of the combinations of products and versions detected (cve_score).

For example, if an IP address has multiple combinations of products and versions with low CVSS values or a few combinations but high CVSS values, then the vulnerability scoring for this parameter is going to be high.

5. Web

Lack of security headers in web services: Referrer-Policy, X-XSS-Protection, Content-Security-Policy, Public-Key-Pins, X-Content-Type-Options, X-Frame-Options and Strict-Transport-Security
The lack of at least one security header represents an extreme level of exposure (web_score).

6. Attack Surface

The attack surface is measured by the number of open ports of an IP address. The higher number of open ports, the higher the vulnerability level (ports_score).

7. Torrent Downloads

If an IP address is downloading torrents, the risk level (torrents_score) is considered extreme.



################




Cookies and Security Headers are incredibly important parameters when configuring a domain. They ensure that the information is only transmitted via secure connections and that session IDs can't be stolen via XSS or Man-in-the-Middle attacks, for example.

As for SSL, we check if the domain allows for SSL connections and if so, if it is correctly configured (the information transmitted would be encrypted).

1. Cookies

Secure
HTTP only
SameSite
Domain/ Path Attributes
Expire/ Max-age Attributes


2. SSL

Expired certificates
Self-signed certificates
No support for OCSP Stapling
Signature Algorithm md5withRSAEncryption or sha1withRSAEncryption
Vulnerable to Heartbleed
Vulnerable to CCS Injection
Vulnerable to logjam
Vulnerable to drown
Vulnerable to poodle
Vulnerable to crime
No support for Renegotiation