What is CERT Polska’s Artemis Security Scanner

Who is CERT Polska and What They Do?

CERT Polska, established in 1996 as Poland’s first computer emergency response team, has played a significant role in the field of computer security since then. Operating within NASK (Research and Academic Computer Network), the team is supported by a research institute that manages the .pl domain and provides advanced IT services.

From its inception, the primary focus of CERT Polska has been responding to security incidents and collaborating with other similar units worldwide. The team’s work is not limited to handling security incidents; it also includes extensive research and development activities related to security.

In 1998, CERT Polska became a member of FIRST, the international forum of incident response teams, and since 2000, it has been part of TERENA TF-CSIRT, the European working group for response teams, accredited by Trusted Introducer. In 2005, CERT Polska led the establishment of the “Abuse FORUM,” which brings together security teams in Poland. In 2010, by joining the Anti-Phishing Working Group, which consists of companies and organizations fighting online crime, CERT Polska further
strengthened its initiatives in this area.

In this way, CERT Polska operates as a pioneering organization in the field of cybersecurity, both nationally and internationally.

What Are the Main Responsibilities of CERT Polska?

1. Recording and handling network security incidents,
2. Active intervention in the event of direct threats to users,
3. Cooperation with other CERT teams in Poland and worldwide,
4. Participation in national and international projects related to IT security,
5. Researching methods for detecting security incidents, malware analysis, and
systems for exchanging information about threats,
6. Development of proprietary and open-source tools for detecting, monitoring,
analyzing, and correlating threats,
7. Regular publication of the annual CERT Polska Report on the security of
Polish cyberspace,
8. Information and training activities aimed at raising awareness about IT
security,
9. Maintaining a blog at cert.pl as well as Facebook and Twitter accounts,
10. Organization of the annual SECURE conference,
11. Analysis and testing of IT security solutions.

The Artemis Security Scanner

What is CERT Polska’s Artemis Security Scanner?

Artemis is an open-source vulnerability scanner developed by CERT Polska. It is designed to detect misconfigurations and security vulnerabilities on websites. The tool automatically generates reports on identified issues and ensures that they are sent to the affected institutions. Thanks to its modular structure, it provides the ability to consolidate results from various tools into a single dashboard.

The Architecture of the Artemis?

Artemis is based on the Karton Framework and conducts its scanning operations through specialized Karton modules integrated into this infrastructure. Each of these modules is designed to perform specific tasks and operates in three main stages:

1. Accept Tasks: The modules first accept a task. For example, examining a domain name is part of this stage.

2. Perform Some Actions: Specific actions are performed on the accepted task. For instance, subdomains of a domain are scanned using https://crt.sh/

3. Produce Other Tasks: In the final stage, new tasks are generated based on the information gathered from the current task. For example, additional scans are conducted on the detected subdomains.

With this modular structure, the scanning process offers the following advantages:

Parallel Processing: The scanning operation can be broken down into smaller parts, allowing multiple tasks to be worked on simultaneously. This increases both the speed and efficiency of the operations.

Easy Expandability: Adding new modules is quite simple, allowing Artemis to be continuously updated and improved.

The diagram below explains the flow of tasks through a small subset of Artemis
modules:

What Are the Modules of the CERT Polska’s Artemis Security Scanner?

The Artemis tool includes many specialized modules used to detect and analyze various vulnerabilities. These modules perform tasks such as scanning, classification, vulnerability identification, and information gathering. Each module is designed to serve a specific function, providing flexibility and efficiency in Artemis’s security analysis processes.

The modules used in the Artemis tool are as follows:

bruter.py	classifier.py
device_identifier.py	directory_index.py
dns_scanner.py	domain_expiration_scanner.py
drupal_scanner.py	example.py
ftp_bruter.py	http_service_to_url.py
humble.py	ip_lookup.py
joomla_scanner.py	mail_dns_scanner.py
mysql_bruter.py	nuclei.py
port_scanner.py	postgresql_bruter.py
reverse_dns_lookup.py	robots.py
scripts_unregistered_domains.py	shodan_vulns.py
sql_injection_detector.py	ssh_bruter.py
subdomain_enumeration.py	vcs.py
webapp_identifier.py	wordpress_bruter.py
wordpress_plugins.py	wp_scanner.py

What Types of Vulnerabilities Does CERT Polska’s Artemis Security Scanner Detect?

Artemis includes many modules to identify the attack surface and detect various vulnerabilities or misconfigurations. This tool can perform the following operations:

• Finding Subdomains: It can detect subdomains (e.g., mail.example.com or old.example.com) of a domain (e.g., example.com) using open-source resources like crt.sh, Common Crawl, and the Wayback Machine.
• Port Scanning and Service Identification: Artemis performs port scanning to determine if a service on a specific port is a website or a database. It can also detect services running on non-standard ports, such as port 8002.
• Detecting DNS Misconfigurations: It can identify DNS misconfigurations such as DNS zone transfers and subdomain takeovers.
• Finding Backup, Archives and Configuration Files: Artemis detects backups, archives, and configuration files, like /wp-config.php.bak, to prevent the exposure of sensitive information.
• Brute-Forcing Weak Passwords: The tool can brute-force weak passwords on services like FTP, PostgreSQL, MySQL, SSH, and WordPress. It is also said to soon support brute-forcing random login panels.
• Directory Index Detection: It identifies directory indexing, which may expose hidden or sensitive files.
• Detecting Known Vulnerabilities: Artemis uses Nuclei, an open-source vulnerability scanner, to detect many known vulnerabilities.
• Identifying Email Misconfigurations: The tool checks whether email security measures like SPF and DMARC are properly configured and if the SMTP server is an open relay.
• Detecting SQL Injection Vulnerabilities: Using the SQLMap tool, Artemis identifies SQL injections. Through specialized URL analysis, it can even find SQL injection vulnerabilities in URLs like https://example.com/pages/1.html
• Detecting Accidentally Published Git/SVN Repositories: It detects accidentally exposed Git or SVN repositories to prevent data leaks.
• Version Control for WordPress, Joomla, or Drupal: Artemis checks the versions of these popular content management systems and determines if they are up to date.
• Verifying SSL/TLS Configuration: It checks whether SSL/TLS configurations are secure.
• Checking Domain Expiration: The tool monitors if a domain’s expiration date is approaching, helping to avoid potential service disruptions.
• Limiting Scan Speed: The scan speed can be limited to ensure that only one module scans a host at a time.
• Easily Integrating New Tools: New tools can be easily integrated, and pull requests are accepted for contributions.
• Creating Modules That Work with Different Object Types: Modules can be created to work with various object types, such as domains, HTTP services, or WordPress instances.

What Makes The Artemis Security Scanner Tool Different from Other Security Scanners?

The biggest difference between Artemis and other security scanners is its ability to generate actionable reports that can be directly sent to the relevant institutions regarding the detected vulnerabilities. While creating these reports, it uses built-in heuristic analysis methods to distinguish false positives from real security vulnerabilities.

Here is an example of such a report:

Report: – Addresses Containing Version Control System Data: – https://example.com:443/.git/config Having the code repository publicly accessible can allow an attacker to learn the inner workings of the system and, if passwords or API keys are stored within the repository, gain unauthorized access. Such data should not be publicly available. Recommendation: Even if directory listing is disabled in the repository folder, an attacker may still copy the repository. We recommend making all version control folders (not just the files listed above) inaccessible to external users. – Addresses with Outdated Joomla Versions: – https://example.com:443 – Joomla 2.5.4 Recommendation: If an old site is no longer in use, we recommend taking it down to eliminate the risk of exploiting known vulnerabilities in outdated Joomla versions. Otherwise, ensure that the Joomla core and its extensions are regularly updated. – Domains with Misconfigured Email Sender Authentication Mechanisms: – example.com: No valid SPF record found. We recommend using SPF, KIM, and DMARC mechanisms to reduce the likelihood of successful email spoofing. – example.com: No valid DMARC record found. We recommend using SPF, DKIM, and DMARC mechanisms to reduce the likelihood of successful email spoofing. Recommendation: These mechanisms significantly increase the chances that a recipient server will reject a spoofed message. Even if a domain is not used to send emails, SPF and DMARC records are still necessary to reduce email spoofing risks.

What Is the Artemis Security Scanner’s Scanning Scope?

As of the beginning of 2023, Artemis has scanned over 50,000 domains and IP addresses, as well as more than 250,000 subdomains in Poland. These scans cover educational institutions, local governments, companies, healthcare institutions, banks, universities, politicians’ websites, and local newspapers. Educational institutions include schools and kindergartens, while local government scans also encompass public utility companies. Additionally, companies, healthcare institutions, universities, banks, and news portals that voluntarily requested scanning were included in the scope.

Educational Institutions: Over 36,000 domains and subdomains.

Local Governments: Over 5,000 domains and 95,000 subdomains.

Volunteering Companies: 1,900 domains and 7,000 subdomains.

Healthcare Institutions: 1,100 domains and 2,900 subdomains.

Universities: 890 domains and 84,000 subdomains.

Banks: 521 domains and 2,300 subdomains.

Politicians’ Websites: 397 domains and 1,100 subdomains.

Local Newspapers: 343 domains and 1,800 subdomains.

The scans are repeated multiple times a year to track whether the detected vulnerabilities have been resolved. When CERT PL identifies a critical vulnerability, the relevant institutions are notified. If necessary, direct contact is made to emphasize the seriousness of the situation and ensure the institution understands the risk.

What Vulnerabilities Were Detected by The Artemis Security Scanner?

In 2023, scans conducted by Artemis identified approximately 184,800 vulnerabilities or misconfigurations, of which about 11,600 posed a high level of risk. Over 65,800 scanned domains and subdomains had at least one vulnerability or misconfiguration.

The main findings are as follows:
– Outdated CMS Versions: Around 78,700 Joomla, WordPress, or WordPress plugin versions were outdated.
– SSL/TLS Misconfigurations: More than 44,200 SSL/TLS configuration errors were detected.
– SPF/DMARC Misconfigurations: Email authentication mechanisms were improperly configured in over 27,000 domains.
– Exposed Administrative Panels: More than 16,000 administrative login panels, RDPs, and similar services were left unprotected.
– Information Leaks: In over 11,200 cases, potential domain transfers, directory listings, or phpinfo() exposure were identified.
– Critical Vulnerabilities: 4,500 high/critical vulnerabilities were found using Nuclei or SQLMap.
– Exposed Backups and Logs: More than 3,400 cases involved exposed backups, source code, database dumps, or log files.
– Domain Expiration: In 20 cases, domain expiration was approaching.

Reports regarding these issues are regularly sent to administrators, ensuring swift action and resolution.

Since the scans are automated, some results may contain duplicates or cases where the detected issue is not a real vulnerability. For example, an SSL/TLS misconfiguration may be flagged on an unused website.