Tajikistan comes second of nations most vulnerable to hacking

Heat map of the internet as seen by Rapid7. Each pixel represents 254 IP addresses, colour-coded by how many of those addresses respond to requests. You can see which countries the above blocks refer to by comparing it with the graphic below. Photograph: Rapid7

A new “heat map of the internet” has revealed the countries most vulnerable to hacking attacks, by scanning the entire internet for servers with their front doors wide open.

Produced by information security firm Rapid7, the National Exposure Index finds that the most exposed country in the world is Belgium, followed by Tajikistan, Samoa and Australia. The US comes 14th and the UK 23rd.

The map of the internet was produced by Rapid7’s Project Sonar, a tool which allows the firm to scan every single public-facing IP address in a matter of hours, and look at which services they are offering to the wider internet.

Many, even most, of those services will be appropriate. For instance, a web server with an open port 80, the “door” through which HTTP web pages are sent through, is appropriate (even if the encrypted version, HTTPS, would be more secure). But eight of the top 10 services offered by servers on the internet are unencrypted, such as POP3, an outdated email protocol, and FTP, an insecure method of transferring files over the net.

Having a port open to an insecure service doesn’t mean that the server itself is insecure. But, as Rapid7 explains, “the more services offered by a server or device, the greater the attack surface/exposure of that server or device”. If the server cannot be connected to by a particular service, it can’t be hacked through that service, and so the vulnerability to hacking attacks rises proportionally to the number of services offered by a server.

An open door doesn’t make a business necessarily unsafe, for example; but a business with 20 open doors is likely to be much harder to keep secure than a business with just one.

Tom Beardsley, one of the report’s three authors, was surprised by his own findings. “We expected to find that the most exposed countries were also the richest,” he explained. The richest countries (by aggregate GDP, which place large countries like China near the top of the list) were likely to have the most net-connected devices, which should mean they proportionally have the most potential for damage. “If you’re a rich country, you have a lot of internet. But we didn’t find any correlation between the number of nodes and the exposure.”

Hence Belgium’s position at the top of the exposure list. While the country has fewer nodes than China, a greater proportion of them are offering connections to services which are often insecure at the best of times. Beardsley gives the example of database protocols: while there may be reasons to want to connect directly to a database remotely, doing so introduces a large risk that someone will do so without permission – and steal information. (To be precise, Beardsley described the motivation of an admin placing a database on the net as “¯\_(ツ)_/¯”.)

The motivation for launching the mapping project was an attempt to comprehensively determine quite how insecure the net is. “Everything is on the internet and it’s all broken,” Beardsley says. Previous comprehensive scans have been carried out, such as the 2012 Internet Census, but all to date have been one-off measures. The Internet Census, for example, traded comprehensiveness for repeatability: its methodology involved legally questionable access to household routers in order to perform the scans; if Rapid7’s approach involves pushing on doors to see if they’re open, the Internet Census followed up by actually going in the building to see what it could find.

In the future, Beardsley hopes to repeat the survey regularly, to finally discover whether or not the internet is moving in a good direction. The hope is that the worst of the insecure servers will go offline over the next few years, but as the internet of things becomes a major source of new connected devices, the status quo could change for the worse rather than the better.