January 2025 Summaries

Detectify addresses the challenge of safely conducting high-volume security tests on customer systems by implementing a custom-built global rate limiter to prevent server overloads. This rate limiter operates using a blocking token bucket algorithm, which controls the flow of requests by maintaining a refillable "bucket" of tokens for each target, denying requests when the bucket is empty. The system is designed to handle a high throughput with low latency, utilizing Redis for its single-threaded operation and atomic execution capabilities. Despite evaluating existing rate-limiting tools, Detectify developed its own solution to meet specific requirements, such as dynamic individual target configurations. This implementation enables the company to safely scale its security testing efforts, ensuring customer systems are not overwhelmed while maintaining robust security testing capabilities. The solution has proven effective, managing up to 40,000 requests per second with minimal latency and error rates, and creatively logs bucket refills to monitor request limits without incurring excessive costs.

Subdomain takeover is a critical cybersecurity threat that occurs when attackers exploit forgotten or misconfigured DNS records to seize control of a subdomain, potentially leading to data breaches, phishing attacks, and brand damage. This vulnerability arises when subdomains point to unused third-party services, allowing adversaries to create accounts and deploy malicious content. Despite being a well-known issue since ethical hacker Frans Rosén and Detectify popularized it in 2014, it remains prevalent and often overlooked, affecting even major companies like Microsoft, Sony, and Uber. Thomas Chauchefoin, a security analyst, emphasizes the importance of maintaining good DNS hygiene and monitoring external attack surfaces to prevent such attacks. Tools like Detectify help organizations identify and mitigate these risks by leveraging a network of ethical hackers to continuously scan and alert on vulnerable subdomains, ensuring that companies can address potential takeovers before they occur.

A critical vulnerability, CVE-2025-0282, has been discovered in Ivanti's Connect Secure, Policy Secure, and ZTA Gateways, potentially allowing unauthenticated remote attackers to execute remote code on the affected systems. This flaw impacts specific versions of these products, and Detectify Surface Monitoring has initiated payload-based tests to detect the vulnerability since January 13, 2025. Detectify employs techniques such as sending payloads to request headers and URLs to identify vulnerabilities, and their Application Scanning involves extensive crawling and fuzzing of application parameters. Ivanti has released patches for some affected versions to address this issue.

Detectify's blog series introduces a new engine framework that enhances the efficiency of monitoring customers' attack surfaces, allowing the company to address vulnerabilities swiftly, such as a critical 0-day vulnerability managed within a day. The process of monitoring involves designing and distributing security tests, or monitors, with varying cadences depending on their importance, to manage traffic and system load effectively. This is achieved through a framework that supports parallelized monitor distribution using PostgreSQL features like "select for update skip locked" to handle millions of monitors daily. The system employs a "slow dripping" technique to distribute tests over time, avoiding overwhelming customers' systems and incorporates self-healing measures to ensure continuous operation. Observability and scalability are emphasized, with the use of lag-duration buckets to track distribution efficiency and prevent infrastructure over-provisioning. This innovative system has increased test frequency and efficiency without compromising performance, benefiting all engine frameworks with easy integration.