Shadow IT: Mapping Switzerland’s External Attack Surface
Shadow IT doesn’t come from one bad decision. It builds up over time as infrastructure grows, people move between teams and companies, vendors deploy systems, cloud environments change, and documentation falls out of date. A single forgotten development instance or an untracked database server can become the path to a serious breach. I have spent years running Internet-wide scanning and building the tooling behind it at FullHunt. I have also run hundreds of security reviews focused on Shadow IT and the ways organizations gradually introduce risk into their external attack surface. In this talk, I’ll show how Shadow IT grows and scales across organizations and the recurring patterns I have seen in the wild. I will introduce the Attack Surface Reduction Maturity Framework, a practical model organizations can use to understand where they stand in their attack surface reduction journey and how they can move from outdated inventories to continuous visibility. Finally, I will present real findings discovered during this research and responsibly disclosed to Swiss organizations.
AI Summary
Disclaimer: This session information was generated with the help of AI.
The information has been reviewed and refined by the Swiss Cyber Storm team before publishing.
Mazin Ahmed, founder of FullHunt, presents Internet-wide scanning research mapping Switzerland’s external attack surface across 25 million IPv4 addresses and around 3,000 major organizations. Focusing on shadow infrastructure, such as forgotten cloud servers and development instances, he shows how rushed deployments, staff turnover, mergers and acquisitions, and outsourcing create exposures that attackers find first. Findings include unauthenticated MongoDB and Elasticsearch instances, already-ransomed databases, writable Docker registries that could enable supply chain attacks, open AI gateways and easily fingerprinted honeypots. He argues for continuous scanning and a national asset inventory so that exposure to a new zero-day can be assessed immediately.
Video chapters
0:00Introduction and speaker background3:30Defining shadow IT and shadow infrastructure5:27Breaches at the European Commission and Equifax8:46Why shadow IT emerges and attracts attackers12:37Exposed Swiss databases and honeypots17:25Writable Docker registries as supply chain risk20:41Open Elasticsearch instances and AI gateways23:40Outdated software and further findings24:55National scanning, research and takeaways28:10Q&A on IPv6 scanning
Key facts
- FullHunt's scans identified around 2,900 MongoDB instances in Switzerland; 13 databases had no authentication enabled and seven had already been compromised, with a ransom note left behind.
- The research found around 26 externally accessible Docker registries holding about 180 unique repositories and 24 gigabytes of image data, including embedded secrets such as database credentials; 22 registries allowed write access.
- Of almost 2,000 Elasticsearch instances in Switzerland, around 76 were reachable from the Internet without authentication, including some exposing a security operations team's infrastructure and security data.
- FullHunt's passive scanning showed that at least 52% of the organizations scanned had systems with known vulnerabilities.
- The Swiss National Cyber Security Centre (NCSC) runs continuous external vulnerability scans, but the results are not shared publicly.
Ideas
- Shadow IT infrastructure accumulates gradually: systems deployed without documentation to meet deadlines, ownership lost when people change teams or employers, personal experiments that become widely used without a security review, and there are also environments inherited through mergers and acquisitions (M&A).
- What matters is the window between a vulnerability's disclosure and its exploitation; forgotten assets such as the Apache Struts system behind the 2017 Equifax breach are not patched in time because nobody knows they exist.
- A self-hosted Docker registry exposed with default settings lacks authentication, so anyone with write access can overwrite an image tag and have downstream deployments pull a backdoored image, turning the registry into a supply chain attack vector.
- Honeypots deployed at scale from identical templates, sharing the same three passwords and database schemas, can be identified and mapped as a whole by anyone scanning the Internet.
- Scanning the entire Swiss IPv6 space is close to impossible, so FullHunt attributes IPv6 addresses to organizations through their Domain Name System (DNS) records instead.
Keywords
- shadow IT
- external attack surface
- scanning
- Docker registries
- inventory
- NCSC
Quotes
- “If you don't really know every internet facing asset that you have, you cannot really secure them.”
- “When you offshore the the system you are not offshoring the risk. You are still responsible for the risk.”
- “Having a continuous scan would help but doing this on a monthly base or a quarterly base against the entire attack surface is not going to work out.”
Recommendations
- Maintain a continuously updated inventory of every Internet-facing asset and scan it continuously rather than monthly or quarterly, so that newly disclosed vulnerabilities can be matched to exposed systems before attackers do.
- Enable authentication and restrict network exposure for self-hosted services such as Docker registries, databases and AI gateways like Ollama or LiteLLM, and threat-model customer-facing registries as part of the supply chain.
- Randomize honeypot deployments, including credentials and database structures, so that the infrastructure cannot be pinpointed as a whole.
Resources
- FullHunt — Tool — Shows defenders what an attacker can see about their domain, including ports, network services and DNS records.
- mazen160/struts-pwn — GitHub Repository — Illustrates how quickly a single critical vulnerability must be checked across a forgotten attack surface.
About the speaker
Mazin Ahmed
CEO and Founder
at
Fullhunt
Mazin Ahmed is a product security and offensive security engineer with 12+ years of experience across product security engineering, vulnerability research, red-team operations, cloud security, AI/LLM security governance, bug bounty operations, and security-program building.
Read more …
Read more …