Google recently announced that it will open source its Tsunami vulnerability Scanner , aiming to help large-scale enterprises protect their customer data
The service, which was launched on GitHub last month , was previously used internally by IT giants, but will now be made open source.
Compared to other vulnerability scanners, Tsunami is designed to detect vulnerabilities in large networks involving hundreds of thousands of devices, making it suitable for large enterprises.
Tsunami consists of two main components and its structure is such that it allows the implementation of new features by adding specific plugins.
The first component is a scanner based on nmap, which scans a company's network for open ports and then tests each one individually.
According to Google, in addition to nmap, the scanner also uses some custom code.
The second component uses the scan results to test devices against a list of vulnerabilities that execute known exploits.
This component allows users to add new capabilities by adding plugins.
The initial version of the Tsunami tool includes functional modules for detecting the following security issues:
Exposed User UIs: Applications like Jenkins, Jupyter, and Hadoop Yarn come with UIs that allow the user to schedule workloads or execute system commands. If these systems are exposed to the Internet without authentication, attackers can leverage the application's functionality to execute malicious commands.
Weak credentials: Tsunami uses other open source tools, such as ncrack, to detect weak passwords used by protocols and tools including SSH, FTP, RDP, and MySQL.
Google plans to release new extensions for the Tsunami scanner, which will allow users to detect a broader range of vulnerabilities in the future. The extensions will be released on GitHub.
