Google has decided to release as open-source a vulnerability scanner for large-scale enterprise networks named Tsunami.
“We have released the Tsunami security scanning engine to the open source communities. We hope that the engine can help other organizations protect their users’ data. We also hope to foster collaboration, and encourage the security community to create and share new detectors on top of Tsunami.” reads the Google’s announcement.
Tsunami was used internally by the IT giants that last month has released its project on GitHub, it will be maintained by the open-source community.
Unlike other vulnerability scanners, Tsunami has been designed to find vulnerabilities in large networks that include hundreds of thousands of devices.
Tsunami is split into two main components and has modular structure that allows to implement new features by adding specific plugins.
The first component is a scanner based on nmap, which scans a company’s network for open ports and then tests each one.
Google said the port fingerprinting module is based on the industry-tested nmap network mapping engine but also uses some custom code.
The second component uses the results of the scan of the fingerprinting module to test the devices against a list of vulnerabilities running known exploits.
This module allows users to add new testing capabilities by adding adding plugins.
The initial version of the Tsunami tool already includes modules to detect the following security issues:
Google plans to release new plugins for its Tsunami scanner to allow users to detect a broader range of vulnerabilities in the future. The plugins will be released through a GitHub repository.
“In the coming months, we plan to release many more detectors for vulnerabilities similar to remote code execution (RCE). Furthermore, we are working on several other new features that will make the engine more powerful and easier to use and extend.” concludes Google.
(SecurityAffairs – hacking, Tsunami)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.