Attack Surface Mapping of Country-Wide Networks - a Technical Report

The escalating landscape of cyber threats necessitates a comprehensive approach to detecting compromised devices and services across wide-area networks, particularly for national security. This paper presents methodologies and results from a study aimed at enhancing the cybersecurity posture of Hungary’s digital infrastructure, facilitated by the national Computer Security Incident Response Team (CSIRT). By employing active and passive attack surface detection, digital fingerprinting, and utilizing advanced data enrichment techniques from sources such as certificate transparency lists, we enhance the detection and analysis capabilities for compromised entities within the .hu domain and Hungarian IP address spaces. Our multi-faceted approach not only supports the early identification of security breaches but also enables proactive risk mitigation, contributing to a strengthened national cybersecurity framework.