Many months after U.S. Cert issued their first warning to the public regarding exploits to the vulnerable port 445 allowing for a remote attacker to take over a vulnerable computer, many computers that are publicly exposed continue to be unpatched and shielded from attacks against port 445.  First there was WannaCry that attacked Windows Computers.  Now there is SambaCry, that is attacking Linux machines.  Even more nasty malware that relies upon leaked U.S. Intelligence agency Cyber weapons is bound to continue to wreak havoc unless ISPs take action and block port 445.

A review today of the number of hosts within the U.S. on shodan.io reveals the following ranked list as of today:

1. California 134,382
2. Wyoming 40,823
3. Arizona 34,273
4. New York 32,406
5. Texas 27,752
6. Virginia 22,899
7. Illinois 14,333
8. Washington 11,895
9. Oregon 10,834
10. New Jersey 10,135
11. Florida 9,241
12. Georgia 6,924
13. Missouri 6,438
14. Colorado 6,276
15. Pennsylvania 6,206
16. North Carolina 5,947
17. Michigan 5,560
18. Nevada 4,945
19. Oklahoma 4,509
20. Utah 4,052
21. Ohio 3,742
22. Minnesota 2,667
23. Iowa 2,326
24. Kansas 2,322
25. Idaho 2,321
26. Delaware 2,287
27. Massachusetts 2,097
28. Indiana 1,804
29. Maryland 1,691
30. North Dakota 1,247
31. Nebraska 1,227
32. South Carolina 1,189
33. Arkansas 903
34. Wisconsin 822
35. Kentucky 810
36. Alabama 775
37. Tennessee 775
38. South Dakota 697
39. Louisiana 687
40. Montana 637
41. Alaska 636
42. Connecticut 596
43. Mississippi 543
44. New Mexico 296
45. Vermont 254
46. New Hampshire 229
47. Maine 222
48. Rhode Island 221
49. Hawaii 215
50. West Virginia 134

SMB Port 445 is the same port that was used to attack Sony.

When will the U.S. and State governments kick into action and start forcing ISP’s to police their vulnerable machines?

Top Cities that make up the largest vulnerable attack surface within the U.S. as of today include:

1. Los Angeles 83,613
2. Phoenix 23,841
3. Cheyenne 40,665
4. Buffalo 23,106
5. Thousand Oaks 17,205
6. Ashburn 14,803
7. Chicago 10,379
8. Dallas 10,077
9. Boardman 9,118
10. San Antonio 7,376

There remain a total of 455,023 computers within the U.S. still vulnerable to these types of SMB Port 445 attacks.

Mitigation boils down to the top 25 ISPs taking actions to stop the malware attacks by forcibly blocking Port 445.