Vulnerability scanning of a remote file system
In an embodiment, a vulnerability scanner component determines one or more target software objects of a remote file system for a vulnerability scan, and performs, via a file system application programming interface (API), a file system decoding procedure based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprise the one or more target software objects. The vulnerability scanner component transmits, to a remote device, a read request associated with the subset of disk blocks, and obtains, in response to the read request, the subset of disk blocks (e.g., rather than a full disk image). The vulnerability scanner component extracts the one or more target software objects from the subset of disk blocks, and performs the vulnerability scan on the extracted one or more target software objects.
1. A method of operating a vulnerability scanner component, comprising:
determining one or more target software objects of a remote file system for a vulnerability scan;
performing, via a file system application programming interface (API) based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprises the one or more target software objects;
mapping the subset of disk blocks to a set of storage blocks that comprises the subset of disk blocks;
transmitting, to a remote device, a read request that requests the set of storage blocks that comprises the subset of disk blocks;
obtaining, in response to the read request, the subset of disk blocks;
extracting the one or more target software objects from the subset of disk blocks; and
performing the vulnerability scan on the extracted one or more target software objects.
2. The method of claim 1 ,
wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and
wherein the read request requests the subset of disk blocks.
3. The method of claim 1 ,
wherein the read request is transmitted to Amazon Web Services (AWS), and the set of storage blocks is a set of Elastic Block Stores (EBSs), or
wherein the read request is transmitted to Microsoft Azure, and the set of storage blocks is a set of Blobs.
4. The method of claim 1 , wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.
5. The method of claim 1 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.
6. The method of claim 1 , wherein the read request does not trigger retrieval of a disk image of the remote file system.
7. The method of claim 1 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).
8. A vulnerability scanner component, comprising:
one or more memories;
one or more transceivers; and
one or more processors communicatively coupled to the one or more memories and the one or more transceivers, the one or more processors, either alone or in combination, configured to:
determine one or more target software objects of a remote file system for a vulnerability scan;
perform, via a file system application programming interface (API) based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprises the one or more target software objects;
map the subset of disk blocks to a set of storage blocks that comprises the subset of disk blocks;
transmit, via the one or more transceivers, to a remote device, a read request that requests the set of storage blocks that comprises the subset of disk blocks;
obtain, in response to the read request, the subset of disk blocks;
extract the one or more target software objects from the subset of disk blocks; and
perform the vulnerability scan on the extracted one or more target software objects.
9. The vulnerability scanner component of claim 8 ,
wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and
wherein the read request requests the subset of disk blocks.
10. The vulnerability scanner component of claim 8 ,
wherein the read request is transmitted to Amazon Web Services (AWS), and the set of storage blocks is a set of Elastic Block Stores (EBSs), or
wherein the read request is transmitted to Microsoft Azure, and the set of storage blocks is a set of Blobs.
11. The vulnerability scanner component of claim 8 , wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.
12. The vulnerability scanner component of claim 8 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.
13. The vulnerability scanner component of claim 8 , wherein the read request does not trigger retrieval of a disk image of the remote file system.
14. The vulnerability scanner component of claim 8 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).
15. A vulnerability scanner component, comprising:
means for determining one or more target software objects of a remote file system for a vulnerability scan;
means for performing, via a file system application programming interface (API) based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprises the one or more target software objects;
means for mapping the subset of disk blocks to a set of storage blocks that comprises the subset of disk blocks;
means for transmitting, to a remote device, a read request that requests the set of storage blocks that comprises the subset of disk blocks;
means for obtaining, in response to the read request, the subset of disk blocks;
means for extracting the one or more target software objects from the subset of disk blocks; and
means for performing the vulnerability scan on the extracted one or more target software objects.
16. The vulnerability scanner component of claim 15 ,
wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and
wherein the read request requests the subset of disk blocks.
17. The vulnerability scanner component of claim 15 ,
wherein the read request is transmitted to Amazon Web Services (AWS), and the set of storage blocks is a set of Elastic Block Stores (EBSs), or
wherein the read request is transmitted to Microsoft Azure, and the set of storage blocks is a set of Blobs.
18. The vulnerability scanner component of claim 15 , wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.
19. The vulnerability scanner component of claim 15 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.
20. The vulnerability scanner component of claim 15 , wherein the read request does not trigger retrieval of a disk image of the remote file system.
21. The vulnerability scanner component of claim 15 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).
22. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a vulnerability scanner component, cause the vulnerability scanner component to:
determine one or more target software objects of a remote file system for a vulnerability scan;
perform, via a file system application programming interface (API) based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprises the one or more target software objects;
map the subset of disk blocks to a set of storage blocks that comprises the subset of disk blocks;
transmit, to a remote device, a read request that requests the set of storage blocks that comprises the subset of disk blocks;
obtain, in response to the read request, the subset of disk blocks;
extract the one or more target software objects from the subset of disk blocks; and
perform the vulnerability scan on the extracted one or more target software objects.
23. The non-transitory computer-readable medium of claim 22 ,
wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and
wherein the read request requests the subset of disk blocks.
24. The non-transitory computer-readable medium of claim 22 ,
wherein the read request is transmitted to Amazon Web Services (AWS), and the set of storage blocks is a set of Elastic Block Stores (EBSs), or
wherein the read request is transmitted to Microsoft Azure, and the set of storage blocks is a set of Blobs.
25. The non-transitory computer-readable medium of claim 22 , wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.
26. The non-transitory computer-readable medium of claim 22 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.
27. The non-transitory computer-readable medium of claim 22 , wherein the read request does not trigger retrieval of a disk image of the remote file system.
28. The non-transitory computer-readable medium of claim 22 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).