Assetnote Launches New Tool to Check for Security Weaknesses and Potential Abuse of IP Whitelisting
Sydney, Australia, June 5 2025
Assetnote, now a Searchlight Cyber company, has published a new tool to identify weaknesses that could allow hackers to bypass network controls by routing traffic through a specific location. Newtowner uses offensive security techniques to test for common misconfigurations in IP whitelisting, which could be abused by cybercriminals to conduct attacks.
Modern cloud environments often have trust boundaries that are weak and can be easily bypassed, such as allowing all traffic from the same data center. This has become more prevalent as cloud platform popularity has increased, with vendors and SaaS platforms often asking users to broadly whitelist ranges. This leaves organizations exposed to malicious ingress and egress of traffic using whitelisted IPs to mask malicious activity.
Newtowner allows a user to test firewalls and network trust boundaries by masquerading traffic to appear as if it’s originating from different datacenters around the world. The user can quickly spin up a GitHub action, Gitlab CI pipeline, Bitbucket pipeline, AWS API Gateway, or AWS EC2 instance to check a difference between their home or office connection and the remote connection for one or more URLs.
Shubham Shah, SVP of Engineering and Research at Searchlight Cyber explained: “IP whitelisting is fundamentally broken. At Assetnote, we’ve successfully bypassed network controls by routing traffic through a specific location – either a cloud provider, geo-location – which makes the connection appear legitimate. If we can do it, hackers can too. This tool is designed to help users to identify whether this vulnerability exists in their setup, enabling them to take mitigative actions that can prevent a potential cyberattack.”
Newtowner has immediately been made publicly available for security researchers through GitHub. The Assetnote team continues to undertake and publish research that helps organizations to identify and remediate security vulnerabilities before they can be exploited.
ends
About Assetnote, a Searchlight Cyber company
Founded in 2018, Assetnote provides industry-leading attack surface management and adversarial exposure validation solutions, helping organizations identify and remediate security vulnerabilities before they can be exploited. Through continuous security testing and verification, Assetnote enables organizations to actionably defend their attack surface without noise. Assetnote customers receive security alerts and mitigations at the same time to disclosure to third-party vendors. In January 2025, Assetnote was acquired by Searchlight Cyber. Combined, the companies form a holistic platform for combating external threats. Visit assetnote.io and slcyber.io for more information.