Storm Watch by GreyNoise Intelligence

Forecast = Expect heavy BTLE storms with a high chance of UUID leaks. Pack your Faraday umbrellas and watch out for rogue packets raining from the cloud.

‍

On this episode of Storm⚡️Watch, we're diving into some major cybersecurity developments that have been making waves. We'll start by unpacking the ongoing saga of the Columbus, Ohio cyberattack, which has turned into a complex web of legal battles, data leaks, and questions about municipal cybersecurity preparedness. We'll explore how this incident is affecting the city's tech aspirations and what it means for residents' data security.

Next, we're excited to bring you our Cyberside Chat, where we'll be discussing a fascinating topic: BLUUID. We'll explore how Bluetooth vulnerabilities are impacting everything from insulin pumps to firewalls. We'll break down the technical details of extracting BTLE UUIDs from Android APK files and how this process can be used to identify devices. We'll also delve into some serious vulnerabilities discovered in Firewalla firewall products, including potential remote code execution risks.

As always, we'll be sharing some of our recent work in the cybersecurity field. We've got some intriguing analyses from Censys, including a deep dive into Fox Kitten infrastructure and a challenging look at securing internet-exposed industrial control systems. VulnCheck has been busy too, with a new blog post about the Flax Typhoon botnet. And don't miss our GreyNoise blog, where we're questioning assumptions about ICS security.

We'll wrap up with our regular "We Need to Talk About KEV" segment, where we'll round up the latest additions to CISA's Known Exploited Vulnerabilities catalog. It's a packed episode that you won't want to miss, so tune in to stay on top of the latest in the world of cybersecurity.

Storm Watch Homepage >>

Learn more about GreyNoise >>

On this episode, we're joined by GreyNoise Founder and Chief Architect, Andrew Morris, to take a ride in the Mystery Mobile to discover a hidden message buried in the payloads of over two million mis-directed ICMP packets.

Along the way, we discuss the history of "noise storms" seen through the lens of GreyNoise's planetary-scale network of internet sensors, talk about some other, recent mega-storms, then don our bestest tin-foil hats to conspiracy theorize who sent this encoded message and why.

Forecast - Digital Disturbance Advisory!

Subscribe to Storm⚡️Watch - https://stormwatch.ing

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast - A volatile storm is brewing with lightning strikes of intrigue and clouds of legal turbulence on the horizon.

In this episode of GreyNoise Storm⚡️Watch, we kick things off with intros and roundtable discussion before diving into the exciting news and discussion. Notably, Bob and Glenn are absent.

In our Cyberside Chat segment, we discuss ransomware. First, we'll discuss how the US government has issued an advisory on the RansomHub ransomware group, which is believed to be responsible for a cyberattack on oil giant Halliburton. RansomHub is believed to have targeted at least 210 victims across various critical infrastructure sectors since February 2024. Then we'll examine the controversial legal battle unfolding in Columbus, Ohio. The city has taken the unusual step of suing security researcher David Leroy Ross after he publicly contradicted official statements about a recent ransomware attack.

Then we'll shift gears to explore the discovery of a sophisticated espionage campaign dubbed "Voldemort," uncovered by Proofpoint researchers in August 2024. This custom malware, impersonating tax authorities across multiple countries, has targeted numerous organizations worldwide using innovative techniques.

In our Shameless Self-Promotion segment, we highlight Emily and Glenn's involvement in Labscon, as well as some recent Censys advisories.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast: High pressure system over Georgia Tech as DOJ storm rolls in. SolarWinds experiencing unexpected credential precipitation.

This episode features the DOJ hot takes on Georgia Tech, SolarWinds dropping the ball (again), and why Keanu Reeves may want to re-think some of his recent life choices. Plus, we're decoding the latest KEV advisory. Tune in for our usual no-holds-barred analyses and commentary.

‍A major legal action by the U.S. Department of Justice targets Georgia Tech and its research corporation over alleged cybersecurity violations. The case underscores the critical importance of cybersecurity compliance, even for prestigious academic institutions.

Keanu Reeves' involvement in a Palo Alto Networks AI security campaign raises questions about celebrity endorsements in tech. SolarWinds faces scrutiny after a recent credential leak in a hotfix for their Web Help Desk product, highlighting the risks of rushed patches. Additionally, a critical authentication flaw in DiCal-RED illustrates the ongoing challenge of securing essential software functions.

• ‍‍Emily and Glenn will be speaking at LABSCON
• Glenn's BSidesLV presentation on vulnerability insights from the CISA KEV Catalog.
• GreyNoise's blog "BLUUID: Firewallas, Diabetics, And... Bluetooth," explores the intersection of technology and healthcare.

‍A roundup of the latest tags from the GreyNoise Visualizer and a deep dive into the KEV (Known Exploited Vulnerabilities) Roundup, with special attention on CVE-2024-39717, a Versa Director vulnerability that has stirred controversy due to its rapid addition to the KEV catalog despite limited public information on its exploitation.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Expect partly cloudy skies with a high chance of old vulnerabilities resurfacing - don't forget your patch umbrella (or lamp shade)!

What's old is new, again, in this episode of Storm⚡️Watch, as we explore the "0.0.0.0 Day" vulnerability, a critical flaw affecting major web browsers like Chrome, Firefox, and Safari. This vulnerability allows malicious websites to bypass browser security mechanisms and potentially gain unauthorized access to local services. We break down the technical details, real-world implications, and the responses from browser developers to this threat.

Next, we shed light on a 2017 vulnerability still affecting over 20,000 Ubiquiti devices, including cameras and routers. This issue exposes these devices to amplification attacks and privacy risks due to custom privileged processes on specific network ports. We discuss the discovery protocol, the types of information exposed, and provide practical mitigation strategies for users and administrators of Ubiquiti equipment.

In our Cyber Spotlight segment, we cover the National Public Data (NPD) breach, a massive cybersecurity incident that has exposed sensitive personal information of millions of individuals. We take a look at the scope of the breach, the data that was leaked and put up for sale, and the analysis provided by cybersecurity expert Troy Hunt. The implications of this breach are far-reaching, highlighting ongoing concerns in the data broker industry and the potential for long-term impacts on affected individuals.

We wrap up the episode with our regular segments, including a look at recent tags from the GreyNoise visualization tool and a roundup of the latest additions to CISA's Known Exploited Vulnerabilities catalog. As always, we encourage our listeners to stay informed and implement necessary security measures to protect themselves in this ever-evolving cyber landscape.

Storm Watch Homepage >>

Learn more about GreyNoise >>

On this episode the crew kicks things off with a "Thorns and Roses" segment, sharing their experiences from the recent Black Hat, DEF CON, and BSides conferences.

Next, they dive into the world of internet-connected industrial control systems, exploring the findings from a recent Censys research report that sheds light on the vulnerabilities and risks associated with these critical systems.

The spotlight then turns to StormBamboo, a sophisticated threat actor that's been making waves in the cybersecurity community. The team breaks down how this group compromised an internet service provider to conduct DNS poisoning attacks and exploit insecure software update mechanisms. They discuss the implications of this attack, including the deployment of malware families like MACMA and POCOSTICK/MGBot, and the use of a malicious Chrome extension called RELOADEXT.

Moving on, the hosts share insights from their recent work, including a look at state of exploitation in the first half of 2024 and fresh perspectives on vulnerability prioritization. They emphasize the importance of keeping vulnerability intelligence up-to-date and introduce GreyNoise's new offerings for vulnerability management teams.

The episode wraps up with a look at the latest tags from GreyNoise's visualization tool and a roundupof the most recent additions to CISA's Known Exploited Vulnerabilities catalog.

Forecast = Stormy skies ahead as ICS vulnerabilities rain down and foreign threat actors flood ISPs, with a high chance of KEV alerts and a 100% probability of cybersecurity drama!

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Persistent cyber heat dome in effect with no sign of abatement.

In this episode of Storm⚡️Watch, we dive into the latest cybersecurity news and trends. We kick things off with a breaking story about DigiCert's certificate revocation incident. Due to a validation issue affecting about 0.4% of their domain validations, DigiCert is revoking certificates with less than 24 hours' notice. This could impact thousands of SSL certs and potentially cause outages worldwide starting July 30 at 19:30 UTC. Organizations using affected certificates should be prepared for a busy night of renewals.

Our Cyberside Chat focuses on a critical vulnerability in VMware ESXi hypervisors that ransomware operators are actively exploiting. Identified as CVE-2024-37085, this flaw allows attackers to gain full administrative access to ESXi servers without proper validation. Several ransomware groups, including Storm-0506 and Storm-1175, have been using this vulnerability to deploy ransomware like Akira and Black Basta. Microsoft reports that incidents targeting ESXi hypervisors have doubled over the past three years, highlighting the growing threat to these systems.

In our Cyber Spotlight, we examine a global cyber espionage campaign conducted by North Korean hackers. This operation aims to steal classified military intelligence to advance Pyongyang's nuclear weapons program. The hackers, known as Anadriel or APT45, have targeted defense and engineering companies involved in producing tanks, submarines, naval ships, fighter jets, and missile technologies. The campaign affects not only the US, UK, and South Korea but also entities in Japan and India. This underscores the persistent threat posed by state-sponsored actors from North Korea in their pursuit of military and nuclear ambitions.

We wrap up with our Tag Roundup, highlighting recent trends in cyber threats, and our KEV Roundup, discussing the latest known exploited vulnerabilities cataloged by CISA. These segments provide valuable insights into the current threat landscape and help our listeners stay informed about potential risks to their organizations.

Don't forget to check out the Storm Watch homepage and learn more about GreyNoise for additional cybersecurity resources and updates.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Expect a downpour of data breaches and a thick fog of trust issues.

In this episode of Storm⚡️Watch, we dive into some critical cybersecurity issues affecting both government agencies and major corporations. The CISA Red Team's recent assessment of a Federal Civilian Executive Branch organization revealed significant vulnerabilities, highlighting the importance of defense-in-depth strategies. The exercise exposed weaknesses in patch management, credential security, and network segmentation, emphasizing the need for layered security controls and behavior-based threat detection.

We also discuss the massive AT&T data breach linked to the Snowflake cyberattack. This incident compromised call and text records of nearly all AT&T wireless customers, spanning a six-month period in 2022. While the content of communications wasn't accessed, the breach included metadata such as phone numbers, call durations, and approximate location data. This event underscores the far-reaching consequences of supply chain attacks and the critical importance of robust cloud security measures.

In our Shameless Self-Promotion segment, we highlight a recent GreyNoise Labs discovery of a path traversal vulnerability in the D-Link DIR-859 router. This perma-vuln, identified as CVE-2024-0769, leads to information disclosure and poses long-term exploitation risks as the product is no longer supported. We also touch on Censys's analysis of how Google's removal of Entrust from Chrome's Root Store will impact the internet, reflecting on the broader implications for digital certificate security.

As always, we round up the latest cybersecurity trends and active campaigns in our Tag Roundup section, providing insights into the current threat landscape. We close with an update on known exploited vulnerabilities (KEVs) that organizations should prioritize in their security efforts.

Storm Watch Homepage >>

Learn more about GreyNoise >>