Storm Watch by GreyNoise Intelligence

In this episode of Storm Watch, we delve into a range of cybersecurity topics that have made headlines recently.

We kick off with a discussion on the recent agreement inked by the US, Britain, and other countries to make AI 'secure by design'. This landmark decision underscores the growing importance of cybersecurity in the era of artificial intelligence and the collective effort to ensure its safe implementation.

Next, we turn our attention to the disruption of a Cyber Scam Organization through the seizure of nearly $9M in cryptocurrency. This case highlights the increasing use of digital currencies in cybercrime and the efforts by law enforcement to curb such activities.

We then discuss a critical vulnerability in ownCloud, a top file-sharing service. The security bug, which reveals admin passwords, was quickly exploited in the wild, underscoring the need for swift action in addressing such vulnerabilities.

The episode also covers the spread of the InfectedSlurs Botnet, which is disseminating Mirai via zero-days. This development is a stark reminder of the persistent threat posed by botnets and the importance of staying abreast of the latest cybersecurity threats.

We also delve into the recent ransomware 'catastrophe' at Fidelity National Financial that caused panic among homeowners and buyers. This incident underscores the far-reaching implications of ransomware attacks and the urgent need for robust cybersecurity measures.

In the automotive sector, we discuss the warning issued by auto parts giant AutoZone about a MOVEit data breach. This incident serves as a reminder of the pervasive nature of cyber threats across various industries.

Celebrating its 10th anniversary, Microsoft's bug bounty program is another topic of discussion. Over the past decade, the program has awarded more than $60M, highlighting the tech giant's commitment to cybersecurity.

We also touch on the intriguing topic of the 'Internet of Insecure Cows', a study that explores the vulnerabilities of IoT devices in the agricultural sector.

The episode also includes discussions on Vidar tracking, a technique used to monitor the infrastructure of this notorious malware, and the concept of 'Living off the land', a stealthy cyberattack strategy.

We wrap up with a look at the 'Have I Been Squatted?' service, an overview of the latest GreyNoise Tags, a roundup of Known Exploited Vulnerabilities (KEV), and a review of CISA's Ransomware Response Checklist. These resources provide valuable insights and tools for cybersecurity professionals and enthusiasts alike.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

Welcome to the latest episode of Storm Watch by GreyNoise Intelligence, hosted by Emily Austin, Kimber Duke, Glenn Thorpe, and boB Rudis. In this episode, we're excited to share some good news about the takedown of the IPStorm Botnet, a significant victory in the fight against cybercrime. The Russian and Moldovan national behind the illegal botnet proxy service has pleaded guilty, marking a significant step forward in international cybersecurity efforts.

In breaking news, we discuss the recent SEC complaint filed by AlphV against MeridianLink for not disclosing a breach to the SEC. The breach was linked to Confluence, and we delve into the details of this incident and its implications. We also focus on the CrushFTP RCE.

In our regular programming segment, we discuss how Clorox is cleaning house after a cyberattack, with the company's cyber chief leaving as recovery efforts continue. We also talk about Rackspace's hefty $11M ransomware recovery bill, which was linked to an OWASSRF vulnerability. Toyota also makes headlines with a breach confirmed after the Medusa ransomware group threatened to leak data, an incident tied to the CitrixBleed vulnerability.

We also discuss the upcoming IRISSCON cybersecurity conference, where Russian cybersecurity experts are expected to present. We reflect on the 20th anniversary of Patch Tuesday, a monthly event that has become a staple in the cybersecurity world. We also give a nod to the upcoming CAMLIS conference, which we'll cover in more detail next week.

In our tool time segment, we introduce MaxCVE, a useful tool for cybersecurity professionals, and discuss the importance of container vulnerability scanning awareness.

In our self-promotion segment, we share some of the latest updates and discoveries from Censys and GreyNoise, including the introduction of Censys Search Teams, the discovery of NTC Vulkan infrastructure, and how to get a leg up on initial access ransomware with CISA KEV and GreyNoise tags. We also showcase UX and feature improvements in Sift.

Finally, we discuss the latest trends in GreyNoise tags and the importance of the Known Exploited Vulnerabilities Catalog from CISA. We also cover CISA's new initiative to expand scalable cybersecurity services to protect broader critical infrastructure and their recently released Health Sector Guidance Document.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

Before we got the podcast going, we sent some love to Iceland, which is currently experiencing significant seismic activity. The Icelandic Meteorological Office has detected about 900 earthquakes in the region between Grindavík and Sundhnúkur, leading to the evacuation of the coastal town of Grindavík. The likelihood of a volcanic eruption is deemed considerable.

In good news, an international syndicate involved in cybercrime has been busted with the arrest of eight people. This is a significant step in the fight against cybercrime and a testament to the hard work of law enforcement agencies worldwide.

Breaking news from Maine involves a rant about MOVEit, a global data security incident that has raised concerns about data protection and privacy. We'll delve into this topic and discuss its implications.

In tech news, a new cutting-edge attack has been discovered that can steal SSH cryptographic keys. This vulnerability occurs during the signature generation when a client and server are establishing a connection and affects keys using the RSA cryptographic algorithm. This discovery underscores the importance of constant vigilance and innovation in cybersecurity.

In regular news, Sumo Logic has disclosed a security breach after discovering unauthorized access to its AWS account. The company has advised customers to rotate their API access keys and other credentials as a precautionary measure.

Hive ransomware is back, and a new offspring, Hunters International, has taken the stage. We'll discuss this development and its potential impact on cybersecurity.

We also talked about NotCVE, a new initiative in the cybersecurity world, and introduce you to a useful tool, the CVE Half Day Watcher.

In our shameless self-promotion segment, we discussed the SLP Tag Blog and the new addition of PCAPs in Analysis.

We also did the usual roundup of the latest tags on GreyNoise.

Finally, we discussed the latest updates from KEV, including the ACSC BCiB and the CISA Software Supply Chain Guide.

Episodes Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch our hosts discuss a variety of topics, including the top cyber conflicts, vulnerability remediation, and the latest issues with Confluence, F5, ApacheMQ, and VMware.

The episode began with a brief introduction and some casual banter among the hosts. They discussed their Halloween experiences and a Glenn's obsession with Wordle. They also mentioned a movie called "Clown" that Kimber recommended for those with a fear of clowns.

The hosts then moved on to discuss cybersecurity topics including:

-Interview with Konstantin of CVECrowd.com - Good News: UK CVD legislation - Confluence Viz Activity - ActiveMQ Viz Activity - F5 Viz Activity - Okta breach update - QNAP vulns - Myth of the long-tail vulnerability - The release of CVSS4 - Quick FYI for the Microsoft/Foreign Policy "Digital Front Lines" magazine - Quick FYI on a Wiz blog - News about the joint Censys/GreyNoise workshop - Mention of the new GreyNoise Honeypots/honeytokens blog - Mention of the new GreyNoise Summary Stats Observable notebook - GreyNoise Tag roundup - KEV roundup - Notes that November is Critical Infra Security & Resilience Month

The episode concluded with a discussion on the myth of the long tail vulnerability, a topic covered in a blog post by Ben from Cisco. The hosts agreed that the hype cycle for vulnerabilities is real and predictable, and there is no long tail vulnerability.

This Episodes Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

The StormWatch podcast episode from October 31, 2023, began with the hosts in a light-hearted mood, donning costumes for Halloween. The hosts discussed the latest happenings in the cybersecurity world, focusing on the latest phones, developments at Censys and GreyNoise, and important cybersecurity news. They also touched on conspiracy theories. The hosts were in costumes, with one host dressed as the Invisible Man, another as Louise Belcher from Bob's Burgers, and another as Cozy Bear, a reference to APT 29, a cyber espionage group. They also discussed their "scariest vulnerabilities," with one host mentioning the mercenary spyware like Pegasus as a significant concern.

The hosts then discussed the recent security breaches involving Okta, Beyond Trust, and 1Password. They praised 1Password for their transparent and detailed response to the incident. They also discussed the recent vulnerabilities found in SolarWinds and the subsequent charges filed by the SEC against SolarWinds and their Chief Information Security Officer for fraud and internal control failures.

The hosts also discussed a tool called cvecrowd.com, which tracks CVE mentions on Mastodon, a social network. They praised the tool for its usefulness in tracking cybersecurity vulnerabilities and incidents. They also mentioned an upcoming event at a brewery where they would discuss threat hunting techniques and tips.

The hosts then discussed the recent vulnerabilities found in Cisco IOS, with one host sharing her findings from her investigation into the vulnerabilities. They also discussed the importance of patching and updating systems to protect against these vulnerabilities.

This Episodes Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

This episode of Storm Watch begins with introductions of the hosts - Bob, Emily (Censys), Glenn, Remy, and guest Jake Baines (VulnCheck).

The hosts discuss two ransomware groups being taken down - the Ukrainian Cyber Alliance taking down Trigona, and RagnarLocker ceasing operations. However, they note ransomware attacks often continue in new forms. The increase in Bitcoin value is also concerning, as it tends to correlate with more ransomware attacks.

A significant portion of the podcast focuses on the vulnerabilities in Cisco routers and Citrix systems. The hosts explain the vulnerabilities, provide background, and detail the work done by their teams to analyze the issues. They are critical of Cisco's disclosure and patching process.

The hosts discuss the recent Okta breach, criticizing their response time and communication process. They explain how the breach occurred via access to support systems, and compromised session tokens and HAR files. The hosts emphasize the sensitivity of HAR files.

Other topics covered include:

• Recent Citrix vulnerability
• Attackers targeting exposed Jupyter notebooks
• MGM Resorts data breach notification letters finally reaching Maine residents
• New open source tool Precursor for payload analysis

The hosts close out with recommendations for tabletop incident response exercises, favorite Halloween candies, and a plea for better security awareness and coordination across the industry.

This Episode's Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

This "Breaking News" edition of the Storm Watch podcast begins with the hosts introducing themselves and their guest, Mark from Censys. The hosts discuss the recent surge in activity around a new Cisco IOS vulnerability and the subsequent system implants. Censys has published a blog post on the topic and discovered that approximately 41,983 hosts had this implant installed, an increase of about 5,000 to 6,000 from the previous day.

The hosts discuss the unique nature of this implant, noting that it does not persist through reboots or maintenance. However, attackers can establish a more permanent threshold or entry point post-implant pre-reboot. The hosts also discuss the development of a scan profile for this vulnerability, which was facilitated by information provided by Talos in their blog post.

Then they discuss the distribution of the affected hosts, noting that they are spread across many different autonomous system organizations. They speculate that many of the affected systems are likely small businesses or residential users who received their devices from their Internet Service Providers (ISPs). The hosts also note that many different entities are scanning for this vulnerability, some of which are unknown, indicating that many people are opportunistically jumping on this issue.

The hosts conclude the podcast by discussing the severity of this vulnerability, noting that it provides top-tier, or "God mode," access to people's networks. They encourage listeners to stay informed and safe, and they express hope that they won't have to report on another breaking news issue before their next scheduled episode. Be sure to check out the GreyNoise blog for more details and updates on this active vulnerability.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

On this episode of Storm Watch the hosts discuss a recent vulnerability in the Cisco IOS software, which they describe as a "legit terrible vulnerability". This vulnerability can be triggered to place an implant on a Cisco device, granting the attacker full access to the device. They emphasize that this is a serious issue and encourage listeners to look into it further. They also discuss a vulnerability in WordPad, which they find surprising given that WordPad is often forgotten about. They note that Microsoft has claimed to have updated WordPad to address this vulnerability and also that Microsoft is abandoning WordPad (though they made an update for this vuln).

The hosts also discuss the importance of blocking outbound NTLM over SMB in Windows, with Glenn emphasizing that organizations should not allow SMB outbound from their perimeter. They discuss the challenges of restricting outbound internet access for the general user base, noting that it would require an application firewall and could potentially lead to a large number of help desk tickets.

Another topic of discussion is a recent blog post by Vulncheck, which reveals that many devices have already been compromised due to the iOS software vulnerability. They note that the compromised devices were found in Digital Ocean, which they find amusing.

Finally the team reviews recent GreyNoise Tags, additions to CISA KEV, a new "KEV API" open-source tool, and the new KEV "ransomware" field, with a daily-updated visualization by GreyNoise.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts were joined again by Emily Austin, a senior researcher from Censys, and Daniel Grant, a principal data scientist at GreyNoise. They discussed the SIFT tool, a new product from GreyNoise, and its potential applications in the field of cybersecurity.

The hosts began by discussing a recent Microsoft report that suggested basic security hygiene could protect against 99% of attacks. They highlighted the importance of multi-factor authentication, zero trust, and patching as key elements of this basic security. The hosts also noted that 80% of ransomware compromises occur via unmanaged devices, emphasizing the need for organizations to prioritize their security efforts.

Next, they discussed a recent vulnerability in Confluence, a popular team collaboration software. The vulnerability, which was exploited as a zero-day, allowed remote attackers to create new users. The hosts stressed the importance of auditing user accounts, even after patching, to ensure that no unauthorized users were created during the exploit.

The hosts then turned their attention to the impact of a cyber attack on Clorox. The company has predicted a significant drop in sales due to the attack, which the hosts speculated might have been timed to coincide with flu season, a high-demand period for Clorox products.

The episode also covered a new vulnerability in the HTTP/2 protocol, which could potentially be exploited for a denial-of-service (DoS) attack. The hosts noted that currently, the best protection against this type of attack is a DDoS mitigation service.

Finally, the hosts discussed the addition and removal of certain devices from the Known Exploitable Vulnerabilities (KEV) list. They noted that the MeetingOwl, a device they had previously discussed, had been removed from the list. The hosts concluded the episode by emphasizing the importance of basic security measures and the role of cybersecurity professionals in protecting against threats.

View Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

Welcome to Storm Watch by GreyNoise Intelligence, where the hosts discuss the latest cybersecurity topics and news. In this episode, the hosts are joined by special guest Emily Austin, a security researcher at Censys.

Censys is a company that scans the entire IPV4 space, providing fast internet-wide scan data for researchers, threat hunters, and others who need to understand the internet landscape. They also offer an attack surface management platform to help organizations identify and protect their assets. Emily is a senior researcher and leads the research team at Censys, focusing on new vulnerabilities and internet measurement analytics.

During the podcast, the hosts discuss the challenges of analyzing scan data and the importance of being informed about potential threats. They also touch on the topic of threat hunting and the debate between the terms "threat hunting" and "thrunting." Emily then does a deep dive on the WS_FTP exposure situation.

The hosts mention the upcoming nationwide test of the emergency alert system by FEMA, which will send alerts to cell phones, radios, and televisions. They emphasize the importance of being aware of this test and the potential for disruptions.

The conversation then shifts to the recent libwebp debacle, which has made every Chromium instance vulnerable. The hosts express concern about the lack of attention this issue is receiving and the confusion caused by the changing CVEs.

Along with other cyber news, the show announces a new GreyNoise Early Access Program (EAP) feature: Sift. Sift lets users with GreyNoise accounts access the same early attack triage tools the internal GreyNoise Detection Engineering team uses. GreyNoise Labs is releasing it now to get feedback from customers and the community to help make Sift as useful as possible when applied to the PCAP data coming from the GreyNoise Early Access Program new sensors.

View Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>