Storm Watch by GreyNoise Intelligence

In this episode of Storm Watch, the hosts discuss their recent experiences and updates in the cybersecurity world. The podcast begins with Kimber sharing her experience at LabsCon, a small conference organized by Sentinel One's labs team, focused on threat intelligence information sharing.

Next, the hosts discuss GreyNoise's sensor workshop at LabsCon, where they demonstrated the deployment of a sensor and the possibilities it opens up for information gathering. Sensors are points on the internet that passively collect data, waiting for interactions and storing the information in a database for further analysis. The team is working on new sensor profiles and personas, allowing them to pretend to be anything in ways they have never been able to do before.

The conversation then shifts to the ongoing MoveIt vulnerability saga, with two new CVEs being announced in the past week. The hosts emphasize the importance of staying on top of these vulnerabilities and practicing responsible disclosure. They also briefly mention JetBrains' new beta Rust IDE, which is currently available for testing.

Lastly, the hosts touch upon GreyNoise trends, noting that it has been a relatively calm week in terms of botnet activity. However, they point out an increase in open proxy scanners, advising listeners to educate themselves on the topic. Overall, the episode covers a range of cybersecurity topics, from conferences and workshops to vulnerabilities and trends.

View Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss a recent noise storm, which is an event where a capable attacker group sends out massive amounts of TCP packets without three-way handshakes. These noise storms can cause problems for data processing pipelines and are sometimes used to distract security professionals from other malicious activities. The hosts also mention that some early noise storms were in close proximity to large-scale military engagements, leading to speculation about their purpose.

The podcast also covers a recent ransomware attack by the AlphaV group, which targeted MGM via Okta, a popular identity and access management platform. The hosts discuss the group's articulate statement and snarky tone, as well as the fact that the group seems to be based in the US, which may contribute to their proficiency in English. They also mention that GreyNoise has coverage for this emergent threat and provides advice for security professionals on how to handle it.

Additionally, the hosts announce the launch of GreyNoise Labs, a platform for deep technical dives and research. Labs is designed for ultra-nerds who want to know the nitty-gritty details of various security topics. The hosts also discuss the potential for predicting security events by correlating anomalies with news articles and breaches.

Finally, the hosts touch on the "jet stream" of the internet, which consists of always-on threats like Mirai and SSH brute force attacks. They mention that these threats behave differently over time and are accompanied by smaller pockets of thunderstorms and systems moving in. Overall, the episode covers a wide range of cybersecurity topics, from noise storms and ransomware attacks to the launch of GreyNoise Labs and the ever-present threats on the internet.

In the Storm Watch podcast episode from September 12, 2023, the host discusses the value of private group chats and the resurgence of IRC. They mention the creation of a new Discord server for their community and express concerns about Salesforce's ownership of Slack. The conversation then shifts to the recent Apple vulnerabilities, emphasizing the importance of patching devices and staying informed about security issues.

The host also talk about the LastPass breach, in which the company was hacked, and the subsequent poor handling of the situation. They advise listeners to switch to two-factor authentication and change their passwords in response to the breach. The episode also covers the theft of $35 million from crypto accounts, which may be linked to the LastPass breach.

The podcast touches on the topic of known exploited vulnerabilities, expressing frustration with the lack of timely information about such incidents. The host and guests then engage in a discussion about their predictions for the number of vulnerabilities to be discovered in the coming week.

In conclusion, the host encourages listeners to stay safe, be cautious when interacting with strangers, and reach out to the Storm Watch community through various platforms, including Slack, social media, and Discord.

In this episode of Storm Watch, the hosts discuss various topics related to cybersecurity and the internet. They begin by comparing the unpredictability of weather patterns to the challenges of predicting internet activity and cyber threats. The hosts suggest that perhaps they should consider using a "cone of uncertainty" model, similar to hurricane forecasting, to help visualize potential internet threats.

The conversation then shifts to the recent North Korean cyberattacks targeting security researchers. The hosts express disappointment at not being targeted themselves and discuss the importance of being aware of potential threats and evaluating one's own risk factors. They also mention Google's efforts to raise awareness about the issue and encourage those affected to reach out for assistance.

Next, the hosts discuss the recent Apple zero-day vulnerabilities and emphasize the importance of patching devices. They also touch on the broader topic of whether security checkboxes and best practices are still effective in today's rapidly evolving threat landscape.

Finally, the episode covers the Microsoft Exchange Server vulnerabilities and the company's response to the issue. The hosts express disappointment in Microsoft's handling of the situation, noting that there seems to be a lack of transparency and detail in their communications. They also discuss the potential consequences of not implementing proper key rotation and the importance of learning from these incidents to improve security practices moving forward.

In the August 28th episode of the Storm Watch podcast, the hosts discussed various cybersecurity topics and welcomed a new guest, Donna, the director of product design at Grey Noise. Donna shared her experience attending Blue Team Con, a conference for cybersecurity defenders. She emphasized the importance of learning directly from the cybersecurity community to improve Grey Noise's overall user experience. Glenn, another host, also attended the conference and praised its organization, variety of talks, and friendly atmosphere.

The hosts then discussed a recent Sophos report on cybersecurity trends, highlighting the report's engaging writing style and informative content. They also touched on a misleading headline about Russia hacking Poland's train rail network, clarifying that it was not a cyber attack but rather a simple radio frequency interference that caused the trains to stop. The hosts expressed concern about the vulnerability of modern systems to such basic attacks.

The conversation shifted to the impact of ransomware attacks on businesses, with the hosts mentioning two Danish cloud providers that went out of business due to ransomware incidents. They emphasized the importance of taking cybersecurity seriously, as even well-prepared businesses can be affected by unforeseen threats.

Lastly, the hosts discussed a recent Capture the Flag (CTF) competition organized by Grey Noise. They praised the event's organization and shared some interesting stories from the participants, including a real-life open-source intelligence gathering situation. The CTF event showcased the creativity and skills of the cybersecurity community and provided valuable learning experiences for the participants.

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss their experiences at Hacker Summer Camp and their excitement about new sensors they've been working with. They consider the possibility of doing a demo in the next episode and mention some sneak peeks available on Andrew's Twitter account. The conversation then shifts to the extreme weather conditions they've been experiencing, including heat domes and "her quakes."

The hosts express their disappointment with the lack of progress made by federal departments and agencies in response to the Biden-Harris administration's executive order on cybersecurity. They emphasize the importance of faster reporting and applying basic cybersecurity principles. They also discuss the massive number of victims affected by the "Move It" ransomware, urging cybersecurity professionals to focus on healthcare and other underserved areas.

The ARPA-H initiative, or "DigiHeals," is introduced as a government research project aimed at improving healthcare cybersecurity. The hosts share their concerns about the vulnerabilities they've observed in healthcare networks and encourage cybersecurity professionals to dedicate time to helping these critical systems. They also announce the winners of the first annual inaugural Noise Fest CTF of 2023, a Capture the Flag competition organized by the GreyNoise Labs team.

Learn more about GreyNoise >>

In this Storm Watch episode the hosts discuss various topics related to cybersecurity, vulnerabilities, and attacker activity. The episode features Kimber, a product manager at GreyNoise, and Glenn Thorpe, the director of security research and detective engineering at Grey Noise. The team shares their experiences and takeaways from attending Black Hat DEF CON, a cybersecurity conference held in Las Vegas.

During the conference, the hosts noticed an increased focus on API and supply chain security, particularly among startups. They also observed a growing interest in healthcare security, with discussions centered around protecting hospitals from ransomware attacks and implementing canaries to detect such attacks faster. The hosts also mention the popularity of the AI Village at DEF CON, as well as the Policy Village, which aims to protect the cybersecurity community and researchers.

The podcast also covers the GreyNoise Capture the Flag (CTF) event, where participants were challenged to solve various cybersecurity puzzles. The hosts express their admiration for the effort put into designing the challenges and their interest in hearing participants' reactions. They also discuss a new feature in GreyNoise that allows users to set up alerts based on specific tags, making it easier to monitor and receive updates on particular vulnerabilities.

Overall, this episode highlights the importance of staying informed about the latest trends and developments in cybersecurity, as well as the value of participating in events like Black Hat DEF CON and Grey Noise CTF to learn and engage with the cybersecurity community.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss a variety of topics, including their upcoming trip to Vegas for a cybersecurity event and the challenges they face in staying up-to-date with the latest vulnerabilities and threats. One of the main topics of discussion is the issue of companies hiding vulnerability information behind paywalls or requiring NDAs to access advisories. The hosts argue that this practice is counterproductive, as it slows down awareness and remediation efforts while creating anxiety and anger towards the affected company.

The hosts also touch on the upcoming Noise Fest CTF (Capture the Flag) event, which features 22 different challenges for participants to test their skills in various areas of cybersecurity. They encourage listeners of all skill levels to participate and reach out for help if needed, as the event is designed to be both fun and educational.

Another topic of discussion is the importance of staying on top of patching and updating systems to protect against vulnerabilities. The hosts praise their own internal team for their quick response to a recent vulnerability in their data science and business analytics software, emphasizing the need for organizations to prioritize security and maintain a proactive approach.

Lastly, the hosts discuss a recent ransomware attack against a health network provider that affected multiple states and disrupted patient services. They emphasize that ransomware is still a significant threat and that organizations must remain vigilant in protecting their systems and data. Overall, the episode highlights the importance of staying informed about the latest threats and vulnerabilities and the need for organizations to prioritize security and transparency in their operations.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss the recent MOVEit data breach and its impact on various organizations. They mention that around 550 organizations have been affected so far, but this number is likely to increase significantly. One of the victims, National Students Clearinghouse, partners with about 3,600 US post-secondary schools, and it is unclear how many of these institutions have been affected. The hosts also discuss the costs associated with incident response, with one company estimating its recovery and remediation costs at $15 million.

Brett Callow from Emsisoft joins the conversation to provide more insight into the MOVEit breach. He explains that his role as a threat analyst involves aggregating data from various sources to shed light on ransomware numbers and trends. The hosts discuss whether the MoveIt breach should be classified as ransomware or simply data theft and extortion. Brett mentions that the attackers have stolen data and are threatening to release it online unless the impacted organizations pay ransoms, which can run into millions of dollars.

The hosts also touch on recent vulnerabilities in MobileIron, ColdFusion, and Citrix ShareFile, noting that they have observed malicious activity targeting these vulnerabilities. They praise the efforts of their team in creating numerous tags for July, highlighting the importance of staying informed about potential threats.

Finally, the hosts briefly mention the threat hunting guides and encourage listeners to check them out for valuable information on identifying and mitigating potential threats.

Join our Community Slack >>

Learn more about GreyNoise >>

In the Storm Watch episode the hosts were joined by Matthew Remacle, aka Remy, a detection engineer at GreyNoise. They discussed the recent surge in zero-day vulnerabilities, which they dubbed "zero-day summer," and how it seems to occur every year before the Blackhat conference. Remy shared his role at GreyNoise, where he analyzes network traffic to write tags or signatures for malicious, benign, and unknown network traffic to identify behaviors on the internet.

The hosts also talked about recent vulnerabilities in ColdFusion and Citrix ADC servers, emphasizing the importance of patching these systems. They mentioned Mandiant's report on North Korean threat actors leveraging JumpCloud in supply chain compromises and the potential unauthenticated API access in Avanti, a mobile device management platform.

Additionally, they discussed GreyNoise's new threat hunting guide, which provides a comprehensive overview of the history, key components, and future of threat hunting. Kimber mentioned the increasing popularity of the term "threat hunting" and how it has evolved into a legitimate job role. The hosts also touched on the use of AI in threat hunting, with Bob mentioning a recently released AI threat hunting platform.

The hosts concluded by discussing the steady increase in known exploited vulnerabilities cataloged by CISA, emphasizing the importance of addressing these vulnerabilities and patching systems.

Join our Community Slack >>

Learn more about GreyNoise >>