Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022

A
Andrew Morris
••
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
Andrew Morris STAYING AHEAD OF INTERNET BACKGROUND EXPLOITATION
Founder and CEO GreyNoise Intelligence @Andrew___Morris andrew@greynoise.io Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ANDREW MORRIS
1. Intro & Background 1. Part I - What Is The Problem? 2. Part II - Our Solution To The Problem 1. Part III - Things We’ve Observed 2. Summary & Recap Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
PART 1 - THE PROBLEM
Every other month, a really bad vulnerability is identified, disclosed, weaponized, and exploited at scale around the internet, in some piece of common perimeter-facing software and nobody has any idea what to do about it. Scanning and exploiting vulnerabilities jumped up to the top infection vector in 2020 with a 35% share, surpassing phishing which was the top vector in 2019. Source: https://www.ibm.com/security/data-breach/threat-intelligence Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 35% of initial infections, according to IBM “Scan-and-exploit” top infection vector in 2020 IN PLAIN TERMS…
ALL THE CELEBRITY VULNERABILITIES Andrew Morris | Staying Ahead Of Internet Background Exploitation
● Vulnerability research has evolved ○ Tooling and development has improved ○ Attack surface has increased Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 HERE’S WHY WE’RE HERE Mass scanning + vulnerability research = mass exploitation dying to happen ● Mass scanning has evolved ○ Tooling is better (Masscan, Zmap, etc) ○ Recyclable IPs are a thing (cloud) ○ The Internet is literally faster
We used to think about bad guys hacking systems on the internet following this pattern: Find Vulnerabilities Scan Target, Enumerate, Profile Identify Target Profit Operate Exploit Vulnerabilities HACKING IN THE 90’s Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
Today more closely resembles an assembly line: Compromise Lots of Hosts Scan Target Internet Identify Target a viable Vulnerability Profit Trade Accesses or Operate Exploit Deconflict Accesses HACKING IN THE 20’s Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
But now: ○ $ASSET can increasingly refer to 0.0.0.0/0 ○ SOMEONE does AN EXPLOIT to THE ENTIRE INTERNET resulting in SHELLS AND CHAOS THREAT MODEL CREEP Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 To quote Bruce Potter at some point a few years ago: ○ $ACTOR does $ACTION to $ASSET resulting in $OUTCOME because $MOTIVATION
On a daily basis, every individual routable IP on the Internet sees: ~3,000 unsolicited pings from… ~1,000 distinct IP addresses Each /24 receives about 46mb of unsolicited network data from ~200,000 IP addresses from SYNs alone Why so much scanning? ● BAD: Credential stuffing, proxy checking, brute forces, exploit vulnerabilities, etc ● GOOD: Web search, asset discovery, third party risk, security research The internet is just really noisy, man. Source: GreyNoise Intelligence WHAT IS INTERNET BACKGROUND NOISE? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Internet scanning of the internet by source IPv4 address, Jan-21 to Feb-22. Each pixel in this photo is a group of 256 IPs.; the “brightness” of each pixel is how many IPs in that group have been observed by GreyNoise.
● Alpha Strike Labs ● GoogleBot ● BinaryEdge.io ● Project Sonar ● Bitsight ● Censys ● ShadowServer.org ● cyber.casa ● ONYPHE ● InterneTTL ● BingBot ● Yandex Search Engine ● Cortex Xpanse ● ipip.net ● Shodan.io ● IPinfo.io ● Cloud System Networks ● Net Systems Research ● OpenIntel.nl ● Facebook Crawler ● AdScore ● Ahrefs ● Intrinsec ● DomainTools ● CriminalIP ● BLEXBot ● Arbor Observatory ● Technical University of Munich ● Mail.RU ● Palo Alto Crawler ● Petalbot ● Caida ● LeakIX ● Quadmetrics.com ● Archive.org ● Moz DotBot ● RWTH AACHEN University ● VeriSign ● Bit Discovery ● Project25499 ● Applebot ● CyberGreen ● ESET ● FH Muenster University ● Knoq ● Mojeek ● SecurityTrails ● University of Colorado SOME SOURCES OF “BENIGN” INTERNET BACKGROUND NOISE Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
“[A] telescope monitoring a single IP address (a /32) the average time to observe a host at 10 addresses per second is over 13 years and the time to observe with 95% likelihood is over 40 years.” http://www.cs.unc.edu/~jeffay/courses/nidsS05/measurement/moore-telescopes04.pdf 2004 Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
“[Masscan] can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine.” https://github.com/robertdavidgraham/masscan 2013 Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
https://www.greynoise.io/blog/a-patchy-server-greynoise-observes-path-traversal-and-remote-code-execution-in-apache-http ● Sept 29, 2021: ○ Patch submitted ● Oct 03, 2021: ○ GreyNoise observes first internet-wide vuln scan ● Oct 04, 2021: ○ Apache version update, patch is GA ● Oct 05, 2021: ○ Apache discloses vulnerability to CVE APACHE PATH TRAVERSAL Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
YES Remotely exploitable? WILL CVE-BLAH-BLAH BE “MASS EXPLOITED”? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Simple to exploit or public POC? YES Running on the internet? YES Widely deployed? YES The CVE is likely to be mass exploited
Defenders ○ “Are you kidding me? Another one? Again?” Software Vendors ○ “This makes people afraid to run our software” WHO EXPERIENCES THE PAIN? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Cyber Security Vendors ○ “This is either an opportunity to make money, OR this makes us look like idiots” Hosting Providers ○ “Please stop popping boxes from our network, we can’t handle any more FBI calls or abuse complaints”
WHY IS THIS PROBLEM HARD? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Trust ○ Lots of data is bad ○ Lack of filtering and quality assurance means nobody is willing to make automated decisions based on someone else’s data Money ○ Accidentally blocking revenue-generating users Speed ○ There is a “time-to-get- something-useful-to-say” ○ There is a “time-to-say-it” ○ If both do not happen prior to an attack hitting the perimeter, you lose the race` Scale issues
● “Whack-a-mole”-style short term blocking has surprisingly good results. ○ Reduces successful attacks by 70%, but needs to be fast ○ Hunting is more straightforward but obviously this means the compromise has already occurred ● More collective defense, more info sharing from vendors and groups who have good data NEXT TIME THE SH*T HITS THE FAN? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ● Fewer well-intentioned security researchers and vendors spraying exploits around ● Assume every service on your perimeter can suddenly become vulnerable on very little notice
Super bad vulnerabilities are coming out every other month, bad guys exploit them at scale, and it’s a differently flavored dumpster fire every time Stopping the vulns from existing seems unlikely, so let’s try to detect and block before it hits a network we care about TL;DR Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
PART II - OUR SOLUTION TO THE PROBLEM
WHO’S TRACKING VULN EXPLOITATION IN THE WILD? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
GreyNoise AttackerKB US CISA 201 March 2020-Present 639 June 2020-Present 377 Nov. 2021-Present *United States Cybersecurity Infrastructure & Security Agency CVES EXPLOITED IN THE WILD Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Deploy a huge network of sensors across the internet ● “Listen” to internet background noise (scans/probes) and internet background exploitation ONE WAY TO SOLVE THE PROBLEM Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ● Make the sensors look like lots of different software ● Fingerprint every exploit request we find ● Temporarily block offenders BEFORE an attack lands on the perimeter
Years ago, someone with a lot of money and a lot of weird problems wanted to know if the computers they were running on the internet were seeing a “normal” amount of scans, or an undue amount of attention. I became obsessed and here we are years later: GreyNoise. GREYNOISE ORIGIN STORY Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Thousands of sensors - we operate thousands of sensors (kinda like honeypots) across the globe ○ Centrally managed ○ Distributed and geographically diverse ○ What they masquerade as is programmable ○ Every host is ephemeral ● Billions of events - as of March 2022 we’re processing and storing several billion events per day GREYNOISE TL;DR Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ● Tagging - we add and maintain signatures on exploit, actor, and other patterns using an internally developed tagging engine and DSL ● Use cases - GreyNoise is useful for several use-cases; one of the increasingly popular use-cases is protecting orgs from opportunistic compromise ● Free data - we give away an insane amount of free data. Seriously.
CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Speed Provider OpSec Cost Automation Geography Data / Scale Masqueraders / Fakers
● Staying “in front of” the exploit is hard ● We only have a few minutes maximum to go from: ○ Malicious traffic hitting the first few sensors.. ○ …classifying the traffic as XYZ exploit… ○ And finally pushing a “block decision” ● It isn’t enough to classify traffic correctly; you have to classify correctly in time. SPEED CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Major cloud providers are easy ○ AWS, Google, Azure, DigitalOcean… ● Language barriers ● Automation maturity ● Infrastructure reliability ● Cost ● GeoIP is fakeish ● No colos SELECTING PROVIDERS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● AWS is the standard for maturity ● API/Deployment Automation ● Minimum viable features ● Cost ○ Smallest instance ○ Many IPs to one instance ● Reliability ELEVATING CLOUD PROVIDERS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Lacking financial automation ○ Pre-payment model ○ Remember to top up… ● IPs per host ○ One IP per host is expensive ○ Many IPs to one host is “expensive” ■ Indirect automation and complexity costs COST CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Find the lowest common denominators for deployment and automation ○ Templating/code generation ○ Custom Terraform providers ○ “metacloud” ● Testing is *really* hard ● No common standard AUTOMATION CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Unreliable APIs ● Unreliable infrastructure ● Latency ● Debugging across multiple providers RELIABILITY CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Do you have sensors in X country? ○ GeoIP is fake… sometimes ○ Ambiguous regions ● No colos ● Dependant on ○ Automation maturity, cost, reliability ● Do you know how hard it is to find cloud hosting providers in most areas of the world??? ● Once you hit a critical mass you can do cool stuff like… identify all IPs that are specifically scanning Israel’s IP space… GEOGRAPHICAL CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
HERE ARE ALL THE IPS SPECIFICALLY SCANNING/CRAWLING/ATTACKING ISRAEL’S IP SPACE, & NOBODY ELSE’S https://api.greynoise.io/datashots/bluehat/israel.csv
● Account freezes ○ Russia, Ukraine, China ○ Photo verification (sorry Greg) ○ Vetting process ○ Flagged for churning sensors ● Typical big data/scaling challenges ● Shout out to the masqueraders OTHER CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
PART III - THINGS WE’VE OBSERVED
● CVE-2021-41773, Apache Path Traversal ● CVE-2021-38647, OMIGOD ● CVE-2021-26084, Atlassian Confluence OGNL Injection ● CVE-2021-44228, Log4Shell CASE STUDIES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
APACHE PATH TRAVERSAL (CVE-2021-41773)
https://www.greynoise.io/blog/a-patchy-server-greynoise-observes-path-traversal-and-remote-code-execution-in-apache-http BLUEHAT IL 2022
TIMELINE Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 October 04, 2021 Apache version update, patch is GA October 05, 2021 Apache discloses vulnerability to CVE September 29, 2021 Patch Submitted October 03, 2021 GreyNoise observes first internet-wide vuln scan
OPPORTUNISTIC EXPLOITATION/SCANNING ONE DAY BEFORE MAJOR POC RELEASE
OMIGOD (CVE-2021-38647)
BLUEHAT IL 2022
BLUEHAT IL 2022
BLUEHAT IL 2022
BLUEHAT IL 2022
BLUEHAT IL 2022
ACCIDENTAL “EXPLOITATION” 4 MONTHS BEFORE PUBLICLY KNOWN
CONFLUENCE OGNL CVE-2021-26084 BLUEHAT IL 2022
OPPORTUNISTIC EXPLOITATION/SCANNING IN LESS THAN 4 HOURS AFTER TOOLING RELEASED
● Interestingly, the first huge wave came from exclusively Tor nodes ● Most attempts at the start were just stuffing the Log4Shell string in random places. ● Shortly after, custom product-specific payloads LOG 4J Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
“scanning != exploiting” except when scanning == exploiting, like with Log4j
Security companies and researchers who exploit vulns with good intentions make this worse while trying to be helpful
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
On any given day, 73% of IPs responsible for opportunistic scan/exploit noise were seen the day before. Only 27% are “new”.
● Spoofed noise storms ● Bad guys acting like security companies that scan the internet ● Upstream blocks ● Just like bad guys, security companies think they’re super sneaky 🤫 ● Printjacking WEIRD STUFF Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
FINAL THOUGHTS
Whack-a-mole shows a surprising amount of promise BLOCKING NOISE Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
Hypothesis: ● Blocking extremely fresh internet background exploitation IPs will meaningfully increases the amount of time it takes for a vulnerable host on the internet to be compromised “WHACK A MOLE” EXPERIMENT Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Method: ● Stand up two identical vulnerable hosts, open to the internet, running poorly credentialed services ○ SSH and telnet ○ admin/aSdmin ○ root/admin ● Measure time to first compromise; total number of compromises
4 Days 6 Hours 19 Minutes Blocked Host Mean Time to Compromise Unblocked Host Mean Time to Compromise ● 32 compromises/day ● 206 compromise attempts/hour ● 4 compromises/day ● 35 compromise attempts/hour “WHACK A MOLE” RESULTS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
Tiny fast IP blocklists (whack-a-mole) are gross but they work better than you’d expect
There is relatively little we can do to prevent the next Log4J, but we can make it suck less by centralizing information and providing ready-use real-time block lists STAYING AHEAD OF THE NEXT LOG4J Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
GreyNoise Community Trends
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022
This is live right now: https://greynoise.io/ GREYNOISE COMMUNITY TRENDS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
● Internet mass exploitation is quantifiably getting worse. I expect this to continue. ● A huge, distributed, sensor system such as GreyNoise is effective at reducing opportunistic compromises ● Running this huge sensor network has challenges but they’re all addressable ● Instead of hoping another Big Bad Vuln doesn’t happen, let’s prepare for when it does CONCLUSION Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
THANK YOU!
1 of 74

Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022

••
Download to read offline
Internet

It’s not just you. The frequency of severe vulnerabilities in internet-facing enterprise software being massively exploited at scale has increased drastically. The amount of time between disclosure and exploitation of these vulnerabilities has been reduced to near-zero, leaving defenders with less time to react and respond. While combating internet-wide opportunistic exploitation is a sprawling and complex problem, there is both an art and a science to staying ahead of large exploitation events such as Log4J. In this talk we will share insights and challenges from operating a huge, shifting, adaptive, distributed sensor network listening to internet background noise and opportunistic exploitation traffic over the past four years. We will give a blunt state of the universe on mass exploitation. We will share patterns and unexplainable phenomena we’ve experienced across billions of internet scans. And we will make recommendations to defenders for preparing for the next time the cyber hits the fan.

A
Andrew Morris

Recommended

The ATT&CK Latin American APT Playbook by
The ATT&CK Latin American APT PlaybookThe ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookMITRE ATT&CK
511 views•30 slides
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew... by
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...MITRE ATT&CK
365 views•17 slides
When Insiders ATT&CK! by
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!MITRE ATT&CK
840 views•26 slides
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac... by
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
1.3K views•15 slides
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™ by
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™Katie Nickels
9K views•34 slides
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ... by
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...MITRE ATT&CK
487 views•43 slides

More Related Content

What's hot

How MITRE ATT&CK helps security operations by
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
4.6K views•39 slides
Cyber Threat Intelligence - It's not just about the feeds by
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
1.8K views•32 slides
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team by
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK
487 views•27 slides
Knowledge for the masses: Storytelling with ATT&CK by
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK
879 views•29 slides
Mapping ATT&CK Techniques to ENGAGE Activities by
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMITRE ATT&CK
601 views•18 slides
ATT&CK Updates- ATT&CK for mac/Linux by
ATT&CK Updates- ATT&CK for mac/LinuxATT&CK Updates- ATT&CK for mac/Linux
ATT&CK Updates- ATT&CK for mac/LinuxMITRE ATT&CK
390 views•16 slides

What's hot(20)

How MITRE ATT&CK helps security operations by Sergey Soldatov
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov•4.6K views
Cyber Threat Intelligence - It's not just about the feeds by Iain Dickson
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson•1.8K views
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team by MITRE ATT&CK
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK•487 views
Knowledge for the masses: Storytelling with ATT&CK by MITRE ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK•879 views
Mapping ATT&CK Techniques to ENGAGE Activities by MITRE ATT&CK
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK•601 views
ATT&CK Updates- ATT&CK for mac/Linux by MITRE ATT&CK
ATT&CK Updates- ATT&CK for mac/LinuxATT&CK Updates- ATT&CK for mac/Linux
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK•390 views
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro... by MITRE ATT&CK
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro... Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK•1.6K views
Introduction to MITRE ATT&CK by Arpan Raval
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval•986 views
The ATT&CK Philharmonic by MITRE ATT&CK
The ATT&CK PhilharmonicThe ATT&CK Philharmonic
The ATT&CK Philharmonic
MITRE ATT&CK•281 views
State of the ATT&CK May 2023 by Adam Pennington
State of the ATT&CK May 2023State of the ATT&CK May 2023
State of the ATT&CK May 2023
Adam Pennington•155 views
MITRE ATT&CK Framework by n|u - The Open Security Community
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community•3.3K views
ATT&CKING Containers in The Cloud by MITRE ATT&CK
ATT&CKING Containers in The CloudATT&CKING Containers in The Cloud
ATT&CKING Containers in The Cloud
MITRE ATT&CK•650 views
Threat Modeling Using STRIDE by Girindro Pringgo Digdo
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
Girindro Pringgo Digdo•8K views
It's just a jump to the left (of boom): Prioritizing detection implementation... by MITRE ATT&CK
It's just a jump to the left (of boom): Prioritizing detection implementation...It's just a jump to the left (of boom): Prioritizing detection implementation...
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK•441 views
Automation: The Wonderful Wizard of CTI (or is it?) by MITRE ATT&CK
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?)
MITRE ATT&CK•543 views
Threat Modelling - It's not just for developers by MITRE ATT&CK
Threat Modelling - It's not just for developersThreat Modelling - It's not just for developers
Threat Modelling - It's not just for developers
MITRE ATT&CK•3.3K views
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon•5.2K views
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE - ATT&CKcon•2.8K views
Landing on Jupyter: The transformative power of data-driven storytelling for ... by MITRE ATT&CK
Landing on Jupyter: The transformative power of data-driven storytelling for ...Landing on Jupyter: The transformative power of data-driven storytelling for ...
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK•477 views
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti... by CloudVillage
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
CloudVillage•6.2K views

Similar to Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022

A Review Paper on Cyber-Security by
A Review Paper on Cyber-SecurityA Review Paper on Cyber-Security
A Review Paper on Cyber-SecurityIRJET Journal
28 views•6 slides
Final Presentation.pptx by
Final Presentation.pptxFinal Presentation.pptx
Final Presentation.pptxBetaBeta9
12 views•10 slides
Cybersecurity2021 by
Cybersecurity2021Cybersecurity2021
Cybersecurity2021PrabhatChoudhary11
63 views•27 slides
Nominum Data Science Security Report, Fall 2016 by
Nominum Data Science Security Report, Fall 2016Nominum Data Science Security Report, Fall 2016
Nominum Data Science Security Report, Fall 2016Brian Metzger
590 views•40 slides
Top Cyber Threat Predictions for 2019 by
Top Cyber Threat Predictions for 2019Top Cyber Threat Predictions for 2019
Top Cyber Threat Predictions for 2019PECB
1.1K views•16 slides
Nominum 2016 Fall Data Revelations Security Report by
Nominum 2016 Fall Data Revelations Security ReportNominum 2016 Fall Data Revelations Security Report
Nominum 2016 Fall Data Revelations Security ReportYuriy Yuzifovich
20 views•40 slides

Similar to Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022(20)

A Review Paper on Cyber-Security by IRJET Journal
A Review Paper on Cyber-SecurityA Review Paper on Cyber-Security
A Review Paper on Cyber-Security
IRJET Journal•28 views
Final Presentation.pptx by BetaBeta9
Final Presentation.pptxFinal Presentation.pptx
Final Presentation.pptx
BetaBeta9•12 views
Cybersecurity2021 by PrabhatChoudhary11
Cybersecurity2021Cybersecurity2021
Cybersecurity2021
PrabhatChoudhary11•63 views
Nominum Data Science Security Report, Fall 2016 by Brian Metzger
Nominum Data Science Security Report, Fall 2016Nominum Data Science Security Report, Fall 2016
Nominum Data Science Security Report, Fall 2016
Brian Metzger•590 views
Top Cyber Threat Predictions for 2019 by PECB
Top Cyber Threat Predictions for 2019Top Cyber Threat Predictions for 2019
Top Cyber Threat Predictions for 2019
PECB •1.1K views
Nominum 2016 Fall Data Revelations Security Report by Yuriy Yuzifovich
Nominum 2016 Fall Data Revelations Security ReportNominum 2016 Fall Data Revelations Security Report
Nominum 2016 Fall Data Revelations Security Report
Yuriy Yuzifovich•20 views
Cybercrime by SERCOD
CybercrimeCybercrime
Cybercrime
SERCOD•2.1K views
Cybercrime: Radically Rethinking the Global Threat by NTT Innovation Institute Inc.
Cybercrime: Radically Rethinking the Global ThreatCybercrime: Radically Rethinking the Global Threat
Cybercrime: Radically Rethinking the Global Threat
NTT Innovation Institute Inc.•1.2K views
AI: The New Player in Cybersecurity (Nov. 08, 2023) by Takeshi Takahashi
AI: The New Player in Cybersecurity (Nov. 08, 2023)AI: The New Player in Cybersecurity (Nov. 08, 2023)
AI: The New Player in Cybersecurity (Nov. 08, 2023)
Takeshi Takahashi•39 views
Module 1- Introduction to Cybercrime.pptx by nikshaikh786
Module 1- Introduction to Cybercrime.pptxModule 1- Introduction to Cybercrime.pptx
Module 1- Introduction to Cybercrime.pptx
nikshaikh786•191 views
ethics final project by Victoriya Poplavskaya
ethics final projectethics final project
ethics final project
Victoriya Poplavskaya•949 views
AECF: A Look into Cyber Crime - Doomsday Preppers for the Naked and Afraid by Phil Agcaoili
AECF: A Look into Cyber Crime - Doomsday Preppers for the Naked and AfraidAECF: A Look into Cyber Crime - Doomsday Preppers for the Naked and Afraid
AECF: A Look into Cyber Crime - Doomsday Preppers for the Naked and Afraid
Phil Agcaoili•1.7K views
Cyber crime and security by Eng. Shuaib ibrahim
Cyber crime and securityCyber crime and security
Cyber crime and security
Eng. Shuaib ibrahim•37.5K views
CSU-1.pptx by RaviKiranReddyBH
CSU-1.pptxCSU-1.pptx
CSU-1.pptx
RaviKiranReddyBH•1 view
cyber crime by Mosuud jilani lipon
cyber crimecyber crime
cyber crime
Mosuud jilani lipon•13K views
Cyber security and threats by Harsh Kumar
Cyber security and threatsCyber security and threats
Cyber security and threats
Harsh Kumar•206 views
Cyber crime by Debayon Saha
Cyber crimeCyber crime
Cyber crime
Debayon Saha•3.9K views
Cyber Resilience by Ian-Edward Stafrace
Cyber ResilienceCyber Resilience
Cyber Resilience
Ian-Edward Stafrace•3.9K views
Cyber crime (2018 )updated by PrabhatChoudhary11
Cyber crime (2018 )updatedCyber crime (2018 )updated
Cyber crime (2018 )updated
PrabhatChoudhary11•558 views
cyber terrorism by Accenture
cyber terrorismcyber terrorism
cyber terrorism
Accenture•9.7K views

More from Andrew Morris

GreyNoise - Mass Exploitation by
GreyNoise - Mass ExploitationGreyNoise - Mass Exploitation
GreyNoise - Mass ExploitationAndrew Morris
95 views•17 slides
GreyNoise - Lowering Signal To Noise by
GreyNoise - Lowering Signal To NoiseGreyNoise - Lowering Signal To Noise
GreyNoise - Lowering Signal To NoiseAndrew Morris
450 views•19 slides
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams by
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse TeamsUsing GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse TeamsAndrew Morris
2.7K views•36 slides
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security... by
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Andrew Morris
2.3K views•39 slides
The Background Noise of the Internet by
The Background Noise of the InternetThe Background Noise of the Internet
The Background Noise of the InternetAndrew Morris
7.8K views•79 slides
Flaying the Blockchain Ledger for Fun, Profit, and Hip Hop by
Flaying the Blockchain Ledger for Fun, Profit, and Hip HopFlaying the Blockchain Ledger for Fun, Profit, and Hip Hop
Flaying the Blockchain Ledger for Fun, Profit, and Hip HopAndrew Morris
1.8K views•105 slides

More from Andrew Morris(10)

GreyNoise - Mass Exploitation by Andrew Morris
GreyNoise - Mass ExploitationGreyNoise - Mass Exploitation
GreyNoise - Mass Exploitation
Andrew Morris•95 views
GreyNoise - Lowering Signal To Noise by Andrew Morris
GreyNoise - Lowering Signal To NoiseGreyNoise - Lowering Signal To Noise
GreyNoise - Lowering Signal To Noise
Andrew Morris•450 views
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams by Andrew Morris
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse TeamsUsing GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams
Andrew Morris•2.7K views
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security... by Andrew Morris
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Andrew Morris•2.3K views
The Background Noise of the Internet by Andrew Morris
The Background Noise of the InternetThe Background Noise of the Internet
The Background Noise of the Internet
Andrew Morris•7.8K views
Flaying the Blockchain Ledger for Fun, Profit, and Hip Hop by Andrew Morris
Flaying the Blockchain Ledger for Fun, Profit, and Hip HopFlaying the Blockchain Ledger for Fun, Profit, and Hip Hop
Flaying the Blockchain Ledger for Fun, Profit, and Hip Hop
Andrew Morris•1.8K views
Weekend Malware Research 2012 by Andrew Morris
Weekend Malware Research 2012Weekend Malware Research 2012
Weekend Malware Research 2012
Andrew Morris•512 views
Shmoocon Epilogue 2013 - Ruining security models with SSH by Andrew Morris
Shmoocon Epilogue 2013 - Ruining security models with SSHShmoocon Epilogue 2013 - Ruining security models with SSH
Shmoocon Epilogue 2013 - Ruining security models with SSH
Andrew Morris•718 views
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns... by Andrew Morris
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
Andrew Morris•1.3K views
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ... by Andrew Morris
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
Andrew Morris•2.9K views

Recently uploaded

information by
informationinformation
informationkhelgishekhar
8 views•4 slides
Building trust in our information ecosystem: who do we trust in an emergency by
Building trust in our information ecosystem: who do we trust in an emergencyBuilding trust in our information ecosystem: who do we trust in an emergency
Building trust in our information ecosystem: who do we trust in an emergencyTina Purnat
98 views•18 slides
Marketing and Community Building in Web3 by
Marketing and Community Building in Web3Marketing and Community Building in Web3
Marketing and Community Building in Web3Federico Ast
12 views•64 slides
PORTFOLIO 1 (Bret Michael Pepito).pdf by
PORTFOLIO 1 (Bret Michael Pepito).pdfPORTFOLIO 1 (Bret Michael Pepito).pdf
PORTFOLIO 1 (Bret Michael Pepito).pdfbrejess0410
8 views•6 slides
DU Series - Day 4.pptx by
DU Series - Day 4.pptxDU Series - Day 4.pptx
DU Series - Day 4.pptxUiPathCommunity
100 views•28 slides
Is Entireweb better than Google by
Is Entireweb better than GoogleIs Entireweb better than Google
Is Entireweb better than Googlesebastianthomasbejan
12 views•1 slide

Recently uploaded(10)

information by khelgishekhar
informationinformation
information
khelgishekhar•8 views
Building trust in our information ecosystem: who do we trust in an emergency by Tina Purnat
Building trust in our information ecosystem: who do we trust in an emergencyBuilding trust in our information ecosystem: who do we trust in an emergency
Building trust in our information ecosystem: who do we trust in an emergency
Tina Purnat•98 views
Marketing and Community Building in Web3 by Federico Ast
Marketing and Community Building in Web3Marketing and Community Building in Web3
Marketing and Community Building in Web3
Federico Ast•12 views
PORTFOLIO 1 (Bret Michael Pepito).pdf by brejess0410
PORTFOLIO 1 (Bret Michael Pepito).pdfPORTFOLIO 1 (Bret Michael Pepito).pdf
PORTFOLIO 1 (Bret Michael Pepito).pdf
brejess0410•8 views
DU Series - Day 4.pptx by UiPathCommunity
DU Series - Day 4.pptxDU Series - Day 4.pptx
DU Series - Day 4.pptx
UiPathCommunity•100 views
Is Entireweb better than Google by sebastianthomasbejan
Is Entireweb better than GoogleIs Entireweb better than Google
Is Entireweb better than Google
sebastianthomasbejan•12 views
How to think like a threat actor for Kubernetes.pptx by LibbySchulze1
How to think like a threat actor for Kubernetes.pptxHow to think like a threat actor for Kubernetes.pptx
How to think like a threat actor for Kubernetes.pptx
LibbySchulze1•5 views
IETF 118: Starlink Protocol Performance by APNIC
IETF 118: Starlink Protocol PerformanceIETF 118: Starlink Protocol Performance
IETF 118: Starlink Protocol Performance
APNIC•244 views
WEB 2.O TOOLS: Empowering education.pptx by narmadhamanohar21
WEB 2.O TOOLS: Empowering education.pptxWEB 2.O TOOLS: Empowering education.pptx
WEB 2.O TOOLS: Empowering education.pptx
narmadhamanohar21•16 views
UiPath Document Understanding_Day 3.pptx by UiPathCommunity
UiPath Document Understanding_Day 3.pptxUiPath Document Understanding_Day 3.pptx
UiPath Document Understanding_Day 3.pptx
UiPathCommunity•103 views

Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel 2022

  • 2. Andrew Morris STAYING AHEAD OF INTERNET BACKGROUND EXPLOITATION
  • 3. Founder and CEO GreyNoise Intelligence @Andrew___Morris andrew@greynoise.io Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ANDREW MORRIS
  • 4. 1. Intro & Background 1. Part I - What Is The Problem? 2. Part II - Our Solution To The Problem 1. Part III - Things We’ve Observed 2. Summary & Recap Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 5. PART 1 - THE PROBLEM
  • 6. Every other month, a really bad vulnerability is identified, disclosed, weaponized, and exploited at scale around the internet, in some piece of common perimeter-facing software and nobody has any idea what to do about it. Scanning and exploiting vulnerabilities jumped up to the top infection vector in 2020 with a 35% share, surpassing phishing which was the top vector in 2019. Source: https://www.ibm.com/security/data-breach/threat-intelligence Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 35% of initial infections, according to IBM “Scan-and-exploit” top infection vector in 2020 IN PLAIN TERMS…
  • 7. ALL THE CELEBRITY VULNERABILITIES Andrew Morris | Staying Ahead Of Internet Background Exploitation
  • 8. ● Vulnerability research has evolved ○ Tooling and development has improved ○ Attack surface has increased Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 HERE’S WHY WE’RE HERE Mass scanning + vulnerability research = mass exploitation dying to happen ● Mass scanning has evolved ○ Tooling is better (Masscan, Zmap, etc) ○ Recyclable IPs are a thing (cloud) ○ The Internet is literally faster
  • 9. We used to think about bad guys hacking systems on the internet following this pattern: Find Vulnerabilities Scan Target, Enumerate, Profile Identify Target Profit Operate Exploit Vulnerabilities HACKING IN THE 90’s Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 10. Today more closely resembles an assembly line: Compromise Lots of Hosts Scan Target Internet Identify Target a viable Vulnerability Profit Trade Accesses or Operate Exploit Deconflict Accesses HACKING IN THE 20’s Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 11. But now: ○ $ASSET can increasingly refer to 0.0.0.0/0 ○ SOMEONE does AN EXPLOIT to THE ENTIRE INTERNET resulting in SHELLS AND CHAOS THREAT MODEL CREEP Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 To quote Bruce Potter at some point a few years ago: ○ $ACTOR does $ACTION to $ASSET resulting in $OUTCOME because $MOTIVATION
  • 12. On a daily basis, every individual routable IP on the Internet sees: ~3,000 unsolicited pings from… ~1,000 distinct IP addresses Each /24 receives about 46mb of unsolicited network data from ~200,000 IP addresses from SYNs alone Why so much scanning? ● BAD: Credential stuffing, proxy checking, brute forces, exploit vulnerabilities, etc ● GOOD: Web search, asset discovery, third party risk, security research The internet is just really noisy, man. Source: GreyNoise Intelligence WHAT IS INTERNET BACKGROUND NOISE? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Internet scanning of the internet by source IPv4 address, Jan-21 to Feb-22. Each pixel in this photo is a group of 256 IPs.; the “brightness” of each pixel is how many IPs in that group have been observed by GreyNoise.
  • 13. ● Alpha Strike Labs ● GoogleBot ● BinaryEdge.io ● Project Sonar ● Bitsight ● Censys ● ShadowServer.org ● cyber.casa ● ONYPHE ● InterneTTL ● BingBot ● Yandex Search Engine ● Cortex Xpanse ● ipip.net ● Shodan.io ● IPinfo.io ● Cloud System Networks ● Net Systems Research ● OpenIntel.nl ● Facebook Crawler ● AdScore ● Ahrefs ● Intrinsec ● DomainTools ● CriminalIP ● BLEXBot ● Arbor Observatory ● Technical University of Munich ● Mail.RU ● Palo Alto Crawler ● Petalbot ● Caida ● LeakIX ● Quadmetrics.com ● Archive.org ● Moz DotBot ● RWTH AACHEN University ● VeriSign ● Bit Discovery ● Project25499 ● Applebot ● CyberGreen ● ESET ● FH Muenster University ● Knoq ● Mojeek ● SecurityTrails ● University of Colorado SOME SOURCES OF “BENIGN” INTERNET BACKGROUND NOISE Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 14. “[A] telescope monitoring a single IP address (a /32) the average time to observe a host at 10 addresses per second is over 13 years and the time to observe with 95% likelihood is over 40 years.” http://www.cs.unc.edu/~jeffay/courses/nidsS05/measurement/moore-telescopes04.pdf 2004 Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 15. “[Masscan] can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine.” https://github.com/robertdavidgraham/masscan 2013 Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 16. https://www.greynoise.io/blog/a-patchy-server-greynoise-observes-path-traversal-and-remote-code-execution-in-apache-http ● Sept 29, 2021: ○ Patch submitted ● Oct 03, 2021: ○ GreyNoise observes first internet-wide vuln scan ● Oct 04, 2021: ○ Apache version update, patch is GA ● Oct 05, 2021: ○ Apache discloses vulnerability to CVE APACHE PATH TRAVERSAL Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 17. YES Remotely exploitable? WILL CVE-BLAH-BLAH BE “MASS EXPLOITED”? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Simple to exploit or public POC? YES Running on the internet? YES Widely deployed? YES The CVE is likely to be mass exploited
  • 18. Defenders ○ “Are you kidding me? Another one? Again?” Software Vendors ○ “This makes people afraid to run our software” WHO EXPERIENCES THE PAIN? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Cyber Security Vendors ○ “This is either an opportunity to make money, OR this makes us look like idiots” Hosting Providers ○ “Please stop popping boxes from our network, we can’t handle any more FBI calls or abuse complaints”
  • 19. WHY IS THIS PROBLEM HARD? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Trust ○ Lots of data is bad ○ Lack of filtering and quality assurance means nobody is willing to make automated decisions based on someone else’s data Money ○ Accidentally blocking revenue-generating users Speed ○ There is a “time-to-get- something-useful-to-say” ○ There is a “time-to-say-it” ○ If both do not happen prior to an attack hitting the perimeter, you lose the race` Scale issues
  • 20. ● “Whack-a-mole”-style short term blocking has surprisingly good results. ○ Reduces successful attacks by 70%, but needs to be fast ○ Hunting is more straightforward but obviously this means the compromise has already occurred ● More collective defense, more info sharing from vendors and groups who have good data NEXT TIME THE SH*T HITS THE FAN? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ● Fewer well-intentioned security researchers and vendors spraying exploits around ● Assume every service on your perimeter can suddenly become vulnerable on very little notice
  • 21. Super bad vulnerabilities are coming out every other month, bad guys exploit them at scale, and it’s a differently flavored dumpster fire every time Stopping the vulns from existing seems unlikely, so let’s try to detect and block before it hits a network we care about TL;DR Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 22. PART II - OUR SOLUTION TO THE PROBLEM
  • 23. WHO’S TRACKING VULN EXPLOITATION IN THE WILD? Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 24. GreyNoise AttackerKB US CISA 201 March 2020-Present 639 June 2020-Present 377 Nov. 2021-Present *United States Cybersecurity Infrastructure & Security Agency CVES EXPLOITED IN THE WILD Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 25. ● Deploy a huge network of sensors across the internet ● “Listen” to internet background noise (scans/probes) and internet background exploitation ONE WAY TO SOLVE THE PROBLEM Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ● Make the sensors look like lots of different software ● Fingerprint every exploit request we find ● Temporarily block offenders BEFORE an attack lands on the perimeter
  • 26. Years ago, someone with a lot of money and a lot of weird problems wanted to know if the computers they were running on the internet were seeing a “normal” amount of scans, or an undue amount of attention. I became obsessed and here we are years later: GreyNoise. GREYNOISE ORIGIN STORY Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 27. ● Thousands of sensors - we operate thousands of sensors (kinda like honeypots) across the globe ○ Centrally managed ○ Distributed and geographically diverse ○ What they masquerade as is programmable ○ Every host is ephemeral ● Billions of events - as of March 2022 we’re processing and storing several billion events per day GREYNOISE TL;DR Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 ● Tagging - we add and maintain signatures on exploit, actor, and other patterns using an internally developed tagging engine and DSL ● Use cases - GreyNoise is useful for several use-cases; one of the increasingly popular use-cases is protecting orgs from opportunistic compromise ● Free data - we give away an insane amount of free data. Seriously.
  • 28. CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Speed Provider OpSec Cost Automation Geography Data / Scale Masqueraders / Fakers
  • 29. ● Staying “in front of” the exploit is hard ● We only have a few minutes maximum to go from: ○ Malicious traffic hitting the first few sensors.. ○ …classifying the traffic as XYZ exploit… ○ And finally pushing a “block decision” ● It isn’t enough to classify traffic correctly; you have to classify correctly in time. SPEED CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 30. ● Major cloud providers are easy ○ AWS, Google, Azure, DigitalOcean… ● Language barriers ● Automation maturity ● Infrastructure reliability ● Cost ● GeoIP is fakeish ● No colos SELECTING PROVIDERS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 31. ● AWS is the standard for maturity ● API/Deployment Automation ● Minimum viable features ● Cost ○ Smallest instance ○ Many IPs to one instance ● Reliability ELEVATING CLOUD PROVIDERS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 32. ● Lacking financial automation ○ Pre-payment model ○ Remember to top up… ● IPs per host ○ One IP per host is expensive ○ Many IPs to one host is “expensive” ■ Indirect automation and complexity costs COST CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 33. ● Find the lowest common denominators for deployment and automation ○ Templating/code generation ○ Custom Terraform providers ○ “metacloud” ● Testing is *really* hard ● No common standard AUTOMATION CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 34. ● Unreliable APIs ● Unreliable infrastructure ● Latency ● Debugging across multiple providers RELIABILITY CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 35. ● Do you have sensors in X country? ○ GeoIP is fake… sometimes ○ Ambiguous regions ● No colos ● Dependant on ○ Automation maturity, cost, reliability ● Do you know how hard it is to find cloud hosting providers in most areas of the world??? ● Once you hit a critical mass you can do cool stuff like… identify all IPs that are specifically scanning Israel’s IP space… GEOGRAPHICAL CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 36. HERE ARE ALL THE IPS SPECIFICALLY SCANNING/CRAWLING/ATTACKING ISRAEL’S IP SPACE, & NOBODY ELSE’S https://api.greynoise.io/datashots/bluehat/israel.csv
  • 37. ● Account freezes ○ Russia, Ukraine, China ○ Photo verification (sorry Greg) ○ Vetting process ○ Flagged for churning sensors ● Typical big data/scaling challenges ● Shout out to the masqueraders OTHER CHALLENGES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 39. PART III - THINGS WE’VE OBSERVED
  • 40. ● CVE-2021-41773, Apache Path Traversal ● CVE-2021-38647, OMIGOD ● CVE-2021-26084, Atlassian Confluence OGNL Injection ● CVE-2021-44228, Log4Shell CASE STUDIES Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 43. TIMELINE Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 October 04, 2021 Apache version update, patch is GA October 05, 2021 Apache discloses vulnerability to CVE September 29, 2021 Patch Submitted October 03, 2021 GreyNoise observes first internet-wide vuln scan
  • 51. ACCIDENTAL “EXPLOITATION” 4 MONTHS BEFORE PUBLICLY KNOWN
  • 53. OPPORTUNISTIC EXPLOITATION/SCANNING IN LESS THAN 4 HOURS AFTER TOOLING RELEASED
  • 54. ● Interestingly, the first huge wave came from exclusively Tor nodes ● Most attempts at the start were just stuffing the Log4Shell string in random places. ● Shortly after, custom product-specific payloads LOG 4J Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 55. “scanning != exploiting” except when scanning == exploiting, like with Log4j
  • 56. Security companies and researchers who exploit vulns with good intentions make this worse while trying to be helpful
  • 59. On any given day, 73% of IPs responsible for opportunistic scan/exploit noise were seen the day before. Only 27% are “new”.
  • 60. ● Spoofed noise storms ● Bad guys acting like security companies that scan the internet ● Upstream blocks ● Just like bad guys, security companies think they’re super sneaky 🤫 ● Printjacking WEIRD STUFF Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 63. Whack-a-mole shows a surprising amount of promise BLOCKING NOISE Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 64. Hypothesis: ● Blocking extremely fresh internet background exploitation IPs will meaningfully increases the amount of time it takes for a vulnerable host on the internet to be compromised “WHACK A MOLE” EXPERIMENT Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022 Method: ● Stand up two identical vulnerable hosts, open to the internet, running poorly credentialed services ○ SSH and telnet ○ admin/aSdmin ○ root/admin ● Measure time to first compromise; total number of compromises
  • 65. 4 Days 6 Hours 19 Minutes Blocked Host Mean Time to Compromise Unblocked Host Mean Time to Compromise ● 32 compromises/day ● 206 compromise attempts/hour ● 4 compromises/day ● 35 compromise attempts/hour “WHACK A MOLE” RESULTS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 66. Tiny fast IP blocklists (whack-a-mole) are gross but they work better than you’d expect
  • 67. There is relatively little we can do to prevent the next Log4J, but we can make it suck less by centralizing information and providing ready-use real-time block lists STAYING AHEAD OF THE NEXT LOG4J Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 72. This is live right now: https://greynoise.io/ GREYNOISE COMMUNITY TRENDS Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022
  • 73. ● Internet mass exploitation is quantifiably getting worse. I expect this to continue. ● A huge, distributed, sensor system such as GreyNoise is effective at reducing opportunistic compromises ● Running this huge sensor network has challenges but they’re all addressable ● Instead of hoping another Big Bad Vuln doesn’t happen, let’s prepare for when it does CONCLUSION Andrew Morris | Staying Ahead Of Internet Background Exploitation BLUEHAT IL 2022