Soap Box: How to dismantle Volt Typhoon-style relay networks
Feb 11, 2024
auto_awesome
Andrew Morris, Greynoise founder, discusses the persistent network of compromised routers despite US actions. Vendors using Greynoise for early warnings, and reversing exploitation attempts. Topics include challenges in dismantling relay networks, fingerprinting techniques, hidden threats in cybersecurity, APT crews' network usage, product security incidents, vulnerability verification, and defensive retaliation.
Ongoing Volt Typhoon infections indicate resilient network despite government takedown.
Grey Noise serves as early warning system for vendors, detecting and addressing product exploitation attempts.
Deep dives
Gray Noise: Operating Global Honeypots
Gray Noise is known for operating a network of honeypots that offer insights into internet attacks. From compromised devices by Volt Typhoon actors to tracking new exploits, Gray Noise's data aids in identifying targeted versus mass scanning, revealing insights into networks of compromised devices used by attackers.
Impact of US Government Takedown on Chinese Routers
Despite a recent US government takedown of compromised Chinese routers, Gray Noise continues to observe active Volt Typhoon infections across residential ISPs in various countries. The disruption appears limited, with ongoing infections indicating potential rebuilding efforts, emphasizing the continuous need for threat detection and monitoring.
Early Warning System for Vendor Exploits
Grey Noise's capability to identify vulnerabilities exploited in products has positioned them as an early warning system for vendors. By detecting exploitation attempts quickly and generating actionable insights, Grey Noise enables vendors to proactively secure their products and address potential vulnerabilities, potentially mitigating larger security risks.
Automated Exploit Generation and Use Case Expansion
The development of 'sift' by Grey Noise, utilizing language models, enables automated exploit generation for vulnerabilities surfaced, leading to potential Metasploit modules creation. With the ability to automatically capture and potentially replicate exploits, Grey Noise expands its use cases to facilitate rapid testing, resiliency assessment, and threat response for customers and vendors alike.