GreyNoise launches free device to guard in opposition to ‘scary’ vulnerabilities like Log4j

GreyNoise Intelligence right now unveiled a brand new device that goals to assist safety groups to extra simply block recognized attackers who’re looking for to take advantage of vital vulnerabilities on a big scale.

All through the previous two years, an particularly “huge, unhealthy and scary” vulnerability has cropped up about as soon as each two months or so, says GreyNoise founder and CEO Andrew Morris. The invention of such vulnerabilities inevitably results in a scramble amongst cybersecurity professionals, and “everybody freaking out about it,” Morris mentioned.

The newest was the vulnerability often known as Log4Shell, an simply exploited distant code execution (RCE) flaw in Apache Log4j. The RCE vulnerability within the broadly used logging software program element was disclosed on December 10.

The vulnerability in Log4j “was significantly unhealthy,” Morris mentioned. “Nevertheless it made us notice, it’s simply going to maintain taking place.”

GreyNoise operates sensors in a whole bunch of knowledge facilities worldwide, capturing knowledge from across the web that may pinpoint malicious actors and their exercise. Shortly after the disclosure of the vulnerability in Log4j, the Washington, D.C.-based startup launched its trove of knowledge totally free to the general public.

Now, with its new device, Examine 4.0, GreyNoise is aiming to streamline what it did for Log4j for future vulnerabilities which can be particularly extreme. The device will present defenders with entry to info that they will use to make selections — in addition to a option to extra simply do automated blocking for IP addresses which have been making an attempt to take advantage of the vulnerability, Morris mentioned.

Defending in opposition to exploits

For safety groups, utilizing the device will be capable to purchase them a while whereas they patch their methods, he mentioned.

“The technique is, attempt to get out forward of it as finest we are able to and get as a lot info as potential about whose exploiting the vulnerability at scale. After which, get that info to as many individuals as potential — in as low-friction a means as potential,” Morris mentioned.

The way in which that GreyNoise has determined to try this is by offering dynamic block lists, which “folks can feed right into a ton of various safety merchandise — that simply routinely replace with the IP addresses of all the hosts which can be exploiting a vulnerability at scale,” he mentioned. “So folks can principally punch it in and simply stroll away.”

Examine 4.0 is aimed toward defending in opposition to opportunistic “scan-and-exploit” assaults — involving vulnerabilities that have an effect on the perimeter and are being exploited at a big scale. Along with Log4Shell, different vulnerabilities which have match this standards embrace the Pulse Safe VPN vulnerability, EternalBlue (which was exploited within the WannaCry ransomware assaults), Azure “OMIGOD” and the current Apache path traversal vulnerability, based on Morris.

Key capabilities for the GreyNoise Examine 4.0 device embrace fast triaging of alerts primarily based on classifications of the alerts as malicious, benign or focused, and identification of trending internet-based assaults which can be concentrating on sure vulnerabilities. The device may even enable customers to dam and hunt for IP addresses which can be opportunistically attacking a sure vulnerability, based on GreyNoise.

‘Much less friction’ for customers

With the brand new device, “we’re actually simply attempting to repeat what we did for Log4j — besides do it at scale, do it on a regular basis and do it with rather a lot much less friction for the consumer,” Morris mentioned.

For customers which have a free account with GreyNoise, the consumer simply has to repeat the hyperlink for a specific vulnerability after which feed that hyperlink into their safety device — reminiscent of a next-gen firewall or risk intelligence gateway, he mentioned. The device will then frequently pull within the dynamic block checklist, to maintain the checklist of unhealthy hosts up-to-date, and can block these unhealthy hosts, Morris mentioned.

GreyNoise, which has about 100 paying clients, is within the technique of determining what options to supply to these clients on high of the free capabilities, he famous.

Finally, GreyNoise is looking for to study from the Log4j expertise, “in order that the following time this occurs — which it is going to — we’re just a little bit extra well-prepared,” Morris mentioned. “We wish to do as a lot as we are able to to make the issues suck much less, for as many individuals as potential.”