NoiseLetter November 2024

November at GreyNoise brought plenty to feast on! Between zero-day insights, fresh blogs, and today’s big launch of our upgraded sensor and platform architecture, we’ve served up more visibility and insights just in time for the holidays. 🦃 Check it all out in this month's NoiseLetter!

‍

A̶n̶d̶r̶e̶w̶ Bob Unfiltered

GreyNoise Founder Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like, but this month, Bob Rudis, VP of Data Science + Research, takes over and gives his thoughts.

‍

Featured

GreyNoise is proud to announce a significant upgrade to its platform’s sensor and data pipeline technology, introducing advanced capabilities that elevate visibility and threat intelligence. Key highlights of the upgrade include:

• Expanded Visibility: The new sensors now detect traffic from an additional 190,000 IPs (708k @ 12:00pm, compared to 518k at 7:00am - and this is growing by 20k per hour), providing broader coverage than the legacy sensors.
• Increased Activity Coverage: Over 800 tags saw activity — 200-500 more than the legacy pipeline could capture.
• Exclusive Insights: The upgraded sensors enable observation of over 1,000 previously undetectable tags, including more than 60 seen this morning. One such example: https://viz.greynoise.io/tags/zyxel-nas-firmware-backdoor-cve-2024-29972-attempt

These enhancements mark a major step forward in the platform’s ability to deliver actionable intelligence. Users are encouraged to log in to viz.greynoise.io to experience the impact of these improvements firsthand.

Check it Out >>

‍

Fresh Content

• Webcast: Storm⚡️Watch | Latest Episode
  
• Webinar: How GreyNoise Discovered 0-Day Vulns Using AI + Human Expertise
• Blog: New Report Reveals Hidden Risks: How Internet-Exposed Systems Threaten Critical Infrastructure
• GreyNoise Labs Blog: Null Problem! Or: The Dangers of an Invisible Byte
• Partner Report: Censys 2024 State of the Internet Report

‍

Recent Tags and Vulnerabilities

GreyNoise Labs released 18 tags during the month of Novembe:

• Apache Solr CVE-2024-45216 Authentication Bypass Attempt‍
• Citrix Virtual Apps and Desktops RCE Attempt
• ‍CyberPanel completePath CVE-2024-51568 RCE Attempt
• ‍CyberPanel getresetstatus CVE-2024-51378 Command Injection Attempt
• ‍D-Link NAS name Parameter CVE-2024-10914 Command Injection Attempt
• ‍Delta Electronics InfraSuite Device Master CVE-2023-47207 RCE Attempt‍
• FortiGate to FortiManager (FGFM) Protocol Scanner
• ‍Fortinet FortiManager CVE-2024-47575 RCE Attempt
• ‍Gradio CVE-2021-43831 Directory Traversal Attempt
• ‍LevelOne WBR-6012 CVE-2024-33699 Unverified Password Change Attempt
• ‍Palo Alto PAN-OS Auth Bypass CVE-2024-0012 Attempt
• ‍Palo Alto PAN-OS Command Injection CVE-2024-9474 Attempt
• ‍Palo Alto PAN-OS Version Scanner
• ‍SecurEnvoy Two Factor Authentication CVE-2024-37393 LDAP Injection Attempt
• ‍Seeyon OA JNDI RCE Attempt
• ‍Spring WebMvc WebFlux CVE-2024-38816 Path Traversal Attempt
• ‍Windows WebIQ CVE-2024-8752 Directory Traversal Attempt
• ‍pgAdmin OAuth2 CVE-2024-9014 Information Disclosure Check

‍

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

‍

Meme of the Month

‍

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

Not subscribed to our NoiseLetter? Subscribe here.