GreyNoise Study Finds Edge-Device Scanning Surges Can Precede Vulnerability Disclosures
Summary
GreyNoise reported that, in a 103-day study, about half of edge-device reconnaissance surges were followed by a vulnerability disclosure from the targeted vendor within three weeks; the median lead time was nine days.
Key points
- GreyNoise recorded 104 distinct activity surges across 18 vendors during the 103-day study.
- About half of the surges were followed by a vulnerability disclosure from the targeted vendor within three weeks; the median lead time was nine days.
- The monitored targets included vendors of routers, VPNs, firewalls, and other security appliances.
- GreyNoise researchers said simultaneous increases in session counts and unique source IPs signal coordinated escalation; an IP-count increase alone is not enough to infer a vulnerability is coming.
- The researchers advised defenders to investigate vendor-targeted scanning spikes as a potential early warning, before public vulnerability alerts.
Article Details
- Publisher
- CyberScoop
- Report Period
- Last winter; the study lasted 103 days, but exact dates are not disclosed.
- Scope
- GreyNoise analysis of reconnaissance activity surges targeting vendors of edge devices, including routers, VPNs, firewalls, and other security appliances.
- Sample Size
- 104 distinct activity surges across 18 vendors.
- Key Statistics
- GreyNoise detected 104 distinct activity surges across 18 vendors during the 103-day study.
- The median warning before a targeted vendor's public vulnerability alert was nine days.
- Roughly half of the detected activity surges were followed by a vulnerability disclosure from the same vendor within three weeks.
- The study covered 103 days last winter; exact dates are not disclosed.
- Recommendations
- Treat simultaneous increases in session counts and unique source IPs targeting a vendor as a high-confidence reason to investigate more closely.
- Do not assume a vulnerability is forthcoming based only on an increase in unique source IPs.
People
Vendors
Cisco#GreyNoise #CiscoF5the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.Fortineta swarm of vulnerabilities disclosed by vendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.GreyNoiseGreyNoise research shows that spikes in edge-device reconnaissance often precede public vulnerability disclosures, giving defenders advance notice.Hewlett Packard Enterprisedisclosed by vendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.Ivantiof vulnerabilities disclosed by vendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.Juniper Networksthe market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.MicroTikdisclosed by vendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.NETGEARincluding Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.Palo Alto Networkssurges to a swarm of vulnerabilities disclosed by vendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.TP-Linkby vendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.VMwarevendors across the market, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MicroTik, TP-Link, VMware, Juniper, F5, Netgear and others.