It's Another Week of the Vulnpocalypse. Bring a Coat
It’s Another Week of the Vulnpocalypse. Bring a Coat
As we have learned to embrace the vulnpocalypse, we still feel there should be a rule against an advisory having over 1,000 associated CVEs. There should be some sort of law as to how many CVEs can be put into a single advisory. We don’t think we’re in the midst of a vulnpocalypse so much as a patchapocalypse (tm). We hope that AI firms start competing for who can write the most secure code and automate patching versus who can break into everyone else quicker. 🚀
The volume of new information continues to surge; daily additions have more than doubled in the past week with a new rewrite of the backend automation. We are integrating AI here and there to audit data (outside of our ecosystem) and may produce a malware identified feed in the coming months as well. There’s an effort to pivot things to a more automated fashion on the backend to handle the AIpocalypse of vulnerabilities and related exploits. We are still at a 10x+ daily rate of additions from last year at this time. 📈
Threat Landscape
On the threat landscape, new zero days have surfaced from Exploit-Garbage and there is also an interesting RoguePlanet patch bypass released by NightmareEclipse. A staggering amount of Joomla proof of concepts have also been added recently. We also observed botnet activity targeting the site. I’m not going to call out the nation state, but we saw your botnet sprawl against the site this morning. It would be prudent to chill out; 15k requests from 12k unique IPs across 6k unique netblocks in a handful of minutes was interesting, but easily noticed.
Additionally, regarding ongoing threat activity, to the owner of another botnet from this morning: performing a single request per IP at this scale, albeit impressive, has probably cost you more in tokens to facilitate than API access would have cost you. But when you DDoS us, you DDoS yourself based on what you are trying to achieve. Surprisingly only an occasional load spike has happened but at the scale this is occurring, we may need to just start dropping packets for many tens of thousands of IP addresses if you persist. And that is not fun for anyone.
The distributed behavior between requests is pretty obvious. Side note - although they may seem noisy, the amount of advisories that come from SUSE and Red Hat are staggering in comparison to all other distros. Are others just not patching, or just not tracking?