Hello, welcome to the Tuesday, August 8, 2020,

3 edition of the Santernet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm

recording from Jacksonville, Florida. Today, I did a little bit of cleanup of our data in particular

when it comes to researchers scanning the internet.

So I took the opportunity to put together a quick diary explaining what the different groups are that we are tracking here.

About 28,000 IP addresses are part of that list, and we track 30 different entities that are scanning the internet for more or less research purposes. The hard part, of course, always what's sort of defined as

legitimate research. Personally, I include IP address or groups in this list that identify

themselves as researchers, So essentially, I take

their word for it. And of course, I expect them to do port scans and the like, but not to

exploit any actual vulnerabilities. Not all of these research efforts are academic in nature. Some

are commercial and often, for example,

for monitoring of attack surfaces, that's sort of one service that a lot of them are offering,

but also some of them are offering based out of a scoring system where you can check up

which companies have how many systems exposed to the internet and how many

of them are vulnerable. For more details, see the diary or just, well, take a look at our API

where you can retrieve these IP addresses. And researchers from Kasada did document an interesting set of events where, well, the bad guys are sort of going after each other.

Now, while this is something to not be too concerned about, of course, the problem here is also that the tool they are exploiting is a calmly used open source penetration testing tool, Open Bullet.

Open Bullet is, well, essentially a way to automate brute forcing, credential stuffing attacks.

It interfaces with headless browsers to get a more realistic interaction with websites.

It even has some tricks and such in order to bypass some catch us.

The trick here is that in order to use Open Bullet, you do need a configuration file,

which essentially is a script that describes how to test a particular website.

...