Mass Exploitation Attacks: Is “Whack-A-Mole” Blocking a Viable Security Strategy? | Cybersecurity Blog | Grey Noise

Summary: GreyNoise ran an experiment from January 12-30, 2022 with two identical weakly-credentialed honeypots, blocking scanner IPs from its NOISE data set on one via iptables and leaving the other open. The unblocked host was compromised in an average of 19 minutes, while the blocked host took 4 days, 6 hours, and 24 minutes, though the static blocklist decayed as daily attempts rose from an average of six on day one to over 2,500 by day five.
Why it matters: An exposed host with weak credentials fell in 19 minutes, so the window between a vulnerability becoming public and compromise is measured in minutes, not days. The blocklist only held because it was fresh; without updates at least every 24 hours, its effectiveness decayed sharply within five days.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2021-44228
Related: CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021
Threat Source Newsletter (Dec. 16, 2021) Cyber Risks ·
Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild Cyber Risks ·