Smash-and-Grab Extortion


The "2024 Attack Intelligence Report" from the staff at Rapid7 is a well-researched, well-written report that is worthy of careful study. There has been a big increase in zero days, and attackers are moving from initial access to exploitation in minutes or hours rather than days or weeks. So the conventional patch and put strategy is as effective as a firetruck showing up after a building has burned to the ground! Of course, patch and put could prevent future attacks, but taking into account that patch development takes from days to weeks and that the average time to apply critical patches is 16 days, devices are vulnerable for a long time after the zero-day has become public knowledge. This allows smaller actors to get their share of the meat, much like the vultures they are. In view of Rapid7's report, something different must be done to protect IoT and other vulnerable devices.

Read the full article at The Hacker News