Andrew Morris (afk)
@Andrew___Morris
Followers
20,169
Following
2,664
Media
1,696
Statuses
13,280
🔳 Internet listener. Founder/Chief Architect of GreyNoise Intelligence ( @GreyNoiseIO )
Washington, DC
Joined September 2011
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
MARTIN AL 9009
• 184921 Tweets
Juliana
• 144014 Tweets
#WWERaw
• 95407 Tweets
Ceci Flores
• 92859 Tweets
Atlético
• 52895 Tweets
Hulk
• 51492 Tweets
Pritchard
• 47378 Tweets
ニンダイ
• 45871 Tweets
Seth
• 40116 Tweets
#NBAFinals
• 27585 Tweets
土砂降り
• 26752 Tweets
Jayson Tatum
• 23753 Tweets
Rony
• 22188 Tweets
Otis
• 20764 Tweets
Estevão
• 20134 Tweets
MITB
• 17714 Tweets
大雨の中
• 14002 Tweets
Textor
• 10221 Tweets
TIL the standard Kafka command for doing a health check is issuing the byte sequence "ruok" to the main service. like... "r u okay?"
then it goes "imok" lmaoooooooo
43
480
6K
linux is by far the best operating system for doing absolutely anything other than using the computer
83
273
4K
Hmm not to be a wet blanket or anything but I literally just downloaded the infected installer from the Solarwinds website and extracted the installer/various CABs and found that the backdoor'd DLL is definitely still contained in the installer on the website literally right now
64
611
2K
You can *feel* when AWS has outages as you browse the internet. For example, I just tried to make a meme about this AWS outage and the MEME GENERATOR WEBSITE I WAS ON USES AWS so I couldn't make it.
26
221
2K
The risk of getting eaten by wolves by is "virtually non-existent", according to a new study by the International Wolves Syndicate, the Wolves Alliance, and the Commission Of Hungry Wolves
The risk of COVID-19 exposure onboard an aircraft is “virtually non-existent,” according to a new study by Boeing, United Airlines and the Department of Defense.
2K
979
4K
29
395
2K
In light of the Russian ground invasion of Ukraine, we (
@GreyNoise
) are doing a few things to be as helpful as possible for network defenders in Ukraine. I understand that the impact will be small all things considered, but this is just where we are:
24
312
1K
Pour one out for all the unhandled exceptions occurring in thousands and thousands of Twitter bot code running around the world right now
12
226
1K
Fuck money. We're gonna start posting IOCs/raw data for hosts exploiting Apache Log4J CVE-2021-44228 as often as we can to get the info to as many people as possible. Gists/pastes to follow from the GN twitter account.
14
304
1K
This IP is scanning every IP on the internet for like every vuln in the world. The Internet is wild.
34
299
1K
an efficiency thing I do when rebooting linux boxes to SSH back in as soon as humanly possible is prepend an SSH command with "ping -o 1.1.1.1" which exits and moves to the next command as soon as it recvs a ping response putting you back into the box the second it boots back up
21
320
1K
Lots of cyber security companies are going to fail this year. They will close their doors from running out of money or go to private equity asset sales. This is going to suck in the near term but be a good thing for the industry in the mid to long term. Many of these businesses…
57
187
1K
I'd like to do an overview of the three most common use-cases to use
@GreyNoiseIO
for.
1. Ignore/deprioritize pointless telemetry or alerts in the SOC
2. Identify compromised systems
3. Track which vulnerabilities are being opportunistically exploited ITW
Thread (1/26)
4
81
930
This blog post is the nerd equivalent of an absolutely ruthless rap diss track. I am completely floored.
18
233
1K
We're shutting
@GreyNoiseIO
down for two weeks and giving every employee mandatory PTO in July to give folks time to decompress from the pandemic. Services will continue to run and someone will always be on call for technical emergencies.
23
77
948
remember when we passed laws to improve privacy on the internet and the only impact they had is now we have to click through a bunch of stupid popups to use literally any website? anyways happy cybersecurity awareness month everyone
10
124
912
Someone who works in security for an extremely large pizza chain uses GreyNoise from their corporate network almost every day and whoever you are I need you to understand from the bottom of my heart that we will absolutely give you free GreyNoise Enterprise for unlimited pizza
20
102
852
fun easter egg I just noticed in google public DNS
3
183
764
AWS HAS ENTERED THE HUGE HONEYPOT NETWORK GAME LETS GOOOOOOOOOOO
stoked to see
@awscloud
finding success with honeypots. I continue to carry an incredibly healthy respect for the excellent folks at
@AWS_Security
.
BLUF: huge, adaptive honeypot networks…
9
121
617
just found out Linux has a feature that’s basically WSL without Windows called the terminal? sounds promising, excited to try it out
27
53
605
I'm extremely excited to announce that
@GreyNoiseIO
has closed a $15M Series A investment. Loads of progress, tons to celebrate, and tons of work to do. Thanks to all of our employees, users, and customers for their continued trust in us. Onward.
63
61
596
This is available now. The following are links to all IPs that are scanning/attempting to compromise *exclusively* Ukrainian IP space, as detected by
@GreyNoiseIO
sensors located in-country. These IPs are targeting Ukraine.
api[.]greynoise[.]io/datashots/ukraine/manifest.json
2) (SHORTLY) We're publishing a free, public, unauthenticated, self-updating feed of all IPs that are exclusively targeting devices geographically located in Ukraine's IP space with scans, exploits, etc. I will post the link to this as soon as it has been pushed to production.
5
57
453
14
259
575
Where the fuck are my cybersecurity professionals
over 40 at? GreyNoise just released our Qradar integration. Hit us up.
110
24
541
One of my favorite things to do is go on threat feed websites, copy the list of the "top 100 bad guy IPs of the day" or whatever, then paste them into `greynoise analyze` and see that 30% of them are legitimate security companies just scanning the Internet
7
112
520
Can whoever is hitting the GreyNoise API through round-robin Tor exit nodes to bypass our rate limiting PLEASE just email me for an API key instead of making me get off my ass and code up a feature to block Tor exit nodes????? THANKS
11
73
503
All GreyNoise Early Access Program customers have just been provisioned with Advanced Intel, which includes IP Similarity, Time Series, and Geo Dest IP features. Tomorrow we provision community VIPs. Please shoot thoughts, feedback, complaints, etc to PM extraordinaire
@kimb3r__
!
10
53
452
walking around the RSA vendor floor for the first time in a few years & forgot how utterly jarring it is. wtf does this zebra petting zoo have to do with mail security? why is there a blimp? who put a screenshot of a password managers mediocre user interface on a stretch hummer??
53
36
497
My sincere intention is not one of self promotion. I don't give a shit if you buy our products or not as a result of this. There is a time and place for grifting and shilling and it is not here or now.
14
11
483
We're building an anti-bot scraping feature in the GreyNoise visualizer where after your IP exceeds our request threshold, instead of rate-limiting or banning you, we simply start passing you fake data with completely random IPs.
24
71
475
We're shutting
@GreyNoiseIO
down for two weeks and giving every employee mandatory PTO again this year, starting this Friday. Services will continue to operate and someone will be on call for emergencies.
If y'all need us over the next two weeks, you'll have to wait✌🏻
We're shutting
@GreyNoiseIO
down for two weeks and giving every employee mandatory PTO in July to give folks time to decompress from the pandemic. Services will continue to run and someone will always be on call for technical emergencies.
23
77
948
10
28
478
2) (SHORTLY) We're publishing a free, public, unauthenticated, self-updating feed of all IPs that are exclusively targeting devices geographically located in Ukraine's IP space with scans, exploits, etc. I will post the link to this as soon as it has been pushed to production.
5
57
453
1) (NOW) Any and all ukrainian emails registered to GreyNoise have been upgraded to VIP which includes full, uncapped enterprise access to all GreyNoise products. All marketing, upsell, and conversion communications will be explicitly and indefinitely opted out.
2
36
445
what feeling immediately hits you when you see this
87
65
443
We're about to cross 100 enterprise customers at GreyNoise. I'm just really proud of that.
25
6
442
Enrich all IPs you are connecting to against GN
sudo netstat -anp TCP | grep ESTAB | grep -v "127.0.0.1" | grep -E -o "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" | grep -v "$192\.\|10\." | sort -u | while read ip;do curl hxxps://api.greynoise.io/v3/community/$ip; echo; done
12
131
436
For kicks, I set up an interactsh server with authoritative DNS, wrote a bit of code that gens a random UUID dot mydomain dot com at runtime, resolves DNS+grabs a web page, compiled it into an exe, and uploaded it to a few malware sandboxes. Results are wild. Here are some stats:
19
78
438
I'm EXTRMELY excited to announce a $4.8M investment in
@GreyNoiseIO
lead by
@CRV
.
Every single dollar of this investment will go towards building a better product for all of our community users and enterprise customers.
63
40
422
For the 3rd year in a row, we're shutting
@GreyNoiseIO
down for 2 weeks- every employee is on mandatory PTO starting this Friday. Services will continue to operate. A skeleton crew will be on call for emergencies.
If yall need us over the next 2 weeks, you'll just have to wait✌🏻
We're shutting
@GreyNoiseIO
down for two weeks and giving every employee mandatory PTO again this year, starting this Friday. Services will continue to operate and someone will be on call for emergencies.
If y'all need us over the next two weeks, you'll have to wait✌🏻
10
28
478
16
26
424
There is a thin line between loving computers and violently hating computers and I walk that line every day of my life
7
257
406
Wew okay, so there's some REALLY bizarre internet-wide scan traffic happening right now in
@GreyNoiseIO
. it started two/three hours ago, quieted down for a few minutes, then just started up again. I'm going to do my best to stream of conscious what's going on while we dig in:
19
173
411
didn't know kafka was an anxious teenaged texter
5
7
396
.
@ThePocketReport
is what SNL wants to be. Fraction of a fraction of the operating budget but 100x the bite. Strongly recommend to any fellow annoying lefties. 10/10.
6
19
382
thinking about when we deployed an initial test sensor in the islamic republic of ir*n and ran apt-get update and it came back with a certificate error
12
10
375
Ever since I realized
@seanspicer
's cell phone was registered on his public WHOIS records I periodically send him supportive text messages
9
102
364
.
@GreyNoiseIO
is about to close our 50th enterprise customer and we're hanging out around 10k weekly active community users. Other than some swag and two parties, we've never spent a single dollar on marketing, and we're fewer than 10 people. I cannot believe this. I am so proud.
30
25
366
I was interviewing a candidate for a job at GreyNoise last week and the candidate asked me which CEOs I look up to the most. I told him it was the founder of Costco, specifically when he told their new CEO that if he raised the price on the $1.50 hotdog he'd "fucking kill him"
2
17
358
coding a bot when i get home that auto responds to unsolicited SMS with the entire script of Bee Movie line by line
27
17
347
$ pip3 install greynoiselabs
$ greynoiselabs init
$ greynoiselabs c2s
$ greynoiselabs knocks
$ greynoiselabs http-requests
$ greynoiselabs noise-rank
$ greynoiselabs payloads
$ greynoiselabs popular-ips
6
36
326
drank my coffee in the shower this morning cuz who gives a shit anymore
27
18
337
One of these days the cybersecurity/threat intel industry is going to realize that the bad guys they're monitoring w/ sock puppets in those underground darkweb chat rooms are all just other sock puppets from other competing threat intel companies
18
35
333
update: Now that we’ve closed our Series A we’re completely gutting the GreyNoise backend, completely rearchitecting, and rewriting most components from scratch.
If y’all think GreyNoise is cool now, your minds are going to fcking shredded in six months.
9
25
336
function gn()
{
curl -s hxxps://api.greynoise.io/v3/community/$1 | python -m json.tool
}
^^ replace "hxxp" w/ "http", drop this in your .bashrc or .bash_profile and use the GreyNoise Community API straight from your terminal without installing anything
8
71
332
My favorite stereotype is that computer people are good at math. I'm horrible at math. Computers are the reason WHY I'm so bad at math. I haven't done math in like a decade. I just tell the computer to do all the math.
20
18
317
The Internet's best kept secret- ARINs public & unauthenticated REST API for WHOIS / ASN / point of contact lookups
7
139
309
One of these days we'll all wake up and realize that the idea of a "Cybersecurity Industry" was a bad idea
24
24
301
All I use Linkedin for is flexing. Thats literally it. I accept every single person who requests to follow me specifically so that I have more people to flex in front of. If I'm not posting then I'm busy working on something to flex later. I'm not humbled and honored. I'm flexing
19
21
305
Big news: We've hired Ash Devata (
@devata
) to replace me as the new CEO of
@GreyNoiseIO
. Moving forward I'll be the Chief Architect to focus on building tech that outpaces adversaries.
I LOVE this dude and I could not be more excited to have him onboard
35
20
304
Someone in Namecheap already using the Metasploit module to exploit the F5 Big-IP CVE-2020-5902 RCE vuln.
This module was merged to master in Metasploit GitHub...... four hours ago
10
123
294
3) (NEXT) All Ukrainian/NATO IPs and emails registered to GreyNoise MOVING FORWARD will receive free GreyNoise Enterprise products with explicit and indefinite opt-out of any and all marketing/upsell communications. This will take us time to implement but we're working on it now.
4
19
292
If you sign malware with a fake self-signed Microsoft certificate, several major AV's on VirusTotal will ignore it
@dez_
@mattifestation
.
@kaspersky
@arcabit
@Malwarebytes
@TrendMicro
@Webroot
@zonealarm
WHAT ARE YOU GUYS DOING????????????????
9
26
88
10
286
290
"I was browsing Linkedin and I found your profi-" browsing linkedin????? BROWSING IT?????
26
11
291
I understand that cyber products are the last thing on Ukrainian's minds at the moment. This is simply what we have to offer. Defenders in Ukraine, please reach out to
@SupriyaMaz
or
@nathanqthai
if there is anything we can do to help.
1
15
281
Back for a sec. Ever wondered whether people are actually scanning for stuff on the Internet or not? Why, from where, how often? Here's one component of what I've been building for the past few months + API docs. It's live. Go ahead and play with the data.
8
105
275
Compress a directory and transfer the .tar.gz to another host securely over SSH without creating a temp file or taking up any disk space on the client machine (useful for when you have zero free space on the client)
$ tar xzcf - whatever/ | ssh user
@host
'cat > whatever.tar.gz'
8
72
269
me and the homies after I get vaccinated tomorrow
16
21
270
I don't report software crashes cuz I'm no snitch 😤💯
5
33
265
Cleaning out my office and i found this note i wrote to myself and kept next to my keyboard the first few months I started GreyNoise in 2017
10
22
261
Reid’s blog post on what sucks about SOC2 is the hardest thing i’ve read in a while
12
53
261
I'm so fucking proud of the entire team @ GreyNoise today. Absolute titans. If you ever see
@_mattata
,
@nathanqthai
,
@SupriyaMaz
,
@4b4c41
in the wild, please just give them a high five from me.
I'm exhausted. Back at it later. Keep the DMs coming.
5
13
265
This has not stopped. We're up to 3.5M IPs in GN over the last 24 hours, roughly 1,800% higher than our previous all time high.
The mysterious blast of scan traffic continues.
Well, GreyNoise just broke one million IPs blasting the Internet with this traffic in one day. That's like..... 300% higher than our previous record of total IPs in a 24 hour period.
7
31
134
21
136
257
A few minutes ago, GreyNoise just kicked off our two week mandatory PTO. We'll all be out of office until July 19th.
If anyone needs anything, you're just going to have to wait✌🏼
8
11
263
I fear we may have accidentally invented an Nday factory
22
29
259
came to twitter to tweet about the best meeting i've ever been to and saw this
I am in the worst meeting I have ever had the misfortune of being invited to.
11
1
108
7
6
251
AWS outage took our data pipeline to a grinding halt. If this is a system failure then then it's a bad one. If this is an attack then it's a great one.
8
32
245
@FigTheDevil
this was a very silly joke, I've mained linux for most of my computering life and it's better today than ever before. easily favorite OS. mostly joking that it can solve mind-bending networking/software scnarios with ease but I have to hit the forums to get my webcam to work
2
3
245
Someone is crawling the internet for SSH private keys, git configs, and .env files masquerading as legitimate security company Censys (
@censysio
) using their user agent but coming from a network that they usually do not originate from.
5
91
245
The Azure "OHMIGOD" vulnerability (CVE-2021-38647) is increasing a good bit. ~10 IPs opportunistically exploiting the vuln across the internet this morning, ~80 now. Tags available to all GN users and customers now.
GNQL:
cve:CVE-2021-38647
4
89
235
I'm not doing Blackhat and Defcon this year. I've watched a half a dozen fully vaccinated people get the delta variant in the past month. Plus i still don't remember how to make eye contact. Hopeful for next year.
10
12
233
This changes everything
You NEED multi colorized brackets in your IDE, it will change your life!
304
2K
10K
12
60
231
Here's the latest version of the GreyNoise Core Principles. They've got a ways to go, but they're coming along.
24
26
223
greynoise offsite party at supriya’s, the team gave me laser etchings of some of my insane tweets. i love these people with all my heart.
20
8
226
Konstantin fucked around and emailed a canary to someone who phished him as me and got his location lmao
11
35
223
I'm completely floored at how incredible/elegant
@Tailscale
is as a modern network/security solution. I was running in 15 minutes and I can already ditch much of my home-rolled VPN/routing/DNS/firewall setup. This is some of the coolest network tech I've seen in a long time.
12
26
220
how many of you nerds came up in forums and IRC? this is a safe space for former skids
67
3
217
Here's a low quality gif of me running tcpdump on a live host I just bought with 2,000 routable IP addresses pointing to it. Every one of these lines is an unsolicited SYN packet hitting it on its perimeter. About 200 packets per second. Anyways, blah blah blah Use GreyNoise.
8
30
206
I will truly never understand why people build these insane elegant GreyNoise scrapers with proxy rotations to scrape the data from our website when we literally give free access to any researcher that emails us for non-commercial use
15
18
209