41–50 of 122 posts
Earlier quoted context omitted.
They never caught the stuxnet attacks. They caught the malware that was spreading far outside of its target. Not quite the same thing.
So you're saying they caught the attackers using one of the most sophisticated pieces of malware ever created. Good, we agree.
Earlier quoted context omitted.
I do not believe that spearphishing would not be prevented by a hardware token. The device would be responsible for authenticating the identity of the service being accessed. If the user can be fooled into handing over their hardware token, I do not see it far fetched that they will not be influenced to not hand over their 2FA token. Again, if a hardware 2FA token can deal with key-loggers, so can a password token. W…
You're almost there, keep going a little farther, and you'll have eliminated passwords and invented FIDO. https://fidoalliance.org
Earlier quoted context omitted.
So you're saying they caught the attackers using one of the most sophisticated pieces of malware ever created. Good, we agree.
They caught the malware not the attackers. Otherwise we would be talking about the authors.
Earlier quoted context omitted.
Ha. Perfect. That is exactly what I was imagining. Apologies for the long conversation. Do you have any idea why this is not popular? Is it too hard to implement or is it just that business's do not see security as something to invest a lot in?
Most major SaaS apps support it, the major hardware provider I see recommended is yubikey although Google makes one as well. See also U2f. It's super easy to implement, try it out for yourself in Flask. https://www.yubico.com/solutions/fido-u2f/ https://cloud.google.com/titan-security-key/ https://github.com/herrjemand/flask-fido-u2f
https://webauthn.guide/ for an intro
https://www.w3.org/TR/webauthn/ for the JS API
Having worked with Citrix, I'm shocked. Shocked that they detected it at all...
I was going to say the same thing, but it sounds like it was the FBI that noticed it: > [T]he hackers had “intermittent access” to its internal network from October 13, 2018 until March 8, 2019, two days after the FBI alerted the company to the breach.
Earlier quoted context omitted.
They caught the malware not the attackers. Otherwise we would be talking about the authors.
I thought it was pretty well-established that Stuxnet was created/authored by TAO within the NSA.
If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.
That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access". I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the va…
This of course does not apply if you are not holding on to anything interesting, but it’s very easy to become interesting at a certain size, or if you have interesting customers. Still, not everybody.
If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.
That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access". I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the va…
If your internal services are built to public-facing standards it’s a shrug.