91–100 of 122 posts
Earlier quoted context omitted.
And it sounds like Citrix didn't even notice, it was the FBI who noticed then alerted Citrix.
So, while the FBI was hacking they found another hacker?
Security is hard. On the upside, every breach is a chance to learn for everyone else. I hope they release more details on how it happened. Is there any blog or news that summarizes such post-mortem lessons? Could be a nice project to collect that.
Earlier quoted context omitted.
Thats the belief but was it truly ever confirmed? I dont doubt it it sounds like a meme worthy of belief and I lean towards it but I dont recall ever finding a confirmation. Also saying they were caught implies the law caught them and arrested them.
As far as I know Stuxnet didn't break any US/Isreal laws. Of course it broke Iranian laws, though. I think Obama said "no comment" to reporters, but then basically admits it by talking about how he regrets that this information got out into the public.
Has anyone gotten that kind of call from the FBI and can shed light on how the process works? Would be fascinating for a outsider and provide a guide on what next steps look like for those poor souls that receive the call in the future.
I've been on this call (both sides of it) probably a dozen times by now. Gov agencies are decent at doing research so it's pretty unlikely that the FBI just called their 1800 number or whatever. Most small start ups don't get to the level where anyone that "big" is looking at them but in the event that something does get flagged the agency will go find their CEO/CTO/counsel on LinkedIn and either message them there o…
Earlier quoted context omitted.
For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow. So even if it's someone with valid access, it would be investigated immediately.
Which tools do you use? I have been looking for something that does this.
Earlier quoted context omitted.
Haven't read the article, don't know anything about their network. Assuming they use a Windows domain for their corp infrastructure. Lower level Windows authentication mechanisms can't be configured for 2FA. If your active directory domain is functional at all then at the very least your systems need to be able to talk via SMB and ldap to a domain controller. With sufficient privileges you're able to execute code on…
Not sure what you meant by lower level mechanisms, but you can protect console logins and RDP with 2FA: https://duo.com/docs/rdp https://help.duo.com/s/article/1084?language=en_US
Just think of any backend protocol that the system uses. The vast majority of those can't be 2FA'ed. This is not Windows specific either. The same is true for most all protocols.
This is why most companies buy firewalls and VPNs and only 2FA the VPN. That meets most compliance requirements and is simple to do. Is it secure? Probably not, but it checks the box (makes audit happy), so buy compromise insurance and move on.
I fully assume there are more hacks we don’t hear about that ones we do. Not only because of cover ups but it can’t be that hard to cover your tracks if you know what you are doing.
Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?
Hiding on a box is easy. Hiding on the wire is hard.
Earlier quoted context omitted.
Not sure what you meant by lower level mechanisms, but you can protect console logins and RDP with 2FA: https://duo.com/docs/rdp https://help.duo.com/s/article/1084?language=en_US
net commands, kerberos tickets, etc. You can really only 2FA web interfaces, VPNs, RDP and interactive console logons. You can 2FA LDAP, but it's a real pain to do so (I've seen it done). Just think of any backend protocol that the system uses. The vast majority of those can't be 2FA'ed. This is not Windows specific either. The same is true for most all protocols. This is why most companies buy firewalls and VPNs and…
Earlier quoted context omitted.
They never caught the stuxnet attacks. They caught the malware that was spreading far outside of its target. Not quite the same thing.
So you're saying they caught the attackers using one of the most sophisticated pieces of malware ever created. Good, we agree.
Earlier quoted context omitted.
That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access". I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the va…
I don’t think the grandparent says that everyone is owned, but that if your data is interesting enough, your threat model must include employees that are willingly exhilarating data, sometimes for nation states. That your first barriers are therefore assumed to be breached to those attackers. This of course does not apply if you are not holding on to anything interesting, but it’s very easy to become interesting at a…
Recall that the Target POS hack back in 2014 happened because someone hacked the largest refrigeration contractor in western Pennsylvania, then bounced from there onto the Target Partners Online portal with legitimate credentials, and then from there in unspecified ways got onto the POS system. Obviously going from TPO to POS is a failure of Target's network security, but their network perimeter was much larger than just Target computers.