Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Customs Database Of Traveler Photos Was Hacked And Stolen

buzzfeednews.com

Post reply on HN
Print view View original

171–180 of 207 posts

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#171

Post by munchbunny »

Thorrez wrote: post #153
munchbunny wrote: post #131

Earlier quoted context omitted.

I wouldn't frame it as decentralization, more like compartmentalization. You harden your systems to prevent horizontal movement between services. For example, you could try to put payment credentials in a separate subnet where they are never read out of that enclave. Access to that subnet might require separate authentication credentials that most employees don't have, and API calls might require the calling server t…

It sounds like CBP might have done that. What was stolen: > The compromised photos were taken of travelers in vehicles coming in and out of the US through specific lanes at a single Port of Entry over a one and a half months period. What wasn't stolen: >No other identifying information was included with the photos and no passport or other travel document photos were compromised, the official said. Images of airline p…

> On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network

Sounds like CBP's issue was less about compartmentalizing, more about controlling for how the subcontractor accessed the data.

Honestly the problem sounds more like something borne from ignorance than malice. It's a headache having to download every image you have to analyze, so why not copy the whole thing to a local network drive and work with it here? And then some hacker lifted it from the local network drive.

Anyway I wasn't talking about the CBP specifically. I was responding to the question about why decentralization saves you from compromise. My response was that compartmentalization is useful for damage control.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#172

Post by taneq »

sokoloff wrote: post #169
taneq wrote: post #159

Earlier quoted context omitted.

And this is the same group that can force you to give them your social media credentials on entry. Terrific. Edit: Wait, just social media handles/account names, not login details. That's less ridiculous. My mistake.

Credentials or just account names?

I thought it was the former but checking again it looks like I misread and it was only the latter. That's still pretty rude but nowhere near as bonkers as I thought it was.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#173

Post by enraged_camel »

01100011 wrote: post #166
MrMorden wrote: post #102

Earlier quoted context omitted.

Compliance with NIST SP 800-53 is mandatory per statute and DHS policy. That system has an identified ISSO, ISSM, ISSPM, DAO, and AO who are responsible for authority to operate being given. If the paperwork is in place, a government employee signed off on that network's operation. If not, it doesn't have ATO and there's a government employee (the AO or CIO) responsible for allowing a such a network to be connected t…

I worked at a government contractor who was rolling out NIST compliance. Everyone, from IT to engineers, hated it. You can rest assured that as soon as someone isn't looking, they're going to violate it.

I have never come across a compliance policy that people didn't hate.

Compliance, almost by definition, needs to make people's job harder, or create extra work. Because people are lazy, and they tend to go for the path of least resistance, and those are not good things in the context of safety and security.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#174

Post by munchbunny »

anigbrowl wrote: post #96
projectileboy wrote: post #86

I’ll just keep saying this, and getting dismissed by everyone I know - any data security discussion around a centralized data store that doesn’t begin with the recognition that that data store will be compromised, is a discussion that is just a joke.

You and a whole bunch of other people making the same extremely basic observation. It would be good if you would suggest some alternative strategies, since 'don't bother keeping that data' isn't a realistic option in this context.

Part of my job is designing software that is resistant to amplification once the hacker is already in, so maybe I can help here.

When you plan your security, step 1 is making it hard to get in, step 2 is making it hard to persist, i.e. plant a command and control process somewhere inside the perimeter, and to move laterally in the system, i.e. get from one service into a more important service.

There's some basic stuff, such as firewall rules that prevent outbound traffic from ports/processes you aren't expecting. That makes it harder for the hacker's command and control systems to get instructions. There's other stuff like using separate credentials for low sensitivity vs high sensitivity systems, two-stage approval processes for especially sensitive operations to prevent a single compromised user from being able to get to the good stuff, automatic password rotation so that exfiltrated tokens aren't valuable, and more.

Those are just single things though. I think the more interesting part is an exercise like this: assume that the hackers have compromised a developer's computer. In that case, what does a system look like that would prevent that developer from exfiltrating payment info? I would argue that the developer doesn't normally need access to real payment info, so maybe the network should be configured so that the developer is unable to SSH into that set of database servers without first requesting a special short-lived SSH keypair. That at least means the developer has to explicitly ask for access. That doesn't make the hacker's job impossible, it just makes it harder. Also makes things less convenient for the developer, so is it worth the trade-off? For especially sensitive data, it probably is. With this setup, maybe the hacker gets to the account information, but they're stopped short of account numbers long enough to notice the breach.

This is all on the theoretical side, but that's the thought exercise once you go "let's pretend someone compromised ____ system."

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#175

Post by diveanon »

axaxs wrote: post #9

> On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network > CBP ... is closely monitoring all CBP work by the subcontractor What. In the private sector, they'd have been fired and probably legal action levelled against them. Th…

Equifax is in the private sector.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#176

Post by asveikau »

axaxs wrote: post #9

> On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network > CBP ... is closely monitoring all CBP work by the subcontractor What. In the private sector, they'd have been fired and probably legal action levelled against them. Th…

If this is a subcontractor, it is the private sector.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#177

Post by sjy »

txcwpalpha wrote: post #83
munk-a wrote: post #76

Earlier quoted context omitted.

This has come up a number of times and I semi-agree with you. It's definitely true that C-level positions do take a special kind of problem solving to navigate with a high emphasis on time management skills that other people (even upper management) can usually delegate up... That said, the only thing restricting new entrants into that market is the resistance of that market. The skills it takes to be a CEO of a multi…

I'm not sure I agree with your first paragraph. I mean no disrespect to you or your abilities, but being a C-level executive, especially in a large corporation, isn't something that someone can just "train up to". These types of positions really do require a specific personality, specific desires, often a specific ethic (work ethic and otherwise), specific connections, and more. These are the things, along with the f…

> I mean no disrespect to you or your abilities, but being a C-level executive, especially in a large corporation, isn't something that someone can just "train up to".

My hunch is that this is no more true of C-levels than it is of any other profession where some natural aptitude (eg. above average intelligence) is required. In other words, I think the "pool" of C-levels is small almost solely because of organisational hierarchy; for every C-level there are many more people with the required natural aptitude who are not C-levels. Of course, for a sufficiently narrow domain, the intersection of people with the required natural aptitude and people with the required years of domain experience may become very small.

In that sense, I think being a C-level is something that many people can just "train up to," if given the right opportunities. I'm not sure if there is any empirical evidence that could tell us who's right.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#178

Post by joe_the_user »

paul7986 wrote: post #164
all_blue_chucks wrote: post #163

Earlier quoted context omitted.

> How many customers did Experian lose? Experian didn't lose any customer data, though. They only lost data on their products. Their actual customers had no reason to stop paying for their services.

It was Equifax not Experian.

It think it's telling that, in this instance, it really doesn't matter. It could have been Experian, with the wave of a butterfly's wings in Himalayas, it was Experian and nothing changes in that alternative universe.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#179

Post by CGamesPlay »

munchbunny wrote: post #174
anigbrowl wrote: post #96

Earlier quoted context omitted.

You and a whole bunch of other people making the same extremely basic observation. It would be good if you would suggest some alternative strategies, since 'don't bother keeping that data' isn't a realistic option in this context.

Part of my job is designing software that is resistant to amplification once the hacker is already in, so maybe I can help here. When you plan your security, step 1 is making it hard to get in, step 2 is making it hard to persist, i.e. plant a command and control process somewhere inside the perimeter, and to move laterally in the system, i.e. get from one service into a more important service. There's some basic stu…

One of my favorite Hacktober tricks was putting an alias around SSH on the developers machine, so the next time they used 2FA to get into a remote host I would drop a note into their MOTD (to prove persistence). That short-lived SSH token would be enough to install persistence.

So obviously, your payment hosts should be very wary of things like port forwarding over SSH, and any unknown outbound traffic.

Post reply on HN