Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NASA Has Been Hacked

forbes.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: NASA Has Been Hacked

#81

Post by olliej »

txcwpalpha wrote: post #35
olliej wrote: post #22

IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. Assume that the physical networks are compromised, and have all privileged resources only accept connections over VPN. Is it perfect? No, but it makes further compromise harder. The assumption of no trust also means acknowledging that you need gate incomi…

> IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. I can assure you that many, many security people (I would say all security people, but I have no doubt that there's some laggards working under the radar somewhere) already think like this. This is all part of a multi-layer security strategy, and having…

Then you need to either mandate updating, or isolate those machines.

Re: NASA Has Been Hacked

#83

Post by Theodores »

eggy wrote: post #79

I remember back in the late 80s telnetting out of the NYU Bobst library on their VAX 11(?) system to some pretty interesting systems. The Johnson Space Center in Houston (running VAX 11/785s was one I particularly remember. Of course, back then things were not battened down as much as they are now; the spirit was an open network. A sysadmin would interrupt your session with quesitons like "Who is this? You are unauth…

I used to love roving around VAX networks. In the UK the ones for science (and defence research) were all setup the same. They didn't design the login scripts for pests like me. So I was able to go round the different boxes looking for interesting datasets. I only wanted super hi resolution satellite imagery, convinced there was some sub-metre resolution stuff out there.

All was going well until I put my own backdoors in to speed up my remote logins. Accidentally I denied access to everyone but me to a MOD computer. I had to admit to that one! Luckily my boss handled it and was practically pleased with his student hire. But yes, I can actually claim to have hacked military computers. I doubt my boss has forgotten that day, the day when the men from the ministry arrived.

Happy times, VAX computers were cool and hacking them with genuine VT DEC terminals on those fairly open networks was living the lifestyle.

Re: NASA Has Been Hacked

#84

Post by bumby »

tetha wrote: post #18

Reading the audit, this kind of confirms my base question when building infrastructure: If people don't do the right thing the business needs, why is it too hard to do? Can't we reduce the pain to do the right thing so doing the lazy / wrong thing is harder? People not doing thing tends to be an indication of boundaries and responsibilities being drawn in bad ways. Something like the log reviews are a classical thing…

One problem is workforce allocation. The argument above is based on the assumption of segregated duties. Some antiquated organizations may have the "sys admin" that is also the "security guy", as well as the backup "software developer", "software QA" etc. because the organization's priorities are elsewhere.

Re: NASA Has Been Hacked

#85

Post by olliej »

unethical_ban wrote: post #43
olliej wrote: post #22

IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. Assume that the physical networks are compromised, and have all privileged resources only accept connections over VPN. Is it perfect? No, but it makes further compromise harder. The assumption of no trust also means acknowledging that you need gate incomi…

Making every device connect over VPN is infeasible. There are, however, varying models of governing port-level access exist. dot1x, ISE, and yes, on some networks forcing VPN is doable.

Correct, but not every device needs access to privileged resources.

I know at least Google and Apple gate almost all internal resources on VPN connection and per machine authentication. This is over 10s of thousands of machines and users.

It also makes attempts to use "unauthorized" devices with your privileged resources harder/impossible.

But more importantly: if you are allowing out of date machines on your network you are by design choosing to allow pretty much every attack that is happening at scale these days. If you are allowing out of date machines to access privileged resources you're rapidly heading to game over from a security PoV.

Re: NASA Has Been Hacked

#86

Post by [deleted] »

SamuelAdams wrote: post #14

I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators respon…

[deleted]

Re: NASA Has Been Hacked

#87

Post by sp332 »

JudgeWapner wrote: post #80
giarc wrote: post #10

Earlier quoted context omitted.

I was going to screenshot that page. A small auto play video in bottom left corner, a top bar pop up to get the "latest updates from Forbes", an email sign up for the Forbes Daily Dozen and in the background, blurred out is the article.

I envision a distributed system that simply renders pages, clicks "agree" or whatever, and uploads just the content to "archive" servers automatically. After a critical mass is reached, then instead of going to the URL, you plug the URL into archive server to see if it already has a copy and render that version. From there, you could go even further and daily download 100mb or so of pre-sanitized internet from the mo…

If you have Firefox, Edge, or Safari, you can use Readability Mode to strip just the article text and read it.

For something more complex like what you described, check out Brave. It blocks ads from tracking ad networks and either replaces them with non-tracking ads or lets you pay the site author directly.

Re: NASA Has Been Hacked

#89

Post by txcwpalpha »

olliej wrote: post #81
txcwpalpha wrote: post #35

Earlier quoted context omitted.

> IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. I can assure you that many, many security people (I would say all security people, but I have no doubt that there's some laggards working under the radar somewhere) already think like this. This is all part of a multi-layer security strategy, and having…

Then you need to either mandate updating, or isolate those machines.

> mandate updating

hahahahahahahahaahaha

> isolate those machines

that's exactly what is done, but you just said that security people need to stop thinking in those terms, so...?

Re: NASA Has Been Hacked

#90

Post by packet_nerd »

bennofs wrote: post #72
packet_nerd wrote: post #59

Earlier quoted context omitted.

Meanwhile DNS, which is a precursor to almost every connection ever, is rarely encrypted or authenticated in practice. Standards like DNSSEC and DNS over TLS exist but seem to have lots of vocal opposition without any serious proposals for improvement. A Microsoft certificate training I took recently literally put emphasis on randomizing source port numbers as a way to mitigate attacks.... let that sink in.

What does encrypted/authenticated DNS gain you? If the application protocol is encrypted and authenticated like https then faking DNS responses just results in a connection that is closed immediately because authentication fails. Encrypting is also useless unless you use a proxy/VPN because otherwise the connection target leaks via the IP header anyway when you open the connection.

> What does encrypted/authenticated DNS gain you?

Many things, here's three to start:

* A measure of privacy - instead of every rando with ability to sniff packets (activities you have no way to ever know about, available to many parties along the path) only the DNS server (which you choose, presumably trust, and can change) knows what names you resolve.

* Stronger foundation for TLS - LetsEncrypt and other public certificate authorities depend on DNS to issue certificates. If an attacker controls DNS, they could easily generate certificates for any site they wanted to attack.

* There have been many shady incidents with certificate authorities. I just feel that beefing up some of the other layers in the stack is a good idea.

> faking DNS responses just results in a connection that is closed immediately

On the web it's often not closed immediately, the users often get a certificate warning that they may be conditioned to click through. Of course HSTS helps with that, but still... why the hostility to securing the name resolution layer?

Post reply on HN