11–20 of 84 posts
Any journalists out there, this is how it's done.
Very well written article - it does a terrific job of explaining things like rainbow tables for a non-technical (or at least, technically-but-not-security-minded) audience. The only part that seems off is the theme that /all/ of the exploited vulnerabilities were necessary to render HBGary vulnerable: "Even with the flawed usage of MD5, HBGary could have been safe..." They homebrewed their own password system. Can so…
They homebrewed their own password system. the story says hbgary hired an outside company to make this cms for them, which may explain the crappy security on that particular system. Can someone switch on the tptacek bat-signal? thomas' security company also got hacked a couple years ago and had sensitive information plastered all over a mailing list. rumor was that it happened via their use of wordpress for their web…
Doesn't that make them look even more amateurish and incompetent? They chose an insecure content management system and, most importantly, they didn't isolate it enough. So penetrating that resulted in a complete penetration of their site.
If they were selling hand-made baskets, nobody would blame them, but they sell "security" and charge big bucks for it, so they deserve the ridicule.
It is an interesting perspective I guess on selling "security", both as a service and a product. One can charge lots of money, but unless there is a serious attack and penetration, it is hard to know what the quality of they security product is. Of course once the penetration happened, there is at best pity and at worst ridicule and blame.
Very well written article - it does a terrific job of explaining things like rainbow tables for a non-technical (or at least, technically-but-not-security-minded) audience. The only part that seems off is the theme that /all/ of the exploited vulnerabilities were necessary to render HBGary vulnerable: "Even with the flawed usage of MD5, HBGary could have been safe..." They homebrewed their own password system. Can so…
They homebrewed their own password system. the story says hbgary hired an outside company to make this cms for them, which may explain the crappy security on that particular system. Can someone switch on the tptacek bat-signal? thomas' security company also got hacked a couple years ago and had sensitive information plastered all over a mailing list. rumor was that it happened via their use of wordpress for their web…
Security through obscurity doesn't work.
As soon as someone who knows what they're doing comes along, you're in trouble.
Wow. Did they do anything right? I can understand a typical organization making most of these mistakes, but a security firm?
This might be a "cobbler's kids shoes" issue, or just a general failure of people and process.
One of the only truisms I've found so far when dealing with breaches is that almost no one gets this right proactively. You almost have to be the victim of a breach (the more public the better) to actually rethink how your people/processes are implemented.
This seems true for the largest banks in the world, and the smallest security firms.
And it's easy to look back in hindsight and say "how could they have possibly had things set up that way?", but the truth is that this was not an opportunistic attack; if these vulnerabilities weren't present, then they'd have looked for others.
That's the problem with securing your environment, you have to get everything right, and the attacker only has to get one thing right. That being said, as with most "disasters", this was a series of cascading failures (like most airplane crashes, or oil rig explosions).
Hopefully they'll learn from this (assuming the negative fallout doesn't completely bankrupt the company).
This really makes the case for much more public-key cryptography everywhere -- if all of the emails between HBGary, even internally only, were encrypted, HBGary would have gotten out with just a small DDOS and been meandering along just fine today. I think that people that run a computer security company should at least be able to figure out Enigmail.
Earlier quoted context omitted.
They homebrewed their own password system. the story says hbgary hired an outside company to make this cms for them, which may explain the crappy security on that particular system. Can someone switch on the tptacek bat-signal? thomas' security company also got hacked a couple years ago and had sensitive information plastered all over a mailing list. rumor was that it happened via their use of wordpress for their web…
To me this reads a clear message: Security through obscurity doesn't work. As soon as someone who knows what they're doing comes along, you're in trouble.
Security through obscurity isn't a replacement for other strategies. That doesn't mean that it's useless; just that if people are relying solely on it, then you can pretty much bet that they're screwed.
Very well written article - it does a terrific job of explaining things like rainbow tables for a non-technical (or at least, technically-but-not-security-minded) audience. The only part that seems off is the theme that /all/ of the exploited vulnerabilities were necessary to render HBGary vulnerable: "Even with the flawed usage of MD5, HBGary could have been safe..." They homebrewed their own password system. Can so…
They homebrewed their own password system. the story says hbgary hired an outside company to make this cms for them, which may explain the crappy security on that particular system. Can someone switch on the tptacek bat-signal? thomas' security company also got hacked a couple years ago and had sensitive information plastered all over a mailing list. rumor was that it happened via their use of wordpress for their web…
This really makes the case for much more public-key cryptography everywhere -- if all of the emails between HBGary, even internally only, were encrypted, HBGary would have gotten out with just a small DDOS and been meandering along just fine today. I think that people that run a computer security company should at least be able to figure out Enigmail.
not sure how e-mail encryption would have helped... ? They SQL injected and got the DB, obtained the passwords and then proceeded further (social engineering: FW policy change, ssh password through e-mail, etc.)
This really makes the case for much more public-key cryptography everywhere -- if all of the emails between HBGary, even internally only, were encrypted, HBGary would have gotten out with just a small DDOS and been meandering along just fine today. I think that people that run a computer security company should at least be able to figure out Enigmail.
not sure how e-mail encryption would have helped... ? They SQL injected and got the DB, obtained the passwords and then proceeded further (social engineering: FW policy change, ssh password through e-mail, etc.)
Also, a common policy of encrypting and signing emails would have stopped the social engineering attack completely, as the sysadmin would've known not to accept an unsigned request to give out passwords.
Kind of mind boggling that people don't do this generally already.