51–59 of 59 posts
In a geographical note, if you can get a chance to work/contract in Denmark, absolutely do so! I have been working in Copenhagen in 2014-2015 and I only have great memories of the country and the capital.
Earlier quoted context omitted.
I'm guessing you know what a password hash is and roughly how password hashing works? Microsoft's systems don't like to send your plaintext password over the network. Rather than either get rid of passwords or at least secure that so it isn't a problem any more, they do the hashing on your machine and send the hash to wherever it needs to be authenticated. This behaviour enables Pass-the-hash. Since we can authentica…
Linux isn't vulnerable by default, because it's missing features by default. It has no equivalent of Active Directory, and doesn't use Kerberos or anything like it by default. However, it can , at which point you're back to the same problem. The vulnerability is with the protocol, not the operating system. Modern versions of Active Directory enable strong protections for Kerberos that almost entirely stops the majori…
Could you tell more why do you think so?
For what I remember, Linux in this regard is exactly the same as Windows: you have to install and configure Samba 4 or FreeIPA in order to get a kerberized domain; you also have to join the clients into domain exactly the same way you would join windows clients.
In Windows, your servers out of the box won't run the necessary services, you have to install the AD DS server role. You have to join the clients into domain.
So there's nothing like AD or Kerberos on Windows by default either.
Some examples: Thanks to corona, tons of people started using usb headphones. The bloody thing needs local admin for almost weekly firmware updates. No idea why, but if you dont do them, a windows update for the driver will break them soon.
VPN! If you dare to log on with alternate credentials, it ends your connection. Hence any admin on a remote machine can only happen by a local admin.
Banking software pushes an update and immediately refuses to do any payment until you upgrade. The (nice) people who should package that upgrade are swamped and need months, at least if you manage to get a budget to let them package it. After that, an infosec review might take more weeks.
Printer drivers. No admin? No printing! Bonus points if vendor decides to publish the driver in the app store, which is blocked by group policy for everyone including admins.
ctr alt del needs local admin to kill a task.
As a bonus, infosec is the biggest hurdle: If they take weeks to approve any kind of admin access,and keep asling bureaucratic questions, only big problems that burn for weeks are worth solving. We have expensive software being unused because no one wants to do the battle to get access to fix it. I would love to drop some privileges, if only I trust I could claim them back when shit hits the fan.
In a geographical note, if you can get a chance to work/contract in Denmark, absolutely do so! I have been working in Copenhagen in 2014-2015 and I only have great memories of the country and the capital.
What about the language? I've heard that the best way to learn Danish is to be born to Danish parents.
Earlier quoted context omitted.
I'm guessing you know what a password hash is and roughly how password hashing works? Microsoft's systems don't like to send your plaintext password over the network. Rather than either get rid of passwords or at least secure that so it isn't a problem any more, they do the hashing on your machine and send the hash to wherever it needs to be authenticated. This behaviour enables Pass-the-hash. Since we can authentica…
Linux isn't vulnerable by default, because it's missing features by default. It has no equivalent of Active Directory, and doesn't use Kerberos or anything like it by default. However, it can , at which point you're back to the same problem. The vulnerability is with the protocol, not the operating system. Modern versions of Active Directory enable strong protections for Kerberos that almost entirely stops the majori…
In fact it has been given a CVE number and fixed in obscure systems where it was done, only Windows gets to shrug and say it's hard so we won't fix it. e.g. CVE-2005-3435
In Windows every user - anywhere in the world not just within one organisation - with the same password has the same hash. Worse than a PHP app from the turn of the century their most sophisticated password hash scheme is MD4(password). This makes the mistake that results in Pass-the-hash almost irresistible.
Because a Linux system uses salted (and pessimised) hashes, it is not tempting to try to authenticate remote hashes because you're going to have to build a multi-step protocol, passing parameters to the client so it can perform the hash. You'd probably instead look at existing protocols and discover SRP (or in the modern era any sensible asymmetric PAKE). This immediately shows you a better path forwards with no Pass-the-hash.
But because Windows has this constant 16-byte hash it is tempting to use that for authentication. You can do a bit of hand waving to avoid confronting how insecure the result is:
‣ Bad guys can't possibly know this 128-bit value because it's MD4(password) and there's no way to find that without knowing password. Therefore we only need to check that the 128-bit value is correct and we've authenticated the user.
‣ Storing the 128-bit value locally is fine because it's MD4(password) and you can't reverse MD4 to get the password back so it's not a secret.
Only when you see these arguments next to each other it is obvious this is absurd. So long as they're on different pages of a document, or preferably made in entirely separate discussions at Microsoft, the mistake is unnoticed.
You've engaged in the same equivocation that Microsoft uses by adding "or Golden Ticket attacks". Microsoft documents about Pass-the-hash routinely argue that this is just the same as any other stolen credentials attack, so it's not Windows at fault nobody could be expected to do better. This is definitively wrong and we need to call them out on it.
Earlier quoted context omitted.
They don't directly translate due to the inherent differences in between the two systems. In short, pass-the-hash is a technique by which it is possible to authenticate to a windows system using the hash of a password, instead of the password itself. The NTLM hash is the secret, and does not need decrypting to authenticate. NTLM authentication over the network can be redirected to other machines if they don't have tr…
> It contains all private keys to all systems Hopefully it doesn't? That would be poor design. It typically is just on a network segment that the firewall rules allow it to access the other servers.
So, although it does not literally house all passwords/keys/whatever to your network, it has access to a system that indirectly does.
Normal jump hosts should not have your private keys I guess, but I thought it was the closest analogy.
Just put it this way: if an attacker gets on that system, it's complete game over.
Earlier quoted context omitted.
No. I made a very specific statement about the cost of attack relative to the benefit of attack for this class of attack. The cost of attack is so far from the benefit of attack that there is no meaningful defense being offered. To use an analogy, making a tank from paper provides more defense than tissue paper. That does not, however, mean that there is any meaningful defense against credible threats. To provide a t…
You're still thinking all-or-nothing, talking about "exploits" or "vulnerabilities" where finding one lets you take over the whole ystem at once. That is not how these attacks happen, that is not what happened at Maersk, and that is not what the article is about. The breach happend via compromised third-party software installed on a small number of regular workplace PCs. The big damages happened largely because slopp…
What is your evidence that better privilege management would prevent an attack funded on the order of $30M from being anything other than devastating? Given that nearly every company in the world is routinely successfully attacked, I see no justification for giving the benefit of the doubt to claims of security that are not rigorously analyzed and tested. Have you ever seen a company run a $30M pentest that did not find ways in? If your answer is that no company does a $30M pentest since that is a crazy amount to pay, that supports my point since they are only bothering to test things easier than the standard I put forward. There is no reason to trust an entity in an industry that claims they are better than can be verified. If your answer is that a $30M pentest is not indicative of anything and nobody tests that way, then please suggest a test that correlates to difficulty of attack that is at the $30M level. If the answer is no such test exists, then I fail to see why there should be any confidence at all in claims that can not even be loosely quantified or correlated against the primary problem.
I will actually claim $30M is far too high. I bet attacks of this caliber would only take ~$1M to develop and deploy against best-in-class defenses. Therefore, my extortion argument actually becomes that they engineer 30 independent attacks and can burn one or two of them to demonstrate that they can do at least $300M in damages. Even developing 30 independent attacks, the strategy is highly profitable under my assumptions.
No, the extortion market is new. There is no reason to suggest that a new greenfield market with a multi-billion dollar potential market should be instantaneously saturated. That is ridiculous. This should be especially true in light of the fact that criminals do not have access to high-growth funding models due to being criminals so are generally required to bootstrap. Just because some criminal act is not done does not mean that it can not be done. Nobody hijacked a plane and flew it into a building before 9/11, but nobody is claiming that it was not feasible beforehand or that it would not have been an efficient act of terror if done previously.
If you actually want to make a meaningful counter-argument that may be convincing, please start from $300M in damages and then back-calculate the necessary cost of attack for a criminal to find such an attack profitable. State assumptions on each step for why it influences cost or benefit in some fashion and then we can discuss if those steps seem reasonable. I already did this previously when back-calculating to $30M from $300M, so you could also discuss why you think the individual steps are invalid. Please try to include quantitative estimates or beliefs. Ranges and probabilities are fine to hedge any statements.
Earlier quoted context omitted.
That is not an unanswerable question at all. To clarify, I am literally asking for a simplified threat model. Take an existing threat model, reduce it to cost of doing those actions, done. Order of magnitude is fine. If there are parameters, pick a set of parameters within the non-totally-stupid range and state them. Estimate when reasonable. The question is just me looking for broad strokes anecdotes.
> To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week. > The question is just me looking for broad strokes anecdotes. Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts abo…
To illustrate:
How much damage could somebody do with a $100K budget in a few months to the best system you have been personally involved in?
How much damage could a well-staffed national agency do in a week to that system?
For all credible adversaries that could cause $X in damage, choose the 20th percentile cost adversary, how much would that cost?
The question is also specifically limited to systems the answerer has worked on to avoid speculation on practices or "grass is always greener" mentality. Did you work on the ISS on software or software security?
Jeff Bezos has over $100B. Therefore, I take your answer to mean:
With $100B nobody could orchestrate an cyberattack that could crash the ISS?
The cost to develop the Stuxnet attack has been estimated to be $1M according to former director of the NSA General Hayden. This is likely an underestimate only accounting for the cost of the exploit itself. Kaspersky Lab claims it cost in the regime of $100M to develop and deploy. So, lets take the high number and multiple it by 10 leaving the cost of disabling the secret air-gapped Iranian Nuclear Weapons Program at $1B. Do you think the cost of a critical attack against the ISS is 100x higher than a critical attack on the Iranian Nuclear Weapons Program?
Please avoid limiting your imagination to just direct attack on the ISS itself. There are multiple entities which when attacked would likely be able to de-orbit the ISS and kill all the astronauts. Please verify that none of these could occur for less than $100B: taking over a rocket to the ISS, taking over a rocket to LEO, active satellites in the correct orbital plane, decommissioned satellites that are no longer tracked but with enough fuel to intercept, scientist laptops that connect to the ISS network, over-drawing the laptop batteries so they blow up while in the ISS, etc. This also ignores more clever tactics you could do with $100B such as buy a company directly supplying critical needs of the ISS and then insert backdoors into the software.
I can fully recommend reading the book "Sandworm" by Andy Greenberg. It explains NotPetya and all of the sorrounding investigation.
There's also a really good Darknet Diaries podcast episode on NotPetya: https://darknetdiaries.com/episode/54/ It's a brilliant podcast - there's some very interesting stories and interviews, my favourite recent one being The Courthouse: https://darknetdiaries.com/episode/59/
I still find myself listening occasionally, so it's hard to criticize too much.