Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FireEye Shares Details of Recent Cyber Attack

fireeye.com

Post reply on HN
Print view View original

111–120 of 251 posts

Re: FireEye Shares Details of Recent Cyber Attack

#111

Post by marcinzm »

Ansil849 wrote: post #90

> Consistent with a nation-state cyber-espionage effort, the attacker primarily sought information related to certain government customers. If this was the primary objective of the attackers, why is it buried in the seventh paragraph of FireEye's blogpost, after a lengthy discussion of the attackers targeting -- though apparently not primarily targeting -- FireEye's internal tooling?

Because the tooling getting out impacts everyone and thus warrants a public post. Some government information being stolen only impact those customers and only warrants notifying those customers.

Re: FireEye Shares Details of Recent Cyber Attack

#112

Post by lupire »

arafsheikh wrote: post #85

From their official blog post: > Based on my 25 years in cyber security and responding to incidents, I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities. I wonder what nations possess “top-tier offensive capabilities” today. USA, China, Russia, Israel come to mind. Who else? Is there a list or metric to measure a nation’s cyber attack capabilities?

Why would ant victim conclude anything else? You can't prove them wrong and this is what anyone trying to CYA would say.

Re: FireEye Shares Details of Recent Cyber Attack

#113

Post by Ansil849 »

marcinzm wrote: post #111
Ansil849 wrote: post #90

> Consistent with a nation-state cyber-espionage effort, the attacker primarily sought information related to certain government customers. If this was the primary objective of the attackers, why is it buried in the seventh paragraph of FireEye's blogpost, after a lengthy discussion of the attackers targeting -- though apparently not primarily targeting -- FireEye's internal tooling?

Because the tooling getting out impacts everyone and thus warrants a public post. Some government information being stolen only impact those customers and only warrants notifying those customers.

Information pertaining to government customers invariably impacts civilians under that governance (and potentially civilians outside of it).

Re: FireEye Shares Details of Recent Cyber Attack

#114

Post by think814 »

lupire wrote: post #109
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

> Matthew in accounting that will open that invoice attachment so he can pay it. Matthew in accounting shouldn't have permission to run an untrusted binary.

presumably he opened a pdf with a zero-day from an untrusted source

Re: FireEye Shares Details of Recent Cyber Attack

#115

Post by mike_d »

pabs3 wrote: post #106
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

Whats your opinion of open source tools and distributions of them (like Kali) in this space and the tradeoff between open sourcing your red team tools vs reimplementing tools that are already out there.

A vulnerability that is secret is the biggest threat to security. Publishing tools makes them public knowledge that can be defended against.

If you are doing penetration testing and basic security work, there is no value in having private tools. It becomes important in red team work because you are trying to emulate a real attacker that has access to non-public tools.

Re: FireEye Shares Details of Recent Cyber Attack

#116

Post by Wowfunhappy »

mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

Does Matthew in accounting need access to the same network as the engineering staff?

Re: FireEye Shares Details of Recent Cyber Attack

#117

Post by ramraj07 »

lupire wrote: post #109
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

> Matthew in accounting that will open that invoice attachment so he can pay it. Matthew in accounting shouldn't have permission to run an untrusted binary.

Matthew in accounting should be given an ipad pro instead of a laptop or pc, with a glued in lightning cable that can only do power.

^ This is the solution I have been mulling if and when I am responsible for an org where security is kinda important. Sure, iOS is still hackable, but hopefully we put more hindrance steps between the attacker and the org, and move the exposure more to the cloud services (like box). Curious if this is feasible.

Re: FireEye Shares Details of Recent Cyber Attack

#118

Post by arafsheikh »

est31 wrote: post #107
arafsheikh wrote: post #102

Earlier quoted context omitted.

If I understand your comment correctly - even though the fingerprints are published, the attacker can still reverse eng the implementation from the tools and bypass antivirus systems at least in the near future?

Also fingerprints will only stop the lowest level of attackers. You can easily change binaries in a way the fingerprint is changed but the functionality remains the same. Reorder functions, add some garbage data, etc.

That makes sense. So given that the attacker is technically sophisticated in this case, what are the tangible benefits of publishing the fingerprints?

I guess one benefit might be to push the development of new detection techniques to detect the underlying implementation of these tools.

Re: FireEye Shares Details of Recent Cyber Attack

#119

Post by DiffEq »

lupire wrote: post #109
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

> Matthew in accounting that will open that invoice attachment so he can pay it. Matthew in accounting shouldn't have permission to run an untrusted binary.

...and a binary at all should not be able to be downloaded from the internet or pass through and email server. Additionally the only binary files running on any system should be known binaries. Least Privileged systems with tight change control don’t get hacked.

Re: FireEye Shares Details of Recent Cyber Attack

#120

Post by BiosElement »

rndgermandude wrote: post #101
BiosElement wrote: post #89

Earlier quoted context omitted.

Interest != Used or Stolen Client Data.

"no evidence" != "didn't happen", either, tho, especially if the attackers really were that capable as they claim,

That's entirely true. I'm not qualified to judge that, just that the statements didn't necessarily conflict like they might on first glance.
Post reply on HN