Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FireEye Shares Details of Recent Cyber Attack

fireeye.com

Post reply on HN
Print view View original

121–130 of 251 posts

Re: FireEye Shares Details of Recent Cyber Attack

#121

Post by marcinzm »

Ansil849 wrote: post #113
marcinzm wrote: post #111

Earlier quoted context omitted.

Because the tooling getting out impacts everyone and thus warrants a public post. Some government information being stolen only impact those customers and only warrants notifying those customers.

Information pertaining to government customers invariably impacts civilians under that governance (and potentially civilians outside of it).

Which would be the responsibility of the government customer to disclose to those impacted. FireEye is likely under many contracts that prohibit it from giving out any details on what client data was stolen. Without those details the information is essentially worthless to the public. Who knows if they got the pin number to the VA men's bathroom or all your social security records.

Re: FireEye Shares Details of Recent Cyber Attack

#122

Post by [deleted] »

mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

[deleted]

Re: FireEye Shares Details of Recent Cyber Attack

#123

Post by [deleted] »

arafsheikh wrote: post #85

From their official blog post: > Based on my 25 years in cyber security and responding to incidents, I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities. I wonder what nations possess “top-tier offensive capabilities” today. USA, China, Russia, Israel come to mind. Who else? Is there a list or metric to measure a nation’s cyber attack capabilities?

[deleted]

Re: FireEye Shares Details of Recent Cyber Attack

#124

Post by caeril »

mmaunder wrote: post #93

If only hacked companies were as good at defense as they claim to be at attribution.

You don't need to be good at attribution when you're on the same side as the press.

You can build a case on the flimsiest of IOCs, and anyone who questions you gets smeared as a foreign agent or cutout, without a shred of evidence. Really, quite neat.

Re: FireEye Shares Details of Recent Cyber Attack

#125

Post by kerng »

1970-01-01 wrote: post #46

"They used a novel combination of techniques not witnessed by us or our partners in the past." This is the scary part. FireEye and the others have been studying and watching APTXX nation-state teams for many years. They should have some idea by now. It is entirely possible that a new team is out there.

Yeah, details please. This is PR talk.

If it's something novel indeed, the entire industry would like to know please.

Re: FireEye Shares Details of Recent Cyber Attack

#126

Post by smithza »

mike_d wrote: post #50
forgotmypw17 wrote: post #43

Earlier quoted context omitted.

>I'm not sure anything can protect against a targeted attack from a nation-state. hardware airgap can go a long way

Airgaps protect against low to medium level attackers. Nation state tools for bypassing airgaps are a dime a dozen. One of the most common is interdiction of computers in shipping and installation of hardware implants.

Airgaps are certainly intended to protect against every skill level hacker. The ideal strategy is the multi-layered, Swiss cheese approach. A slice for RBAC (LDAP, AD, MFA, etc.); a slice for email phishing filters and user awareness training; another for network segmentation and isolation (Firewalls, proxies); another for network filters (ping DDOS attacks, etc.); and on and on. The APT attack strategy uses every tool in the arsenal and hunts for a path through the cheese layers, hopefully never finding one to the real prize behind.

Re: FireEye Shares Details of Recent Cyber Attack

#127

Post by judge2020 »

arafsheikh wrote: post #118
est31 wrote: post #107

Earlier quoted context omitted.

Also fingerprints will only stop the lowest level of attackers. You can easily change binaries in a way the fingerprint is changed but the functionality remains the same. Reorder functions, add some garbage data, etc.

That makes sense. So given that the attacker is technically sophisticated in this case, what are the tangible benefits of publishing the fingerprints? I guess one benefit might be to push the development of new detection techniques to detect the underlying implementation of these tools.

The biggest advantage is that it would allow orgs to audit all applications that have been fingerprinted within their org and see if they might have been attacked as well.

Re: FireEye Shares Details of Recent Cyber Attack

#128

Post by judge2020 »

ramraj07 wrote: post #117
lupire wrote: post #109

Earlier quoted context omitted.

> Matthew in accounting that will open that invoice attachment so he can pay it. Matthew in accounting shouldn't have permission to run an untrusted binary.

Matthew in accounting should be given an ipad pro instead of a laptop or pc, with a glued in lightning cable that can only do power. ^ This is the solution I have been mulling if and when I am responsible for an org where security is kinda important. Sure, iOS is still hackable, but hopefully we put more hindrance steps between the attacker and the org, and move the exposure more to the cloud services (like box). Cur…

A magnetic lightning connector glued in should do fine[0], but if your threat model really takes into account checkm8, you could also just buy the newest ipad which will have a patched SecureROM.

0: https://www.amazon.com/REDDOTMOBILE-Detachable-Magnetic-Ligh...

Re: FireEye Shares Details of Recent Cyber Attack

#129

Post by sjg007 »

supercucumber wrote: post #97
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest link :/

The invoice should be a PDF interpreted by pdf.js inside a sandboxed browser.

Even better is that the company should have its own internal ordering system.

Re: FireEye Shares Details of Recent Cyber Attack

#130

Post by hangonhn »

Wowfunhappy wrote: post #116
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

Does Matthew in accounting need access to the same network as the engineering staff?

Air gap is not the final word in security. Stuxnet got into the Iranian centrifuges despite an air gap.
Post reply on HN