Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FireEye Shares Details of Recent Cyber Attack

fireeye.com

Post reply on HN
Print view View original

151–160 of 251 posts

Re: FireEye Shares Details of Recent Cyber Attack

#151

Post by megous »

Wowfunhappy wrote: post #134
hangonhn wrote: post #130

Earlier quoted context omitted.

Air gap is not the final word in security. Stuxnet got into the Iranian centrifuges despite an air gap.

But only because someone plugged a USB drive into the centrifuge computers. If the networks were air gapped, it wouldn't be Matthew's fault. Someone who had access to the engineering network would need to screw up. Which is of course perfectly possible—engineers make mistakes too. (Furthermore, if they were hacked by a nation state... for all we know it really could have been done without any user action at all.)

Viruses spread quite fine without the help of any networking in the days of MS-DOS.

Re: FireEye Shares Details of Recent Cyber Attack

#152

Post by ChuckMcM »

mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

That totally makes sense. It also suggests that it could kickstart someone's effort to make their own tools which avoid the signature detector which is sad.

A technique we used at Blekko (and hopefully you guys do as well) was logging/tracing statistical traffic flows for normal cluster operations such that we could alert on atypical traffic (which in our case meant something was likely kinda broken but limping along and needed to be fixed/replaced.). We also didn't have to deal with APTs before we were acquired so the stakes were way lower.

Agreed that getting hacked is inevitable if the prize is worth it, always interested in adding new ways to instrument the world to detect sniffing or attacks.

Re: FireEye Shares Details of Recent Cyber Attack

#153

Post by gen3 »

pabs3 wrote: post #106
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

Whats your opinion of open source tools and distributions of them (like Kali) in this space and the tradeoff between open sourcing your red team tools vs reimplementing tools that are already out there.

The point in them re-implementing some of the public tools is so sites like totalvirius or a hash based antivirus does not pick up on what the program is.

If they didn’t have a binary that looked reasonably different to those that already exist, then it would instantly get triggered. It is worth noting that there are tools to obfuscate sourcecode/bins.

Re: FireEye Shares Details of Recent Cyber Attack

#154

Post by dang »

arafsheikh wrote: post #76

Official blog post (no info on how the attack was performed though): https://www.fireeye.com/blog/products-and-services/2020/12/f... They’ve also released signatures to detect the use of the compromised tools: https://github.com/fireeye/red_team_tool_countermeasures

(This comment was originally in https://news.ycombinator.com/item?id=25354426 but we're merging the threads.)

Re: FireEye Shares Details of Recent Cyber Attack

#155

Post by dang »

troydavis wrote: post #9

FireEye's own blog post is up: https://www.fireeye.com/blog/threat-research/2020/12/unautho... As is the GitHub repo with their red team tool countermeasures, which they admirably released immediately: https://github.com/fireeye/red_team_tool_countermeasures/

(This comment was originally posted to https://news.ycombinator.com/item?id=25351349 but we're merging the threads.)

Re: FireEye Shares Details of Recent Cyber Attack

#156

Post by dang »

Other articles that were posted on this:

https://www.reuters.com/article/us-fireeye-cyber/u-s-cyberse...

https://www.nytimes.com/2020/12/08/technology/fireeye-hacked...

(via https://news.ycombinator.com/item?id=25354426 and https://news.ycombinator.com/item?id=25351349, but we've merged the comments hither)

Re: FireEye Shares Details of Recent Cyber Attack

#157

Post by hh3k0 »

markus_zhang wrote: post #135
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

As a layman Mimikatz looks like magic. How did the author figure out where in memory the prints are? This is fascinating stuff.

> How did the author figure out where in memory the prints are?

Microsoft provided him a nifty protocol for that.

> Mimikatz first became a key hacker asset thanks to its ability to exploit an obscure Windows function called WDigest. That feature is designed to make it more convenient for corporate and government Windows users to prove their identity to different applications on their network or on the web; it holds their authentication credentials in memory and automatically reuses them, so they only have to enter their username and password once. While Windows keeps that copy of the user's password encrypted, it also keeps a copy of the secret key to decrypt it handy in memory, too. "It’s like storing a password-protected secret in an email with the password in the same email," Delpy says.

https://www.wired.com/story/how-mimikatz-became-go-to-hacker...

Re: FireEye Shares Details of Recent Cyber Attack

#158

Post by markus_zhang »

hh3k0 wrote: post #157
markus_zhang wrote: post #135

Earlier quoted context omitted.

As a layman Mimikatz looks like magic. How did the author figure out where in memory the prints are? This is fascinating stuff.

> How did the author figure out where in memory the prints are? Microsoft provided him a nifty protocol for that. > Mimikatz first became a key hacker asset thanks to its ability to exploit an obscure Windows function called WDigest. That feature is designed to make it more convenient for corporate and government Windows users to prove their identity to different applications on their network or on the web; it holds…

Ah, thank you very much. I wonder if authentification software of my company uses it, too.

Re: FireEye Shares Details of Recent Cyber Attack

#159

Post by tru3_power »

kurthr wrote: post #110
ardy42 wrote: post #81

Earlier quoted context omitted.

> Seriously, the quickest, cheapest, easiest way to spy on someone in the US (or any 5 eyes) is through our own "security" agencies, but I'm going to go with stupidity rather than malice on the NSA's part. No. The quickest and easiest way is probably to send them a phishing message, the next easiest is probably figuring some of their password recovery answers using dossiers compiled by data brokers, maybe after that…

You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out. On the other hand it's all sitting right there at the NSA et al. Your other attacks are similarly focused on individuals, although the credit and health agencies are pri…

Phishing provides a great avenue for escalation type attacks (both lateral and vertical). Might not give you what you’re looking for right then but it gives you a foot in the door.

Re: FireEye Shares Details of Recent Cyber Attack

#160

Post by alasdair_ »

DiffEq wrote: post #119
lupire wrote: post #109

Earlier quoted context omitted.

> Matthew in accounting that will open that invoice attachment so he can pay it. Matthew in accounting shouldn't have permission to run an untrusted binary.

...and a binary at all should not be able to be downloaded from the internet or pass through and email server. Additionally the only binary files running on any system should be known binaries. Least Privileged systems with tight change control don’t get hacked.

> Least Privileged systems with tight change control don’t get hacked.

As often.

Post reply on HN