Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Treasury breached by hackers backed by foreign government – sources

reuters.com

Post reply on HN
Print view View original

221–230 of 389 posts

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#221

Post by arkadiyt »

sneak wrote: post #212
omarforgotpwd wrote: post #206

So apparently Russian hackers were able to infiltrate the Office 365 accounts of multiple federal agencies. They were able to do to this by targeting one of the government's suppliers, a company called "SolarWinds" in Austin. The hackers were able to slip their software into a software update from SolarWinds over the summer. And get this: "SolarWinds says on its website that its customers include most of America’s Fo…

...and yet somehow people tell me I'm crazy when I demand that software not autoupdate without user intervention. Automatic updates are RCE vulnerabilities.

No one is arguing a compromise of the update server doesn't allow compromising all customers. They're arguing that the benefits out auto-updating software (especially consumer software) outweigh the risk of a compromised update server, which is generally true.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#222

Post by o-__-o »

omarforgotpwd wrote: post #214
mdgrech23 wrote: post #207

Earlier quoted context omitted.

curios as to how Russian hackers slipped their software into solar winds. sounds like a major breach.

If I had to guess, probably some kind of social engineering attack. Identify the supplier. Go on LinkedIn, look for employees of that supplier with a title that would imply sufficient privileges to enable the attack. Then get to know that person and target them personally.

Or become employed there and go for the long con. How many companies check in go vendor code or pip install from CI? Ripe targets for abuse

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#224

Post by finaliteration »

omarforgotpwd wrote: post #214
mdgrech23 wrote: post #207

Earlier quoted context omitted.

curios as to how Russian hackers slipped their software into solar winds. sounds like a major breach.

If I had to guess, probably some kind of social engineering attack. Identify the supplier. Go on LinkedIn, look for employees of that supplier with a title that would imply sufficient privileges to enable the attack. Then get to know that person and target them personally.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques.

The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.

It was very sophisticated and I’m glad I fell for it during a simulation rather than in a “real life” situation. It was a learning experience and a situation I’m way more paranoid about now. I could easily see admins and developers anywhere falling for it if they were specifically targeted.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#225

Post by thefucnjosh »

tw04 wrote: post #121
olefoo wrote: post #110

Earlier quoted context omitted.

Imagine if an automobile manufacturer allowed you to configure the safety features of your car and had the defaults set to unsafe but convenient values to help sell vehicles... do you think the manufacturers should evade liability?

They absolutely do. In northern climates where there is snow and ice on the roads for 3+ months out of the year, a car MFG will GLADLY sell you a vehicle with sport/summer tires. If you try driving with those in the winter: at best you'll get stuck, at worst you'll slide through the first intersection you come to and die in a fiery crash. Just about every business will have options that are a perfectly reasonable cho…

I live in Alaska....litterally every car here is sold with summer tires.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#226

Post by vecinu »

rapjr9 wrote: post #216

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted and audited apps are run on the system, there will always be zero day exploits. Science has come up with no possible way to provably secure network connected computers. So do not trust them any more. Please prove me wrong, but I doubt you can. The most trusted…

You bring up a very good point and it's worth reiterating that the Kremlin reverted to use paper instead of computers to discuss sensitive topics. [1]

I wouldn't be surprised if any network connected device is vulnerable to being exploited, even if not directly connected to the internet, by association of other devices on the network.

[1] https://www.usatoday.com/story/news/world/2013/07/11/russia-...

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#227

Post by rapjr9 »

jshawl wrote: post #219
rapjr9 wrote: post #216

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted and audited apps are run on the system, there will always be zero day exploits. Science has come up with no possible way to provably secure network connected computers. So do not trust them any more. Please prove me wrong, but I doubt you can. The most trusted…

To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured."

It's an open problem in science to prove security of a network connected computer. It's well known.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#228

Post by nobody9999 »

rapjr9 wrote: post #216

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted and audited apps are run on the system, there will always be zero day exploits. Science has come up with no possible way to provably secure network connected computers. So do not trust them any more. Please prove me wrong, but I doubt you can. The most trusted…

>It's time to admit that computers connected to the internet can not be secured.

That ship sailed a long time ago.

It was normal back in the 1990s for InfoSec folk to assume that "if it's connected to the Internet, eventually, it will be compromised."

The goal (then, as now) is to implement layered (defense-in-depth) mechanisms to deter such activities -- at perimeters, network and systems infrastructure platforms and software implementation.

This is (and has been for a long time), a well-defined, although usually poorly (if at all) implemented set of processes and procedures.

The levels of complexity for Internet resources have vastly increased over the past 25 years. Info Security techniques have advanced as well, but again are often poorly or not at all implemented.

However, far too many organizations implement a "Skittles" type defensive posture rather than defense-in-depth posture.

There are a variety of reasons for this:

1. Those responsible are ignorant of good security practice;

2. Those responsible are aware of the risks, but ignore it as it negatively impacts profit;

3. Those responsible are aware of the risks, but implement inadequate defenses because of the impact on time-to-market and/or profit.

4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration.

There are other reasons, but those are the big ones, IMHO.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#229

Post by astura »

omarforgotpwd wrote: post #206

So apparently Russian hackers were able to infiltrate the Office 365 accounts of multiple federal agencies. They were able to do to this by targeting one of the government's suppliers, a company called "SolarWinds" in Austin. The hackers were able to slip their software into a software update from SolarWinds over the summer. And get this: "SolarWinds says on its website that its customers include most of America’s Fo…

I believe it was an insider.

I have personal experience delivering software/software updates to the USG. I'm actually baffled as to how something like this can happen without an insider. I've never had any slight sliver of concern over the security of our supply chains.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#230

Post by guerrilla »

tialaramex wrote: post #196
simias wrote: post #135

I'm always skeptical of these "nation state" claims, it seems like an easy way out of any tough question about the security of these systems. "No, no, you don't understand, it's not that our systems are insecure, it's that the attackers where highly sophisticated and had the resources of a nation state, otherwise it would never have worked out". I suppose "we think it could be done by a group of two or three teenager…

Right. There are situations where we can see that the only apparent way to do something needed very considerable resources, which suggests a state actor. Equation Group is presumed to be (a front for) the NSA. It forged a (code signing) certificate that otherwise shouldn't exist, using an MD5 collision. But not the MD5 collision painfully created by researchers a little earlier to demonstrate that MD5 was vulnerable,…

Didn't Dan Kaminsky and others have tools to produce nearly arbitray collisions by the early 2000s?
Post reply on HN