So apparently Russian hackers were able to infiltrate the Office 365 accounts of multiple federal agencies. They were able to do to this by targeting one of the government's suppliers, a company called "SolarWinds" in Austin. The hackers were able to slip their software into a software update from SolarWinds over the summer. And get this: "SolarWinds says on its website that its customers include most of America’s Fo…
I believe it was an insider. I have personal experience delivering software/software updates to the USG. I'm actually baffled as to how something like this can happen without an insider. I've never had any slight sliver of concern over the security of our supply chains.
U.S. Treasury breached by hackers backed by foreign government – sources
231–240 of 389 posts
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#232So apparently Russian hackers were able to infiltrate the Office 365 accounts of multiple federal agencies. They were able to do to this by targeting one of the government's suppliers, a company called "SolarWinds" in Austin. The hackers were able to slip their software into a software update from SolarWinds over the summer. And get this: "SolarWinds says on its website that its customers include most of America’s Fo…
...and yet somehow people tell me I'm crazy when I demand that software not autoupdate without user intervention. Automatic updates are RCE vulnerabilities.
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#233I wonder why more attacks are not attributed to businesses. They have lots of resources and would benefit from attacking government agencies and competitors.
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#234We're under attack by the Russians(again), according to anonymous sources(again) that are purportedly government officials. Where is the skepticism? Are we simply to, yet again, blindly accept evidence-free assertions made by anonymous government officials? As technically literate people know, it can be very difficult, if not impossible to determine who exactly intruded into a network, even in the best of circumstances. As historically literate people know, evidence-free government assertions of attacks by our "enemies" are often baseless, deliberately misleading, or outright fabrications.
The Treasury may very well have been hacked, and the culprits may have been Russians, but its madness to believe any of this without evidence that be scrutinized. There's been a lot of recent outcry for "gatekeepers" that sift through disinformation and decide what people are allowed to see and hear. As illustrated with this article(and the reception it has received), the problem isn't the existence of evidence-free assertions, its the uncritical acceptance of these evidence-free assertions. We need to maintain our skepticism and maintain the same demands for evidence regardless of what assertions are offered or who they are offered by. Lies and unsubstantiated statements are just as bad (if not worse) whether they come stamped with the approval of officially designated gatekeepers or not.
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#235> The hack involves the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said. > The hackers are “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press. > “This…
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#236All these systems are just too complicated. We keep adding features on features to software without a second thought, because it's invisible and you can't immediately tell from looking at it how insane it is, in a way that you wouldn't be able to ignore if these were mechanical systems. Also, not that it would have prevented this attack, but as a community we desperately need a fully open source FPGA-based ultra simp…
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#237So apparently Russian hackers were able to infiltrate the Office 365 accounts of multiple federal agencies. They were able to do to this by targeting one of the government's suppliers, a company called "SolarWinds" in Austin. The hackers were able to slip their software into a software update from SolarWinds over the summer. And get this: "SolarWinds says on its website that its customers include most of America’s Fo…
https://en.wikipedia.org/wiki/Executive_Office_of_the_Presid...
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#238Earlier quoted context omitted.
If I had to guess, probably some kind of social engineering attack. Identify the supplier. Go on LinkedIn, look for employees of that supplier with a title that would imply sufficient privileges to enable the attack. Then get to know that person and target them personally.
I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques. The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material. It was very sophisticated…
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#239Earlier quoted context omitted.
curios as to how Russian hackers slipped their software into solar winds. sounds like a major breach.
If I had to guess, probably some kind of social engineering attack. Identify the supplier. Go on LinkedIn, look for employees of that supplier with a title that would imply sufficient privileges to enable the attack. Then get to know that person and target them personally.
Re: U.S. Treasury breached by hackers backed by foreign government – sources
#240Earlier quoted context omitted.
Right. There are situations where we can see that the only apparent way to do something needed very considerable resources, which suggests a state actor. Equation Group is presumed to be (a front for) the NSA. It forged a (code signing) certificate that otherwise shouldn't exist, using an MD5 collision. But not the MD5 collision painfully created by researchers a little earlier to demonstrate that MD5 was vulnerable,…
Didn't Dan Kaminsky and others have tools to produce nearly arbitray collisions by the early 2000s?
However the trouble is MD5 collision isn't like that hilarious "Send all zeroes" Microsoft bug from a few weeks back where you just try it a few times then it works because someone was very stupid - the MD5 collision is pretty hard, the Merkle–Damgård construction actually works, your attack avenue is hammering on the compression function, everything else in MD5 (and any other Merkle–Damgård construction) works because of mathematics unless you can break that compression function - so having a program that when you run it spits out an MD5 collision with your preferred shape is great, it's a cryptographic breakthrough - but maybe it'll take 5000 years to run on a typical home PC. If you're a government or a big crime boss then money turns that into 5 days or (if you've enough of it) 5 hours instead, but if you're a bored teenager or small time crook not so much.
And like I said, Flame depends on a never before seen collision, so it isn't like they just re-used work somebody else had done.