Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Treasury breached by hackers backed by foreign government – sources

reuters.com

Post reply on HN
Print view View original

241–250 of 389 posts

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#241

Post by rapjr9 »

nobody9999 wrote: post #228
rapjr9 wrote: post #216

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted and audited apps are run on the system, there will always be zero day exploits. Science has come up with no possible way to provably secure network connected computers. So do not trust them any more. Please prove me wrong, but I doubt you can. The most trusted…

>It's time to admit that computers connected to the internet can not be secured. That ship sailed a long time ago. It was normal back in the 1990s for InfoSec folk to assume that "if it's connected to the Internet, eventually, it will be compromised." The goal (then, as now) is to implement layered (defense-in-depth) mechanisms to deter such activities -- at perimeters, network and systems infrastructure platforms an…

True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not.

The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#242

Post by finaliteration »

threentaway wrote: post #238
finaliteration wrote: post #224

Earlier quoted context omitted.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques. The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material. It was very sophisticated…

Organizations that are serious about security should not allow random OAuth apps. Both G Suite and O365 admins can restrict what OAuth apps are allowed.

Agreed. However some service providers (like GitHub) allow a user with admin access to approve any OAuth app the first time it’s “launched” if they are the ones initiating the request, rather than using a pre-defined allowlist approach which I believe is what Office 365 does.

My wish would be for some sort of multi-person approval process rather than allowing anyone who is an admin to authorize an app. Even admins can be susceptible to a targeted and advanced attack.

Also, many people (like myself before my own “failure”) simply aren’t aware of OAuth apps as a serious attack vector. Most remedial training around phishing campaigns covers things like fake login pages but not “An attacker has spoofed an internal domain and an OAuth app with your company’s name in it”.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#243

Post by tedunangst »

cookiemonster9 wrote: post #232
sneak wrote: post #212

Earlier quoted context omitted.

...and yet somehow people tell me I'm crazy when I demand that software not autoupdate without user intervention. Automatic updates are RCE vulnerabilities.

To be clear, given that one never knows if or when a provider has been compromised... is the plan to just not update? What if they were compromised before you initially obtained the software? There's not much that can stop attacks like this. Preventing lateral movement, escalation, exfiltration, detection, and remediation, among other things, would be the way to go.

Depends how you weigh timing. If attacker doesn't know when you update, they have to hang out and risk detection at the supplier. (Who added this update?) If they can push updates, they can move quickly and compromise the target.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#244

Post by rapjr9 »

ravi-delia wrote: post #233
rapjr9 wrote: post #223

I wonder why more attacks are not attributed to businesses. They have lots of resources and would benefit from attacking government agencies and competitors.

A salaried employee has absolutely zero incentive to take on that risk unless ordered, and the same would go for whoever ordered them, so it just doesn't really happen. Companies would love it, but at the end of the day people just don't take risks like that when they could simply choose not to and likely be just fine.

But a company officer can just slip cash to a third party in another country to launch an attack. Maybe that's the explanation, that that kind of thing is difficult to attribute.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#245

Post by marcosdumay »

threentaway wrote: post #238
finaliteration wrote: post #224

Earlier quoted context omitted.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques. The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material. It was very sophisticated…

Organizations that are serious about security should not allow random OAuth apps. Both G Suite and O365 admins can restrict what OAuth apps are allowed.

Domain spoofing takes care of any such restriction.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#246

Post by paranoidrobot »

finaliteration wrote: post #224
omarforgotpwd wrote: post #214

Earlier quoted context omitted.

If I had to guess, probably some kind of social engineering attack. Identify the supplier. Go on LinkedIn, look for employees of that supplier with a title that would imply sufficient privileges to enable the attack. Then get to know that person and target them personally.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques. The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material. It was very sophisticated…

> The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.

This sounds like a post I saw on Reddit a few days ago.

This person's IT organisation had been talking about migrating to Github Enterprise, they got an email saying that it had been rolled out from an internal IT mailbox to an OAuth application that had been pre-approved on their Github Organisation.

For that particular scenario - if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway, since to approve the application they probably needed Admin rights anyway.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#247

Post by finaliteration »

paranoidrobot wrote: post #246
finaliteration wrote: post #224

Earlier quoted context omitted.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques. The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material. It was very sophisticated…

> The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material. This sounds like a post I saw on Reddit a few days ago. This person's IT organisation had been talking about migrating to Github Enterprise, they got an email saying that it had been rolled out…

> if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway

In my case the email came through due to a “bad” DMARC configuration so they were able to spoof our domain from an external server and the OAuth app in question had our company’s name on it.

And on a personal front, I was busy that morning and didn’t pay enough attention to the permissions being requested by the app before I clicked “allow”. So it was a failure of both systems and people controls.

My new rule is that if I get an email asking me to do any sort of action, automated or not, I’m going to sit on it for 1-24 hours before doing anything about it. If it’s actually urgent then someone will get ahold of me through some other method than email.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#248

Post by vineyardmike »

alquemist wrote: post #187
andrei_says_ wrote: post #168

Earlier quoted context omitted.

Who would be trusted to design and procure the hardware for such a device?

https://leanprover.github.io While it is difficult to design a secure procurement chain all the way to the SiO2, we could at least design simple enough hw/sw systems for which formal verification is an economical option. And then force government entities to use formally verified systems instead of the bug ridden crap most shops, especially the sw ones, have to ship under intense deadline pressure. The market has led…

> force government entities to use formally verified systems instead of the [current commercial options]

When do we complain about the even more expensive defense budget in this story?

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#249

Post by paranoidrobot »

Godel_unicode wrote: post #119
sorokod wrote: post #68

The "have been hacked by" scale seems to have two settings: 0. Forgot to secure access with password. 100. Nation state.

Seems about right, maybe add in 0.1 didn't patch 14-month-old RCE.

0.09 - Installed the patch, just couldn't get Management approval for the downtime to reboot the machine for it to apply.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#250

Post by octoberfranklin »

ardit33 wrote: post #23
breakingcups wrote: post #18

It's always a nation state. A great way to increase defence budgets and not have to admit incompetence.

I have seen a couple of corporate hacks (not publicized) who happened to be Russian groups hosted in Syria.... By state 'sponsored' it can mean many things, even if the countries just let them be and some officials get bribed to not do anything. In this case it was in Syria, which is a fundamental mess, but the fact that it was Russian groups and they have military presence there, it is enough to put it 'state sponso…

Yeah if I were a blackhat I would launch all my attacks from a cheap VPS in Tehran and sprinkle random Russian gibberish throughout my binaries.

Guaranteed nobody will come looking for me.

Sincerely yours,

Evil mastermind

Post reply on HN