Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 350 posts

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#141

Post by maedla »

aaomidi wrote: post #26
swalsh wrote: post #5

So, am I reading this right? the Russian government had the ability to impersonate the credentials of ANYONE in the marjoity of the fortune 500, the US Government, the US DOD, and our telecomm infrastructure... and they likely had this access for a while. How is this NOT an act of war?

Lmao act of war. You going to fight? This is just what countries do to eachother. Welcome to the 21st century.

It is appalling how so many people seem to have such little regard for what the consequences of the next "war to end all wars" would be.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#142

Post by dj_mc_merlin »

octopoc wrote: post #126
dj_mc_merlin wrote: post #74

Earlier quoted context omitted.

Not uncommon for software that has to do very "shady" stuff, although their other advisories are quite bullcrap.

It's not just shady stuff. Recently, on a customer's Windows server, antivirus software randomly decided to permanently delete some our DLLs (!). We weren't doing anything remotely shady; it was a normal ASP.NET Core app.

Yes, the shady was in quotes. It's hard to tell some classes of malware from a security program in general.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#143

Post by realmod »

outworlder wrote: post #115
thisisdallas wrote: post #65

Earlier quoted context omitted.

No, not at all. It's political theatre the media is playing. Russia has been the big bad wolf since 2016. It's far more likely China than Russia, although it could be a variety of different states/parties.

> Russia has been the big bad wolf since 2016. For a very good reason.

I still cannot help but laugh at the intentional ignorance by a lot of people in the US right now. They have for some reason (we all know why) gotten the notion that Russia is some kind of innocent nation that does nothing at all and that US is unreasonably antagonistic against Russia.

Russia is in NO uncertain terms a hostile and aggressive nation that we all need to be wary of.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#144

Post by toomuchtodo »

Jtsummers wrote: post #112
toomuchtodo wrote: post #96

Earlier quoted context omitted.

What’s preventing more rapid uptake of integrating with the CAC system? I can use my CAC when going through TSA for ID (and verification is sub 10 seconds) but other agencies keep dragging their feet.

It seems to be laziness on the part of the IT system makers. There are (mostly) standardized ways to authenticate a CAC and associate it with a user for an information system. But people seem to prefer to roll their own. Either using traditional username/password combos, or a worse solution. The worse one is this (seen a few times): Username/password and then you register your CAC with it. They only check the CAC its…

As an IAM/trust systems enthusiast with a passing interest in the CAC system (and tangentially, Login.gov), this is disappointing to hear. Thanks for the context. I’ll keep my eye out for opportunities to contribute to improving the situation (USDS or 18F).

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#145

Post by vorpalhex »

triangleman wrote: post #131
Jtsummers wrote: post #30

Earlier quoted context omitted.

The insistence on the stupidly long passwords and 30-60 day expiration times created so many weaknesses. People choose obvious patterns for their passwords to get around it. Like `1q2w3e4r!Q@W#E$R`. Then they shift by one each time they have to update, by the time they get across the keyboard they can restart (or twice, in which case you swap the shift to the first half instead of second half). Or, this was fun, my f…

>Or, this was fun, my first gov't job the guy had stored passwords on a sticky underneath the keyboard (I changed them all). Nothing wrong with writing passwords down. Or at least it's the least wrong thing you could do among all things mentioned here.

It depends entirely on your security and threat model. Me, working from home? I'll write down the password for my netflix account and wifi - sure.

In an office? Absolutely not, never, not once. Offices are not private and not secure and in any kind of even vaguely sensitive setting allowing a colleague to have access to your password and impersonate you is a massive risk.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#146

Post by 35fbe7d3d5b9 »

bluedino wrote: post #140
35fbe7d3d5b9 wrote: post #97

Earlier quoted context omitted.

> SolarWinds hasn't bothered to revoke their certs or remove the package Amazing. While I'm sure the attackers have already shut up shop and the threat no longer exists, this feels insanely tone-deaf from SolarWinds.

Maybe they were just bribed?

An employee, possibly. The whole company, unlikely. And either way, even if someone was bribed to introduce the attack there's zero reason to allow the hacked software to be downloaded now.

I work at a large and highly regulated (HIPAA) company and we have the equivalent of Electric Dylan/Pete Seeger with the axe: if someone at the VP+ level declares a major incident, our infosec team has a script that will lock down all inbound/outbound traffic, snapshot all our running machines for later forensics, lock our AWS IAM access down to a single incident response account, and move DNS for our web properties to a "we've been hacked" page. (OK, it obviously doesn't say that, but something similar that has been heavily vetted by legal and marketing ;-)). We've drilled and timed it out and can stop the ship in ~5 minutes.

Either SolarWinds doesn't have a major security incident response plan, or they don't have the stomach to pull the trigger. Neither is promising.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#147

Post by coldcode »

thesimon wrote: post #29

SolarWinds hasn't bothered to revoke their certs or remove the package https://twitter.com/KyleHanslovan/status/1338360093767823362 Back in 2019 apparently their FTP server credentials were exposed on GitHub, allowing automated updates being pushed https://twitter.com/vinodsparrow/status/1338431183588188160/... Edit: If updates failed due to signature not matching, SolarWinds recommended downloading the package and i…

Clearly whoever is the CIO/CISO could care less? I find it hilarious that people get these positions without seemingly a care in the world. Or maybe they do care and the CEO didn't? Hardly anyone ever gets fired in these circumstances.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#148

Post by alasdair_ »

asimovfan wrote: post #43
jessaustin wrote: post #38

Earlier quoted context omitted.

Maybe we should "send the message" that we won't install insecure shit on our networks?

no... nuclear war before free software.

Microsoft’s rejected new slogan.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#149

Post by Jtsummers »

triangleman wrote: post #131
Jtsummers wrote: post #30

Earlier quoted context omitted.

The insistence on the stupidly long passwords and 30-60 day expiration times created so many weaknesses. People choose obvious patterns for their passwords to get around it. Like `1q2w3e4r!Q@W#E$R`. Then they shift by one each time they have to update, by the time they get across the keyboard they can restart (or twice, in which case you swap the shift to the first half instead of second half). Or, this was fun, my f…

>Or, this was fun, my first gov't job the guy had stored passwords on a sticky underneath the keyboard (I changed them all). Nothing wrong with writing passwords down. Or at least it's the least wrong thing you could do among all things mentioned here.

I would partially agree with this. It's not wrong to write down passwords. It is wrong to write them down and not secure them. Securing them is the same step that happens (or is intended to happen) with password managers. The passwords are, themselves, encrypted in some fashion so that they're not (easily) accessible to others. If these passwords were at least put in a locked cabinet, I'd have felt better about it. A safe would've been even better (and this is assuming that they needed to be shared, we had security tokens that, if used properly, meant we didn't need the passwords at all and each person would have a unique access token for better accountability).

It is moronic to write passwords down and stick them underneath the keyboard.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#150

Post by gitweb »

jessaustin wrote: post #83
Merman_Mike wrote: post #77

Earlier quoted context omitted.

Am I understanding the last one correctly? 1. Customers complain that they can't install latest version because it's checksum doesn't match what SolarWinds posted 2. The checksum doesn't match because malware has been inserted into the package during build/delivery 3. SolarWinds tells customers to ignore this and install it manually Did no one think to check why the checksum didn't match?

One suspects they've given this advice for a long time... because their shit has been hacked for a long time.

I don't understand why anyone would pay for SW in the first place. It has been garbage software for a long time. If government clients are paying for this and installing in on their servers, we have bigger worries.
Post reply on HN