Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

reuters.com

Post reply on HN
Print view View original

101–110 of 294 posts

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#101

Post by WalterBright »

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure. Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?"

This is a fundamental shift in viewpoint.

It seems pretty well established that making secure software is impossible. Time to pivot to designing software systems that are tolerant of inevitable security breaches.

One example of this is compartmentalization. A single breach must not have access to all the sensitive data. Another is backups must be air gapped (or put on physically read-only media) so ransomware cannot compromise them.

Compartmentalization is used in battleship design, aircraft design, spy networks, etc. Time to use it in software systems design.

P.S. Just to be clear, one still strives to design airplane parts so they won't fail, it's just that one does not rely on them never failing.

P.P.S. It's really really hard to sink a battleship as they are so compartmentalized. See the sinking of the Bismarck and the Yamato.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#102

Post by kortilla »

Do we call it sophisticated to cover up how embarrassing it was and the fact that it lurked in what is an obvious attack vector in retrospect?

It just shined a light on how shaky the foundation is we’re standing on. This is relatively tame considering its just some back-doored bolt on software.

What happens when it’s the build compiler for the Windows OS? How about the intel NIC firmware?

Our only answer seems to be even more automated updates. Yet that means a slip up in chrome build security could compromise tens of millions of people in a week.

It’s mind boggling how fragile all of this is. It’s barely safe with insiders behaving correctly.

How many people do you think have to sign off on a code change driving the Qualcomm chipset in your phone? My guess is 1, and that’s if it’s a “modern” development process. So that’s it, two people colluding and you’ve got a back door worth a fortune to a nation state.

What a fucking mess.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#103

Post by icare_1er »

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

That's pretty much the concept of defense-in-depth, and breaches like Solar Winds of others like this kind of threat actors, are so sophisticated that they do work around every single aspect of this.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#104

Post by ed_elliott_asc »

technick wrote: post #83
jjcm wrote: post #6

Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I'm missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack. [1] https://en.wi…

You're completely right, this wasn't a complicated attack at all. The two most notable items here are, Solarwinds has horrible security practices and those customers who were affected by the attack, also have horrible security practices. In a correctly secured environment it wouldn't have been possible for a infected Solarwinds server to connect out to a C2C server.

100% this no ports should be allowed in or out by default and every port open justified - if you can’t get out a payload is useless.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#106

Post by rini17 »

quasirandom wrote: post #94
WalterBright wrote: post #88

Earlier quoted context omitted.

Because it creates perverse incentives to never fix the problem, lie about it, deny it, and cover it up, because fixing it means accepting liability.

Or just distribute your source with the binary, and opt into the no liability regime.

But this does not solve the question: who is going to pay for an expert to read all the source?

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#107

Post by mjevans »

talhah wrote: post #68
cookiengineer wrote: post #62

If the password for your "military grade" secured infastructure is literally "solarwinds123", I wouldn't say it's a sophisticated attack. It's a more complete picture of how much modern businesses value security or pentesting audits. The answer to that is exactly zero effs. As long as businesses think there is no ROI in security, this will stay the same. The only thing sophisticated about this was that from code to d…

Initial compromise may not have been sophisticated or hard to achieve, the post compromise may have been somewhat sophisticated judging from the attackers operational security.

From casual reading alone, easily an order of magnitude, or two or three such orders, more sophisticated than the development and resources seemingly applied by SolarWinds.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#108

Post by mjevans »

WalterBright wrote: post #89

On "60 Minutes" they reported that the hardware in your computer is likely compromised as well, so new hardware will have to be bought. This has a simple fix I've advocated for years. Put the firmware for disk drives, USB sticks, embedded systems, etc., in ROM. Or at least provide a physical write-enable switch for updates. I have no idea why people responsible for security do not demand this. I would expect them to…

A literal turn-key switch on the case would work. Turn the key one way to enable firmware updates. Turn it the other to disable them. This should also be easy to replace and come as a standard sized device.

As an alternative, a 'security card' slot; similarly easily replaced or with an internal switch depressed re-'paired' to a new key.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#109

Post by llaolleh »

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. If there is a loophole on one server OS, then it's everywhere deeply ingrained in software. Even if you split the data, wouldn't the underlying platforms all have that flaw? Ironically the greatest advantage of software - easy distribution is also the cause of its greatest weakness.

What I think might be a good idea for big organizations with sensitive data is to download a portion of the web and run their own intranet and isolate the network. Maybe Google can license their search engine and deliver some of the indexed web on prem as a service. If there is nothing coming in and going out, that might be a good foundation for good defense.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#110

Post by codeduck »

jjcm wrote: post #6

Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I'm missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack. [1] https://en.wi…

I remember reading the analyses of Stuxnet and being staggered by the sophistication. Solarwinds feels like a script-kiddie job in comparison.
Post reply on HN