SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president • Hacker News Board

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#131

Post by aasasd » Mon, Feb 15, 2021, 10:27 AM UTC

WalterBright wrote: post #85

flower-giraffe wrote: post #79

Earlier quoted context omitted.

> nobodys really addressed the elephant in the room. I think the elephant in the room is actually a more general issue that is cross platform and independent of the product implementation. It’s 2021 and we are still ignoring the fundamental “best practice” that we’ve known about for at least 20 years. Systems should be isolated from each other unless there is an overwhelming need for them to be connected and everythi…

It's also important to have diversity. For example, on the Boeing 757 there are two computers that control the stab trim, that do the same thing. They must agree or both computers are automatically locked out. The two computers are developed by two independent teams who are not allowed to talk to each other. Two different CPUs, two different algorithms, two different programming languages. The idea, of course, is a d…

> They must agree or both computers are automatically locked out

As a marine saying goes, never take two chronometers with you to the sea. Take either one or three.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#132

Post by rini17 » Mon, Feb 15, 2021, 10:28 AM UTC

KirillPanov wrote: post #123

rini17 wrote: post #106

Earlier quoted context omitted.

But this does not solve the question: who is going to pay for an expert to read all the source?

The vendor's competitors, of course. Humiliating the competition is good marketing.

LOL nope. Humiliation works only on the level which target audience understands, like performance benchmarks. Security exploits are much more esoteric and tend to result in mudfights. It already did many times, like, how many businesspeople responsible for procurement have accurate understanding of spectre/meltdown/rowhammer vulns? Why do you think AMD isn't using it for marketing against Intel?

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#133

Post by einpoklum » Mon, Feb 15, 2021, 10:28 AM UTC

jjcm wrote: post #6

Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I'm missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack. [1] https://en.wi…

It was the "largest and most sophisticated attack" that Microsoft has to make excuses for right now. (And that's regardless of their culpability or lack thereof.)

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#134

Post by WalterBright » Mon, Feb 15, 2021, 10:29 AM UTC

WalterBright wrote: post #112

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

Some questions a security professional should ask: 1. What happens when the root password is guessed by a malicious person? 2. What happens when a trusted employee is really an enemy agent? 3. What happens when we download and install a malicious update from a trusted vendor? 4. What happens when the server room burns down? 5. What happens when a malicious USB stick is plugged into our secure network? 6. What happens…

Just to be blunt, here are wrong answers:

1. make the root password unguessable and change it often

2. background check employees

3. audit trusted vendor's security procedures

4. install sprinklers (!)

5. jam all USB ports with glue

6. train CEO on laptop security protocol

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#135

Post by unishark » Mon, Feb 15, 2021, 10:31 AM UTC

llaolleh wrote: post #109

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. If there is a loophole on one server OS, then it's everywhere deeply ingrained in software. Even if you split the data, wouldn't the underlying platforms all have that flaw? Ironically the greatest advantage of softwa…

> That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad.

I think this is the point. Software is about operating at the top level predominantly, packaging together stuff other people wrote using only simplified API's which abstract away their internal complexity. So you can zoom along at light speed producing "solutions" before the other guy and make the most money the fastest and move on.

Engineering is about starting from physical principles and building a product that fits the understanding of those fundamental principles at work. The engineer generally stays with a set of fundamental domain principles their entire career (e.g. sticks with bridges as opposed to transmission lines) while programmers tend to stay at the top layers while the technologies below the surface change radically.

It doesn't have to be that way for all software, presumably. Critical software and hardware can be designed together, for example, from the bottom up. I wonder if software patents is at fault for allowing those at the top layer to capture almost all the value in computers, and commoditize the technology below.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#136

Post by [deleted] » Mon, Feb 15, 2021, 10:33 AM UTC

rini17 wrote: post #106

quasirandom wrote: post #94

Earlier quoted context omitted.

Or just distribute your source with the binary, and opt into the no liability regime.

But this does not solve the question: who is going to pay for an expert to read all the source?

[deleted]

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#137

Post by funkisjazz » Mon, Feb 15, 2021, 10:34 AM UTC

Does the fact that the MSFT president made it make anyone else think it's a fairly worthless statement?

Not trying to bad-mouth MSFT, just saying that presidents are PR.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#138

Post by LeanderK » Mon, Feb 15, 2021, 10:35 AM UTC

how sophisticated is the penetration testing of government infrastructure? It seems to me like one should invest roughly as much in defensive (so penetration testing etc.) as in offensive capabilities. Maybe even more, because the attack surface is so big.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#139

Post by WalterBright » Mon, Feb 15, 2021, 10:47 AM UTC

aasasd wrote: post #131

WalterBright wrote: post #85

Earlier quoted context omitted.

It's also important to have diversity. For example, on the Boeing 757 there are two computers that control the stab trim, that do the same thing. They must agree or both computers are automatically locked out. The two computers are developed by two independent teams who are not allowed to talk to each other. Two different CPUs, two different algorithms, two different programming languages. The idea, of course, is a d…

> They must agree or both computers are automatically locked out As a marine saying goes, never take two chronometers with you to the sea. Take either one or three.

I must remember to use "chronometer" rather than "clock".

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#140

Post by waihtis » Mon, Feb 15, 2021, 10:54 AM UTC

WalterBright wrote: post #128

waihtis wrote: post #126

Earlier quoted context omitted.

How to defend against these: 1) detection 2) detection 3) detection 4) sprinklers 5) detection 6) detection unfortunately, most orgs outsource their internal detection or have no capability at all.

Detection is inadequate, because detecting the open barn door after the horse left is not helpful. > Sprinklers That is "we can prevent the server room from being destroyed" thinking, rather than "how do we survive the server room being destroyed" I'm proposing.

Youre suggesting detection is only possible much after the fact, when it is possible to also do before an adversary has been able to achieve anything significant on the target. But credit where credit is due, detection is not the answer but rather early detection.

Sprinklers comment was made in jest.