Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

reuters.com

Post reply on HN
Print view View original

161–170 of 294 posts

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#161

Post by IQunder130 »

unishark wrote: post #135
llaolleh wrote: post #109

Earlier quoted context omitted.

That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. If there is a loophole on one server OS, then it's everywhere deeply ingrained in software. Even if you split the data, wouldn't the underlying platforms all have that flaw? Ironically the greatest advantage of softwa…

> That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. I think this is the point. Software is about operating at the top level predominantly, packaging together stuff other people wrote using only simplified API's which abstract away their internal complexity. So you ca…

Engineers work with high level abstractions and heuristics nobody really understands all the time. There are people working on R&D, and building design tools, but then again there are also people working on algorithm theory and writing kernel drivers.

I don't think there is a fundamental difference, just a difference in degree. Software enables far more layers of abstraction and far quicker development cycles than other engineering disciplines.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#162

Post by rndgermandude »

icare_1er wrote: post #125
pornel wrote: post #118

Earlier quoted context omitted.

> are so sophisticated Their password was "SolarWinds123". Everyone who gets pwnd tells a story about sophisticated state actors to make it sound like some unstoppable force has hit their impenetrable defences.

1/ The article talks about the SolarWinds hack, as the campaign that then targeted Microsoft, the DoJ and others. Not the hack "into" SolarWinds. 2/ For SolarWinds itself, the password is one tiny step along the way. I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender) and getting knowledge of the…

>I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender)

SolarWinds recommended to proactively add exceptions to your AntiVirus such as Windows Defender for their stuff[0]. They probably followed their own advice for their own systems as well. Just saying...

https://twitter.com/ffforward/status/1338785034375999491

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#163

Post by sofixa »

WalterBright wrote: post #146
drtillberg wrote: post #144

Earlier quoted context omitted.

Unfortunately, sophisticated threat actors are still very hard to defend against in aviation like in software.

In my day at Boeing, nobody considered that the pilot might be a bad actor. Unfortunately, that was a mistake. It turns out pilots can be bad, and now there are procedures for that.

Funny that Boeing are capable of considering that, but not a single sensor failing and how that might impact a system designed to hide the actual aerodynamics of the plane.

Boeing really aren't a good example for anything besides negligence and how to game regulators.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#164

Post by dualbreathe »

ayewo wrote: post #157
WalterBright wrote: post #112

Earlier quoted context omitted.

Some questions a security professional should ask: 1. What happens when the root password is guessed by a malicious person? 2. What happens when a trusted employee is really an enemy agent? 3. What happens when we download and install a malicious update from a trusted vendor? 4. What happens when the server room burns down? 5. What happens when a malicious USB stick is plugged into our secure network? 6. What happens…

These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. Without providing the context of how expensive or cheap it will be to adhere to each of these best practices, it will be hard to convince those with decision-making authority to do the right thing, unless they are in a highly regulated environment to begin with. An aircraft on the other hand is already very exp…

That's where risk assessments should come into play. Although not all questions asked may be answered, they can still be considered if the risk is commensurable to the consequences to either safety, financial or whatever your organization deems important.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#165

Post by hackeraccount »

aasasd wrote: post #131
WalterBright wrote: post #85

Earlier quoted context omitted.

It's also important to have diversity. For example, on the Boeing 757 there are two computers that control the stab trim, that do the same thing. They must agree or both computers are automatically locked out. The two computers are developed by two independent teams who are not allowed to talk to each other. Two different CPUs, two different algorithms, two different programming languages. The idea, of course, is a d…

> They must agree or both computers are automatically locked out As a marine saying goes, never take two chronometers with you to the sea. Take either one or three.

It's funny because it's true.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#166

Post by sofixa »

notimetorelax wrote: post #71
spoonjim wrote: post #50

Earlier quoted context omitted.

LOL the whole “fall guy” thing is how companies keep doing what they’re doing while making some symbolic penance. For a software company a fuckup of this magnitude should be: all customers leave, company dies, execs never work again. Anything less is an insufficient incentive to work extremely hard to prevent this from happening.

Sorry, I can’t agree with you here. What you’re saying is basically company’s dissolution of it is hacked. If this indeed becomes the case the companies will indeed kill to keep their secrets.

First, with GDPR and co, they can't keep their secrets if they get hacked.

Second, with such negligence? They deserve to be shut down. This isn't a highly sophisticated zero day exploit, there were multiple huge failure at Solarwinds that allowed the attack to happen.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#167

Post by marsokod »

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

This is also taken into account in software engineering. Most software have defense in depth against single point of failure, they can recover or cope with wrong input.

But you cannot compare them because the context is different: software is less regulated than aviation so while anyone can write of very bad software in 5min and sell it, this is not possible for a plane. And not everyone can pilot a plane, while there is no mandatory licencing and training to use a software.

In addition, no safety feature on a plane can prevent the pilot from crashing it willingly. Setting such an easy password and not adding additional protection (due to lack of training) is self sabotage. So far, anything related to SolarWind points towards a bad usage of the tools.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#168

Post by sofixa »

jannes wrote: post #116
ed_elliott_asc wrote: post #104

Earlier quoted context omitted.

100% this no ports should be allowed in or out by default and every port open justified - if you can’t get out a payload is useless.

What about port 80 and 443?

Why would monitoring servers have access to the internet?

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#169

Post by TheRealDunkirk »

ayewo wrote: post #157
WalterBright wrote: post #112

Earlier quoted context omitted.

Some questions a security professional should ask: 1. What happens when the root password is guessed by a malicious person? 2. What happens when a trusted employee is really an enemy agent? 3. What happens when we download and install a malicious update from a trusted vendor? 4. What happens when the server room burns down? 5. What happens when a malicious USB stick is plugged into our secure network? 6. What happens…

These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. Without providing the context of how expensive or cheap it will be to adhere to each of these best practices, it will be hard to convince those with decision-making authority to do the right thing, unless they are in a highly regulated environment to begin with. An aircraft on the other hand is already very exp…

> These hypothetical scenarios are not anchored with the language that most businesses will understand: cost.

I've argued this to well-placed people in two Fortune 250 companies. At the first place, the conversation led to a cleanup up the IT policies, so that they were more consistent and reasonable, but they still weren't grounded in reality. The reaction at the second place has caused me to realize that IT security -- like everything else at a company -- is just another political game of thrones. Aggressive people are trying to work their way up the ladder, and increase the size of their internal kingdoms. They use scary language to leverage fear in upper management to drive ever-larger budgets and ever-more inconvenience in the name of "security" which winds up being little more than security theater. If there's a Fortune-sized company out there which actually makes IT security decisions based on practical consideration of risk vs. cost, I'd love to know. My current belief is that, by the time you get this big, there's too much disconnection between the IT department(s) and everyone else to align the incentives.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#170

Post by dwheeler »

What's interesting about the main SolarWinds subversion was a build environment subversion. It didn't matter how much source code review was done. To detect/counter this kind of attack you need different measures. Start by hardening the build environment, but if you want real strength you need reproducible builds.

For more info see: https://www.linuxfoundation.org/en/blog/preventing-supply-ch...

Post reply on HN