SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president • Hacker News Board

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#171

Post by knuckleheads » Mon, Feb 15, 2021, 1:02 PM UTC

tptacek wrote: post #61

quasirandom wrote: post #59

Earlier quoted context omitted.

> but I can't think of any realistic policy that could be applied to stop these kinds of attacks, not without massively disrupting the technology industry at the same time Why wouldn't Dan Geer's proposal to attach traditional products liability to closed source software improve the situation? Over time, source availability and reproducible builds should make this kind of thing a lot more difficult without wrecking a…

That would work if we knew how to ship secure software at something resembling the cadence the industry demands, but we do not. We pretend to, and we get away with it because there isn't toothy liability attached to shipping bugs. We are all here, the software people on this site, the beneficiaries of that system. Just very simple things, like reimplementing non-performance-sensitive C software from the 1990s and 200…

What if the government directly paid the cost of reimplementing that old c software? If the market is failing here as it seems to be then perhaps the government should step in.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#172

Post by alkonaut » Mon, Feb 15, 2021, 1:03 PM UTC

I think this hack shines a light on the less-is-more approach to security. I can count on an OS or a compiler to not be hacked, but I can't add an unlimited amount of "security software" because someone decides we need to do something to protect against vectors X, Y and Z and those are addressed by massive pieces of software that runs in sensitive locations such as "everyone's machine" or "our CI infrastrycture". It's just a very bad idea™.

Unfortunately it's an idea that is going to be a very hard idea to get rid of (Right now my computer is running CarbonBlack, F-Secure AV, EgoSecure, CyberARK, and at least a couple of others I forget. I assume many of you on corporate machines have the same problem).

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#173

Post by bamboozled » Mon, Feb 15, 2021, 1:09 PM UTC

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

This is already a thing, checkout Zero Trust Networks: https://en.wikipedia.org/wiki/Zero_trust_networks these systems kind of operate on the premise the network is compromised to being with so what do you do then?

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#174

Post by tartoran » Mon, Feb 15, 2021, 1:20 PM UTC

dathinab wrote: post #160

WalterBright wrote: post #134

Earlier quoted context omitted.

Just to be blunt, here are wrong answers: 1. make the root password unguessable and change it often 2. background check employees 3. audit trusted vendor's security procedures 4. install sprinklers (!) 5. jam all USB ports with glue 6. train CEO on laptop security protocol

> install sprinklers (!) Sure you install sprinklers in a data center to sprinkle water on servers and other electric devices in a context where there might or might not be broken or other wise un-isolated wires due to the fire... What you can use instead is to flood the room with CO2 to suffocate the fire. The problem with that is that it's also deadly to humans. Still e.g. for rooms with long term data storage it's…

Installing sprinklers in the datacenter is probably a bad idea. But around it it may pay off, the fire may originate outside the datacenter. Inside the datacenter it’s be great to have some phisical separation so not all is lost in case of a fire and an extinguisher or whatnot can be used on the burning component without effecting the whole system. Also installing heat sensors and monitoring those may prevent a disaster. Installing partitions or building separated server rooms could also help.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#175

Post by hugh-avherald » Mon, Feb 15, 2021, 1:22 PM UTC

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

This is not really a helpful mnemonic -- security breaches are adversarial. Boeing airliners are not designed to keep flying to the intended destination if the cockpit is breached by hijackers.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#176

Post by joncrane » Mon, Feb 15, 2021, 1:28 PM UTC

nimbius wrote: post #30

jjcm wrote: post #6

Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I'm missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack. [1] https://en.wi…

Absolutely agree. Solarwinds focuses a disproportionate amount of effort in ensuring it shows up favorably in Gartner magazine reviews and trade publications. As a monitoring platform its a monolithic, expensive, slow and rather dated monitoring solution. Agile does not come to mind, and you certainly wouldnt use it for anything approaching "observability." But the concerted marketing effort pays dividends. Solarwind…

They release earnings for Q3 2020 on Feb 25th. The hack was announced Dec 12th so it will be difficult to gauge how many orders they lost as a result.

On April 28th 2021 they will announce Q1 2020 results. THAT's when we'll know for sure how bad this hurt them.

They may release less than sanguine guidance on Feb 25th, we'll see.

The reason why I know this stuff I will leave as an exercise to the reader. :)

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#177

Post by eternalban » Mon, Feb 15, 2021, 1:32 PM UTC

WalterBright wrote: post #143

waihtis wrote: post #140

Earlier quoted context omitted.

Youre suggesting detection is only possible much after the fact, when it is possible to also do before an adversary has been able to achieve anything significant on the target. But credit where credit is due, detection is not the answer but rather early detection. Sprinklers comment was made in jest.

I bought a book some years back about how to defeat burglar alarm systems, as I wanted to make my home more resistant to burglars. The book described a sophisticated system that would detect burglar entry and then automatically phone the cops. The defeat was to chop the phone line where it entered the house, because the telephone company puts their box on the exterior of the house. (The book was printed before cell p…

We deal with imperfect information all the time when building complex software systems.

Let's talk dead node detection, for example, and consensus. "Perfect detection" is impossible due to possible network partition, yet we can build reliable distributed systems on top of that imperfect reality, even in face of malicious nodes (B-F/T). We do this via redundancies; mutli-step 'actualization' of system changes (e.g. transactions); and the ability to revert to a known stable state.

Based on that analog, I think it reasonable to strive for security regime approaches that permit for security failures at component levels. The computational and bandwidth loads may be excessive (ATM) but ultimately there will be systems observing systems and a type of 'security consensus or quorum' theoretical work informing how to build such systems.

There is a thin layer of semantics that overlays the generalized and irreducible state transition due to input: one instance is preventing inconsistent action on data; the other is preventing insecure action on systems.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#178

Post by javajosh » Mon, Feb 15, 2021, 1:39 PM UTC

WalterBright wrote: post #112

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

Some questions a security professional should ask: 1. What happens when the root password is guessed by a malicious person? 2. What happens when a trusted employee is really an enemy agent? 3. What happens when we download and install a malicious update from a trusted vendor? 4. What happens when the server room burns down? 5. What happens when a malicious USB stick is plugged into our secure network? 6. What happens…

The name for this is "threat model".

https://en.wikipedia.org/wiki/Threat_model

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#179

Post by Person5478 » Mon, Feb 15, 2021, 1:41 PM UTC

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

> I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure. Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?"

And this is the fundamental difference between erlang/OTP and basically everything else, and it's no accident that erlang systems are known for their stability.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#180

Post by mindcrime » Mon, Feb 15, 2021, 1:50 PM UTC

WalterBright wrote: post #134

WalterBright wrote: post #112

Earlier quoted context omitted.

Some questions a security professional should ask: 1. What happens when the root password is guessed by a malicious person? 2. What happens when a trusted employee is really an enemy agent? 3. What happens when we download and install a malicious update from a trusted vendor? 4. What happens when the server room burns down? 5. What happens when a malicious USB stick is plugged into our secure network? 6. What happens…

Just to be blunt, here are wrong answers: 1. make the root password unguessable and change it often 2. background check employees 3. audit trusted vendor's security procedures 4. install sprinklers (!) 5. jam all USB ports with glue 6. train CEO on laptop security protocol

4. install sprinklers (!)

Yes, water based sprinklers are not the best choice for inside the server-room proper. But that doesn't mean you can't have other automated fire suppression systems. In the days of yore Halon systems were mostly used for this particular application. Halon has some issues though and has mostly been banned / replaced with cleaner alternatives. These days you see things like FM-200 used for fire suppression in these kinds of applications.

All of that said, speaking as a former firefighter, I'd take a water based sprinkler over nothing, even in that setting. Why? Because at the end of the day, human life is more valuable than a data-center full of computers and data, and if stopping a fire early saves even one life, but ruins a room full of computers, that's an acceptable tradeoff. And of course sprinklers are absolutely invaluable outside of the server-room. I don't have all the numbers memorized now, but to summarize in a succinct form, "sprinklers are wildly effective at preventing incipient stage fires from growing large, and at saving lives and property."

And as @WalterBright continues to say below - you are storing backups off-site, right? And you have a DR data-center on another continent that can be spun up in a matter of minutes by toggling a load-balancer or DNS setting somewhere, right?