Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

reuters.com

Post reply on HN
Print view View original

261–270 of 294 posts

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#261

Post by buran77 »

bootsup wrote: post #254
buran77 wrote: post #183

Earlier quoted context omitted.

An aircraft carrier also has the benefit of being operated under a vastly different framework than a regular IT system: military vs. civilian. This means any inconvenience of using the system only matters if it leads to clear operational risks. But I've seen plenty of companies implementing solid (real) security measures only to see employees looking to bypass them themselves due to the inconvenience they caused, thu…

Last I was paying attention, all the legacy aircraft carriers hadn't been upgraded from windows xp, and had no upgrade path. That's only one of the platform's many vulnerabilities. Their purpose seems to have more to do with capital extraction than warfighting.

I was mostly thinking of the physical design of the ships (and their operation) as brought up by OP and GP. But even when it comes to IT, I can understand having a hard time fully validating a new OS on those ships. And still they take much better measures for securing those carriers overall than your average supermarket with XP cash registers.

The point, as I said below, is that the framework under which the military operate does a far better job at forcing the people to more consistently adhere to stricter rules. Which means under similar circumstances there's a good chance the military can keep a system safer than most companies.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#262

Post by lake_vincent »

grifball wrote: post #247
munchbunny wrote: post #238

Earlier quoted context omitted.

Speaking as a security professional, this viewpoint already exists in software in various concepts like "defense in depth" and "zero-trust networking". > It seems pretty well established that making secure software is impossible. Time to pivot to designing software systems that are tolerant of inevitable security breaches. This is the nature of "zero-touch networking". More generally, we talk about "security boundari…

Seems that a lot of these attacks (except for this one) are just simple social engineering: an employee is phished to get into the company VPN, and from there, it's maybe a couple more simple exploits on systems that were never meant to be exposed and then it's over. You can compartmentalize employees but it's harder to do than compartmentalizing software I think.

This 1000%

WE are the weakest link! The most technically secure system would be nearly unusable by humans without enormous inconvenience. So long as software systems are built by humans, for humans, they will always be vulnerable at the interface.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#263

Post by jiveturkey »

dogman144 wrote: post #231
WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

Yeah I mean this is called Zero Trust Architecture/defense in depth, and it's a popular thing. The budget and architecture changes are not popular, though. I partially blame this the security community as well (of which I'm a part of). The common tendency to think exclusively in risk controls and absolutist statements on secure vs. insecure means the incremental improvements needed to hit eventual ZTA are difficult t…

> In short, security teams suck at intra-company sales sometimes.

I've been at this a long time. My POV is that this is true, but doesn't matter. The leadership almost never actually cares about security. It's the correct choice for most orgs. https://hbr.org/2015/03/why-data-breaches-dont-hurt-stock-pr...

Even the most impacted companies only take a hit in the medium term (1 yr) at best. https://investorplace.com/2019/03/equifax-stock-investors-ar... Right after that article, the stock took off and is still doing well.

Leadership is sophisticated these days. They aren't ignoring security due to lack of salesmanship from their security team.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#264

Post by unishark »

jjk166 wrote: post #218
unishark wrote: post #135

Earlier quoted context omitted.

> That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. I think this is the point. Software is about operating at the top level predominantly, packaging together stuff other people wrote using only simplified API's which abstract away their internal complexity. So you ca…

> Engineering is about starting from physical principles and building a product that fits the understanding of those fundamental principles at work. The engineer generally stays with a set of fundamental domain principles their entire career (e.g. sticks with bridges as opposed to transmission lines) while programmers tend to stay at the top layers while the technologies below the surface change radically. That's not…

Your field may look vast to you but from where I'm sitting I couldn't even tell you what is different about the principles needed for tv mounts versus helicopter flexbeams. Both sound like statics class to me, presumably decades after you took it, still being used in your work. Fine the bridge guy may be able to build other structures. Though I suspect it will get increasingly difficult for them to get past the job interviews as they stray from their narrow domain. Meanwhile a software person who knows databases can create a database for practically any kind of organization in existence.

I didn't say build things from scratch, I said use fundamental principles. Your solenoid operates directly on your fluids or whatever and you presumably need to be able to understand how. Is it not possible to choose incorrectly without having the right expertise?

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#265

Post by mike_d »

samstave wrote: post #224
frombody wrote: post #49

Earlier quoted context omitted.

Suggesting stuxnet's goal wasn't stealth is silly. It was so sophisticated at not being detected that it went under everyone's radar for 5+ years. Stuxnet behaved in exactly the same way.. neither did anything that would be detectable unless certain criteria was met and a secondary payload sent.

I would say that the sophistication of the Solarwinds breach is in the success of its scale, as opposed to the methods with which it used to successfully reached such scale. Stuxnet was very sophisticated to hit a relatively narrow target by comparison. So I think they are both sophisticated, but not comparing them directly.

Stuxnet infected close to 200,000 machines, over half in Iran, before being detected. It was so extremely stealthy and well designed that it could spread widely and avoid detection while making its way to the intended targets.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#266

Post by KineticLensman »

buran77 wrote: post #259
KineticLensman wrote: post #201

Earlier quoted context omitted.

> military vs. civilian. This means any inconvenience of using the system only matters if it leads to clear operational risks. The military are not immune to this either. Case study, the 2006 Nimrod crash in Afghanistan [0], which killed all 14 of its crew. This plane was the flying equivalent of an unsecured server whose root password was 'password'. [0] https://en.wikipedia.org/wiki/2006_Royal_Air_Force_Nimrod_cr..…

Nobody is "immune" to mistakes but the framework under which the military operates raises the bar for any kind of attack or mistake simply by forcing the personnel to more consistently adhere to stricter rules regardless of the sector (in front of a keyboard or a trigger). And coming back to the particular Nimrod crash, the findings of the inquiry suggest a chain of issues slightly more complex than your analogy sugg…

> the findings of the inquiry suggest a chain of issues slightly more complex than your analogy suggests

I agree that my analogy is an oversimplification. But I think my point stands - the plane had a massive set of issues that were tolerated because up to that point the operators had got away with it by sheer luck - there hadn't been an operational disaster, just a mass of technical and maintenance issues over the years.

In this case, the flight crew as military personnel were acting at a high standard but were fatally let down by the wider organisation that allowed them to fly. The military owned safety case was fundamentally flawed and evidence that suggested otherwise had been actively suppressed, as revealed by the Haddon Cave enquiry which found fault with a range of military and contractor organisations and individuals.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#267

Post by PoignardAzur »

grifball wrote: post #247
munchbunny wrote: post #238

Earlier quoted context omitted.

Speaking as a security professional, this viewpoint already exists in software in various concepts like "defense in depth" and "zero-trust networking". > It seems pretty well established that making secure software is impossible. Time to pivot to designing software systems that are tolerant of inevitable security breaches. This is the nature of "zero-touch networking". More generally, we talk about "security boundari…

Seems that a lot of these attacks (except for this one) are just simple social engineering: an employee is phished to get into the company VPN, and from there, it's maybe a couple more simple exploits on systems that were never meant to be exposed and then it's over. You can compartmentalize employees but it's harder to do than compartmentalizing software I think.

I think that's part of what security people mean by "zero-trust security".

Instead of building a giant moat and assuming that everyone who got past the moat is trusted, assume that everyone is untrusted by default, and build a capability system that's expressive enough that you can give everyone just enough capabilities that they can do their job without going through a bunch of pointless checks.

In practice that model is impopular because corporations tend to screw up the later part.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#268

Post by jjk166 »

unishark wrote: post #264
jjk166 wrote: post #218

Earlier quoted context omitted.

> Engineering is about starting from physical principles and building a product that fits the understanding of those fundamental principles at work. The engineer generally stays with a set of fundamental domain principles their entire career (e.g. sticks with bridges as opposed to transmission lines) while programmers tend to stay at the top layers while the technologies below the surface change radically. That's not…

Your field may look vast to you but from where I'm sitting I couldn't even tell you what is different about the principles needed for tv mounts versus helicopter flexbeams. Both sound like statics class to me, presumably decades after you took it, still being used in your work. Fine the bridge guy may be able to build other structures. Though I suspect it will get increasingly difficult for them to get past the job i…

So when you don't know the difference between two things you assume there is no difference and not only disregard those better informed than you who claim otherwise, but try to tell them how simple their profession is?

Neither the tv mounts nor the testing machine were remotely close to statics class. For the seismic TV mounts, I had to make an economical laser cut sheet metal assembly which could be assembled in a field and still survive earthquakes. For the flexbeam tester, I had to design a machine that could survive millions of cycles while placed in an oven at high temperature to simulate the effects of 3 years of flight time in less than 1 year. To say it was just statics would be like saying software is just assigning variables.

Conversely, if you are a database person, that is an incredibly narrow skillset. Creating a database isn't a profession, it's not even a job, it's just a task. Yes a database guy can create a database for practically any kind of organization, and the structures guy can analyze a truss for any kind of organization. But the engineer who can only analyze trusses is fired.

Yes, an engineer must understand fundamental principles, but that is true of any profession. How can you set up a database without knowing the fundamentals of how a database works? How could an accountant manage money without knowing the fundamentals of transactions? How could a ditch digger dig a ditch if they don't understand the fundamentals of a shovel? Any job that requires no understanding whatsoever was automated away long ago. That said, most professions, engineers included, can treat many of these things as black boxes during day to day life. I don't know how any given solenoid valve is implemented, and I don't generally care beyond it being rated for my use case. Of course this can lead to problems - I once designed a big machine for scanning cars and the power cables wrapped around it made it act like a giant antennna interfering with the data cables to the cameras - that took a while to debug.

The world is a fascinating place, you would do well to learn about it instead of resting on assumptions.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#269

Post by WalterBright »

mindcrime wrote: post #180
WalterBright wrote: post #134

Earlier quoted context omitted.

Just to be blunt, here are wrong answers: 1. make the root password unguessable and change it often 2. background check employees 3. audit trusted vendor's security procedures 4. install sprinklers (!) 5. jam all USB ports with glue 6. train CEO on laptop security protocol

4. install sprinklers (!) Yes, water based sprinklers are not the best choice for inside the server-room proper. But that doesn't mean you can't have other automated fire suppression systems. In the days of yore Halon systems were mostly used for this particular application. Halon has some issues though and has mostly been banned / replaced with cleaner alternatives. These days you see things like FM-200 used for fir…

I totally am sold on fire sprinklers. They're installed in my house. Yeah, they'll wreck the room they come on in, but will save the rest of the house. I also read that, in the US, nobody ever died from fire in a building where there were sprinklers that were not disabled.

Even counting 9-11, as the plane crash cut the water pipes.

But still, relying on sprinklers to save your IT business is a bad idea. Offsite backups are needed.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#270

Post by WalterBright »

mindcrime wrote: post #184
tartoran wrote: post #174

Earlier quoted context omitted.

Installing sprinklers in the datacenter is probably a bad idea. But around it it may pay off, the fire may originate outside the datacenter. Inside the datacenter it’s be great to have some phisical separation so not all is lost in case of a fire and an extinguisher or whatnot can be used on the burning component without effecting the whole system. Also installing heat sensors and monitoring those may prevent a disas…

Yes, from a fire safety standpoint, more partitions in the building are generally a good thing, especially when they consist of actual rated fire-resistant firewalls (physical firewalls not the "iptables" kind). It's amazing just how effective a firewall can be. I've been to structure fires before where you can basically say in the aftermath "everything on the 'fire' side of the firewall is rubble now, and everything…

Keep a fire axe under the bed to create a new doorway as necessary :-)
Post reply on HN