Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Story of the SolarWinds Hack

npr.org

Post reply on HN
Print view View original

101–110 of 139 posts

Re: The Story of the SolarWinds Hack

#101

Post by Godel_unicode »

wglb wrote: post #91
Veserv wrote: post #66

Earlier quoted context omitted.

First, you do not need to be the Russian intelligence services to pull off this attack. Given prevailing trends in the vulnerabilities market this sort of attack would cost at most $1M to pull of which puts it within the capabilities of maybe ~50,000,000 individuals worldwide let alone organizations. If the SVR is anything like the CIA they are probably running at least 1,000 programs of similar scale simultaneously,…

I'm not convinced about the arguments of cost. There are a whole lot of presumptions in that chain of reasoning. The initial vector seems to not require any high-prices vulnerabilities, but simple authorization by pass, e.g., bypassing 2FA. Which could well have been a root account. From there, get the keys that Duo depends on, then you own the whole thing. I have always argued that doing what I call "defense by pres…

If you want to see the difference between just throwing money at the problem and an actual tier 1 threat, compare this with the Chinese iPhone 0day from fall of 2019. Probably a multimillion dollar exploit, with terrible quality and no opsec on the c2 side . Just spending money doesn't get you the kind of expertise that's needed to pull off something like this.

It's a bit like arguing Bill Gates is a serious threat to any naval power because he can afford to buy a nuclear attack sub; there's more to it than that.

Re: The Story of the SolarWinds Hack

#102

Post by comboy »

kevinsundar wrote: post #92
comboy wrote: post #72

Earlier quoted context omitted.

I was just playing with Grafana a few days ago, their cloud version. When you install agent, it opens up ports with unprotected metrics on a public IP. Opens up ports on your production without info about it whatsoever, because it is in theory a push agent. Why would you do that? Support response: "Regarding your second message about port 12345 on the Grafana Agent -- the HTTP server only exposes the Agent's internal…

Not sure what your comment about docker containers is trying to say. In docker you need to specify port mappings before ports are exposed outside the container, so this wouldn't happen without you explicitly knowing. Containers are by default untrusted and access to network and filesystem is mediated. In fact, if you linked to a docker container I'd have less qualms running than a binary.

Yes, you have and that is reasonable. It is assumed that it is safely contained environment that cannot maliciously affect your host system. Yet every virtualization and container solution we've seen so far had been exploited.

"But is there a vulnerability at the moment that can be exploited?" "None that we know of"

Containers also often get generous access rights and internet access, even assuming container solution being intact.

Security of the system inside is a whole big surface of attack that you have little control of (unless you meticulously analyze each docker full fucking system image every time you run them), and necessarily affects your systems because otherwise you would have no use for this container.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=docker

Re: The Story of the SolarWinds Hack

#103

Post by bane »

I think the most important thing the SolarWinds hack has revealed is that the massive pile of paperwork that has to be filled out, full of security controls, to accredit system for government systems, is fairly useless. It's the digital equivalent of the Great Wall of China. Designed by bureaucrats, impressive in size, a massive effort, and ultimately not going to stop the Mongols anyways. Security paperwork is not security.

More important I think is that the months and months it takes to usher things through the process forces things to be out of date which in itself creates security problems.

An actual audit of the source code + running it in an instrumented live test environment to capture behavior is far better.

Re: The Story of the SolarWinds Hack

#104

Post by georgiecasey »

vzaliva wrote: post #99

I am curious about "compiler" attack they are mentioning. Looks like they compromized compiler used to build the code. Any more technical info on this aspect?

I think they compromised Teamcity, or at least I've heard a lot of mentions of Teamcity related to this hack, I could be completely wrong. But it's possible they just got admin access to the Teamcity build server and added their code just before the build was deployed. So not really compromising the compiler per se

Re: The Story of the SolarWinds Hack

#105

Post by thyrsus »

dmcgee wrote: post #80

This is the line that got me: >And so we are fairly broadly deployed software and where we enjoy administrative privileges in customer environments. There is a lot of talk about shoring up security practices by many of the people quoted here. But something that would be hard to admit is that maybe they should not have administrative privileges in customer environments. Maybe they should not install agents on your mac…

I don't like the Solarwinds Linux agent. When I last looked, there was still an sh syntax error in the cron job it installed (look for a file named 1 in your root directory) and I couldn't reach anyone who could understand my bug report. It also frequently exhausted the space in its log partition. I replaced the agent with SNMP 3 read only access. I don't believe I'm authorized to describe my employer's current monitoring posture.

Re: The Story of the SolarWinds Hack

#106

Post by thyrsus »

askl56 wrote: post #71
encryptluks2 wrote: post #70

Earlier quoted context omitted.

The SolarWinds hack in addition to election interference should easily be seen as an attack worthy of taking out Putin IMO.

Yes, let's assassinate a world leader of the country with the most nukes in the world based on unfounded claims of election interference and a hack. Do you have any idea what America did in Russia in the immediate aftermath of the fall of the Soviet Union? The 1996 election in Russia which was majorly "interfered" with by Clinton: https://archive.is/R7i5u , not to mention the fact that most Russian hacking activities…

I agree completely that assasination, beyond moral abhorrence, would work out as well as most U.S. foreign policy - horrifically. The last foreign policy success I'm aware of was the Marshall plan.

I think it's a mistake to minimize Russian influence, when it suffices to compare the unmitigated disaster of U.S. actions - both government and private sector, and at enormous scale - in post-Soviet Russia.

Re: The Story of the SolarWinds Hack

#107

Post by thyrsus »

tkinom wrote: post #57
makomk wrote: post #24

Earlier quoted context omitted.

Like, say, that backdoor someone wrote an article about recently which ran from RAM and had a sophisticated self-destruct mechanism that erased all traces if anyone tried to dump its memory? I wonder how many companies had exploits like that which they either didn't notice or didn't have the sophistication to actually catch and dump.

There are defences for this: If one controls/monitors for every app in system for network access, as soon as any unusually network access are triggered, it is investigated and block. In my home windows setup, only windows defender, firefox and chrome are allowed out going internet access in regular base. Everything else are blocked. Windows update are only allowed when I in the mood for it (~once a year). Anyone can…

I think you mean "blocked, then investigated", which it sounds like you're doing. A company running a large variety of software - particularly third party - needs to have staffing sufficient to such investigations.

Re: The Story of the SolarWinds Hack

#108

Post by takeda »

kevinsundar wrote: post #92
comboy wrote: post #72

Earlier quoted context omitted.

I was just playing with Grafana a few days ago, their cloud version. When you install agent, it opens up ports with unprotected metrics on a public IP. Opens up ports on your production without info about it whatsoever, because it is in theory a push agent. Why would you do that? Support response: "Regarding your second message about port 12345 on the Grafana Agent -- the HTTP server only exposes the Agent's internal…

Not sure what your comment about docker containers is trying to say. In docker you need to specify port mappings before ports are exposed outside the container, so this wouldn't happen without you explicitly knowing. Containers are by default untrusted and access to network and filesystem is mediated. In fact, if you linked to a docker container I'd have less qualms running than a binary.

The filesystem is restricted, but network generally not. You can have a malicious container connect to rest of your network. The ports don't need to be open either, it can phone home (like how most bots do).

Certain data centers restrict access to outside network (i.e. Internet), with now popular public cloud. It's actually hard to place such restriction, because majority tooling, including official images are expecting to be connected outside.

Re: The Story of the SolarWinds Hack

#109

Post by takeda »

sudosysgen wrote: post #81
grosswait wrote: post #78

Earlier quoted context omitted.

Your cited article is interesting but does not support your assertion of major interference IMO. Policy maneuvers for political purposes are the norm for all countries right or wrong.

Really? A government saying that they would ensure no "negative stories would come out", literally puppetting international institutions to pay out money - billions - for an election campaign, sent US Government agents to be embedded into the Yeltsin campaign right as he was violating every law on the books and calling in favours from the mafia and oligarchs, and very likely also used intelligence agencies to help, a…

I have a family member affected by those "targeted ads" and can tell you this is hardly comparable to news agencies writing favorably or not about someone. Some people are seriously fucked up because of this. Just look what happened on January 6th.

Re: The Story of the SolarWinds Hack

#110

Post by asperous »

bane wrote: post #103

I think the most important thing the SolarWinds hack has revealed is that the massive pile of paperwork that has to be filled out, full of security controls, to accredit system for government systems, is fairly useless. It's the digital equivalent of the Great Wall of China. Designed by bureaucrats, impressive in size, a massive effort, and ultimately not going to stop the Mongols anyways. Security paperwork is not s…

They didn’t prevent this specific hack so they are completely useless?
Post reply on HN