Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US companies hit by 'colossal' cyber-attack

bbc.com

Post reply on HN
Print view View original

31–40 of 514 posts

Re: US companies hit by 'colossal' cyber-attack

#31

Post by nmstoker »

colonelanguz wrote: post #19
yashap wrote: post #17

Earlier quoted context omitted.

Agreed. Companies that are great at selling to governments and massive enterprises tend to be great at security theatre and security certifications, but that’s not the same as being great at security. Their tech tends to be bloated spaghetti full of tech debt, with a huge surface area for attacks, and systems like that are nearly impossible to secure in a truly robust way. Embedding this kind of software deep in your…

Would you mind briefly explaining the concept of "tech debt" to a layperson?

I presume you were not trying to be ironic with this request (given how you chose the easy option of inconveniencing others rather than Google/Wikipedia)

Anyway, here's a good introduction: https://en.m.wikipedia.org/wiki/Technical_debt

Re: US companies hit by 'colossal' cyber-attack

#32

Post by yashap »

colonelanguz wrote: post #19
yashap wrote: post #17

Earlier quoted context omitted.

Agreed. Companies that are great at selling to governments and massive enterprises tend to be great at security theatre and security certifications, but that’s not the same as being great at security. Their tech tends to be bloated spaghetti full of tech debt, with a huge surface area for attacks, and systems like that are nearly impossible to secure in a truly robust way. Embedding this kind of software deep in your…

Would you mind briefly explaining the concept of "tech debt" to a layperson?

It’s a pretty broad term, but I’d define it as properties of a software system that make it hard to modify/maintain safely and easily. And it’s fixable, but takes an investment of time/effort/money to fix. The debt metaphor is that it can make sense to have a bit of this, but too much becomes crippling.

Often the most maintainable solution is simple and elegant, but it takes a lot of refactoring to implement, so a hacky, complex solution is implemented instead, because it’s faster/easier to implement. Such solutions tend to either contain bugs, or lead to bugs when built upon, and a lot of security vulnerabilities are basically bugs in hairy parts of systems that are hard to understand.

Re: US companies hit by 'colossal' cyber-attack

#34

Post by aj3 »

jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

SolarWinds affected 100% of installations that updated their deployments during that 8 month window. Your 1% comes from the ratio of networks that were specifically targeted and received 2nd stage with all the goodies.

The reason why 2nd stage was only given to (relatively) small number of organizations - because the attack wasn’t ransomware, attackers didn’t have economical motives (in fact they were spooks on a government payroll).

EDIT: I can’t spell

Re: US companies hit by 'colossal' cyber-attack

#35

Post by daniellarusso »

hn_throwaway_99 wrote: post #14

Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture. I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the ca…

I used to work for an MSP and we had used Kaseya.

There was an AV integration, and then Kaseya changed to Kaspersky. I don’t remember what the prior AV software was.

I always thought it bizarre we were actively installing AV software from Russia on banking and medical office PCs.

Re: US companies hit by 'colossal' cyber-attack

#36

Post by daniellarusso »

SV_BubbleTime wrote: post #21
hn_throwaway_99 wrote: post #14

Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture. I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the ca…

I specifically have experience with Kaseya. I kicked and screamed to get us off of it, the IT people insisted it was top notch. So when I became CFO I fired them (outside company), not just for this, but it didn’t help. It’s bad software. 24/7 full low level access is exactly what it is. We had an add on that stored admin credentials in a JSON… so looking back on that, it seems this should have happened sooner.

The craziest part to me was their pushing of the vPro integrations.

Re: US companies hit by 'colossal' cyber-attack

#37

Post by aj3 »

gonesilent wrote: post #12
jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

Didn't it only affect those who were unpatched hence the low percent? Current hack is 0-day.

Solarwinds was distributed by a malicious patch (through legit channels). So all orgs were unpatched and in fact all got at least first stage downloaded (if they patched during that window).

Re: US companies hit by 'colossal' cyber-attack

#38

Post by adventured »

aaron695 wrote: post #33

Theory: REvil is someone DARPA sent from the future to stop future cyber wars. Here's a list of popular Ransomware onions, REvils is called "Happy Blog" https://www.kiledjian.com/main/2021/3/4/popular-ransomware-d...

It's all just one person stuck in a loop. Predestination.

Re: US companies hit by 'colossal' cyber-attack

#39

Post by aj3 »

aborsy wrote: post #30

I wonder if institutions in other countries and regions, eg, Europe, are also frequently compromised, but we don’t even hear about that. The same sort of software is used by all governments and corporations.

Yes they do get compromised and the information is published regularly. E.g. here is a news item from just this week: https://www.reuters.com/technology/denmarks-central-bank-exp...

Re: US companies hit by 'colossal' cyber-attack

#40

Post by cced »

hn_throwaway_99 wrote: post #14

Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture. I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the ca…

I know we're still pretty close to the Ubiquiti breach, but since then, they've added 2FA.

Is your opinion of their products the same?

Post reply on HN