“NASDAQ is owned.” Five men charged in largest financial hack ever • Hacker News Board

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#131

Post by jokoon » Fri, Jul 26, 2013, 9:36 AM UTC

anigbrowl wrote: post #20

jokoon wrote: post #13

Earlier quoted context omitted.

There are still too many computer illiterate people, it's a matter of how people view things. Blaming the existing systems instead of blaming the hackers, it's like being an astronomer in the middle age. Deciders and business owners will scream and tell their systems are fine, and that the ones who think differently and prove otherwise are at fault.

No it isn't. These people weren't publishing white papers about the lack of security at Nasdaq and other companies, they were using their knowledge to steal money, and the costs were passed back to you, the (presumably) law-abiding customer/credit card user. Suppose you went out and came home to find your window smashed and your most valuable possessions gone. Would you be happy to have received an unscheduled visit…

If those people were not "publishing white papers", maybe it's because computer security sucks everywhere, maybe because there is no true incentive to make things better at all.

I was answering to the question "why were those guys using their skills for criminal activity instead of working on protecting against those crimes ?".

The thing is, I doubt company deciders really care about real computer security at all, and even if they do, the security market is very slim. OSes are not really designed with security first in mind, while they should be the first ones to do research on it, and apply it steadily.

I can find many reasons why the computer security market is still weak: there are not that many crimes because we don't use computers for many important things (even if it's on the rise), intelligence agencies prefer to let those vulnerabilities in place so they can have the upper hand to investigate or spy other countries (not talking about PRISM), and programmers are still a rare supply, and I don't really see any open discussion in university about computer security theory, it's mostly black hats/white hats folks, it's not really productive.

If those guys committed those crimes, either they are not good enough, but that also means nasdaq systems were weak, or that they were actually good enough, but the computer security job market did not propose them enough money, which is why they risked 20 year prison sentences, because it paid more.

You could compare it with the drug market. Right now those substances are illegal, which allows criminals to make huge amounts of money, but the DEA people will also make money, and are often found to work with criminals. That's an example why most of the time, crime pays, while it would be wiser to make those substance legal, and try to help drug users instead. For computer security, it could be a good idea to stimulate the security market by asking universities to create degrees, and maybe make some government programs to work on computer security, instead of letting it rot like that.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#132

Post by phlo » Fri, Jul 26, 2013, 9:42 AM UTC

jingo wrote: post #113

meowface wrote: post #106

Earlier quoted context omitted.

Generally, the DBAs have very little role in knowing whether any part of their application is vulnerable to SQL injection, and on top of that they can't mitigate very well against it. They can do the basic things: don't use the root MySQL user, restrict privileges on each MySQL user, use AppArmor or SELinux to isolate the mysqld process, etc. This does prevent an attacker, in most cases, from instantly uploading a sh…

Question: Can/do they do "fuzzing" on their database applications? Has anyone built a fuzzer for this purpose that tries an assortment of possible vectors as well as random strings? I still do not understand why the injection vectors cannot be preempted to begin with. It seems to me as if the folks securing the database are unable to predict possible ways someone could exploit what their application considers "valid"…

You're attacking the problem from the wrong angle. The fault lies with whomever builds the application /interfacing/ with the DB, not whomever manages the database.

In an application you may need to read user-selected data from some sort of database. As a simple example, you might accept a user's input of an article ID to fetch said article from a db. That might look something like this:

"SELECT * FROM articles WHERE id = $article_id"

Where $article_id is the input you received from your user. A valid $article_id could for example be "7", an invalid one might be "7 OR 1=1". If the latter value is not escaped, it'd change the statement to read "SELECT * FROM articles WHERE id = 7 OR 1=1, returning all articles.

Any somewhat competent programmer would then check if $article_id contains a value of the expected type (i.e. integer, string, string that looks like an email address, ...) and use an escaping function (in PHP this might be mysql_real_escape_string) to escape any special characters (e.g. turn " into \").

If you're doing things right, you'll use a prepared statement. You'll tell your database driver the format of your query first ("SELECT * FROM articles where id = ?"), then provide the contents for your placeholders (? -> $article_id).

Prepared statements are considered more elegant and comfortable to work with; both approaches are secure when done correctly.

All of this is done by the application developer. Now the DBA only gets to work with the assembled query. How would they be able to tell a valid "OR 1=1" from an injected one?

Nonetheless, your point on holding the responsible party accountable stands -- but it's the developers, not the DBAs.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#133

Post by k_bx » Fri, Jul 26, 2013, 12:51 PM UTC

sirsar wrote: post #21

k_bx wrote: post #5

> SQL-injection > NASDAQ

Sanitizing your inputs is apparently even harder than salting and hashing your passwords, something even the big-name companies tend to mess up. Sigh.

You don't even need to sanitize them, actually.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#134

Post by riskable » Fri, Jul 26, 2013, 12:52 PM UTC

mcphilip wrote: post #60

kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

Some services that scan the assets on a network for a wide range of vulnerabilities: QualysGuard, Nexpose, McAfee EPO. There is a market there among Fortune 500 companies, for sure. The difficulties (as I've experienced it) are: 1. Companies want some omni tool that scans vulnerabilities, manages tickets, enforces policies, tests controls, etc and feeds all the data into a single database that they can run reports on…

The bigger the network the more likely something like a simple vulnerability scan will take something down. For this reason many organizations don't allow blanket scans to take place which is a shame because if the scan itself is capable of taking down an important system on your network then clearly you have a huge vulnerability!

I remember when I was working as a security consultant doing a "safe" Nessus scan of a relatively small organization that happened to have a mainframe. The mere act of scanning the ports on the mainframe caused it to crash. The whole thing had to be rebooted and it took HOURS. Essentially, a whole day of work was lost.

When we met with the CSO to talk about it he was both happy and sad: Happy that we discovered such a huge vulnerability and sad that he was going to have to explain to his superiors that an action that he undertook (hiring security consultants to perform a scan) cost the business a lot of money.

I later found out that he was fired because of the incident.

That right there explains a lot about the state of IT security in business right now.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#135

Post by riskable » Fri, Jul 26, 2013, 12:56 PM UTC

adamlj wrote: post #62

kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

The real problem here is that this is extremely asymmetric. All the bad guys need to do is to find a single mistake from an employee, subcontractor, vendor etc.

I wish more people would get this through their heads. The secretary opening a zero-day PDF is usually all it takes for an entire organization to be owned! Especially organizations with Active Directory and Windows workstations. Here's why:

* Secretary's workstation gets owned via zero day. * Attacker installs keylogger. * Attacker "breaks" the workstation's join to the domain. * Domain admin shows up to re-join the workstation to the domain (to "fix it").

Now the attacker has the credentials necessary to manage all of AD and give themselves rights to whatever they want. Also, since AD doesn't use a salt with password hashes the attacker can now trivially obtain the passwords of every employee in the company along with things like service accounts. It's game over at that point--rebuild everything time.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#136

Post by guiomie » Fri, Jul 26, 2013, 1:20 PM UTC

AsymetricCom wrote: post #31

Doesn't NASDAQ have some responsibility for this hack? Doesn't NASDAQ have serious security reputation issues now?

Reputation ? The same company who's one of its chairman ran the biggest known ponzi scheme in recent financial times.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#137

Post by larrys » Fri, Jul 26, 2013, 2:32 PM UTC

janzer wrote: post #117

tptacek wrote: post #90

Earlier quoted context omitted.

I think starting a security consultancy is a business idea that just might work.

I admit by the time I made it through this comment thread, I wasn't quite laughing out loud, but I was having a good chuckle.

When I was maybe 5 years old I asked my parents why they couldn't just cut cancer out? Everybody is a newbie at one point.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#138

Post by jingo » Fri, Jul 26, 2013, 3:11 PM UTC

phlo wrote: post #132

jingo wrote: post #113

Earlier quoted context omitted.

Question: Can/do they do "fuzzing" on their database applications? Has anyone built a fuzzer for this purpose that tries an assortment of possible vectors as well as random strings? I still do not understand why the injection vectors cannot be preempted to begin with. It seems to me as if the folks securing the database are unable to predict possible ways someone could exploit what their application considers "valid"…

You're attacking the problem from the wrong angle. The fault lies with whomever builds the application /interfacing/ with the DB, not whomever manages the database. In an application you may need to read user-selected data from some sort of database. As a simple example, you might accept a user's input of an article ID to fetch said article from a db. That might look something like this: "SELECT * FROM articles WHERE…

Thank you. This is the answer I was looking for.

I assumed (incorrectly) that the person designing the database was also involved in selecting the "prepared statements" or "assembled queries", or was the same person.

Now I'm thinking the problem may be more with the people building the interfaces to these SQL databases, and the languages they are using to build them.

If that's true, then "SQL injection" seems like less of an SQL-specific problem and more of popular label for a more general "santization of user input" in internet-facing programs problem. That problem is as old as the web. And now we encourage every program to be a web-facing application, hosted in "the cloud". Yikes.

Anyway, I think my original comment may indeed be valid: in 200xx, in too many cases, programmer knowledge of escaping and quoting (rules that if I'm not mistaken originated when more people were more familiar with terminals and shells) is inadequate.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#139

Post by imissmyjuno » Sat, Jul 27, 2013, 7:18 AM UTC

2pasc wrote: post #87

crag wrote: post #79

Earlier quoted context omitted.

"military service is compulsory for all men when they are 18 years old." Not correct. All men (and women) except those in a Yeshiva (religious school). As I understated it, they can post-pone their enlistment indefinitely. I also understand this is a touchy subject in Israel right now.

Sure. But a vast majority of men do that, and are proud to do it. In Israel, you meet your best friends in the army.

you're speaking on behalf of a "vast majority of men"?

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#140

Post by readysetgo » Sat, Jul 27, 2013, 6:41 PM UTC

rayiner wrote: post #94

readysetgo wrote: post #51

Earlier quoted context omitted.

People don't often die from terrorism. He is much more likley to die from diabities, heart disease, cars or a gun shot. More toddlers with guns have killed Americans this year than terrorist have. If we are trying to save lives, worrying about terrorism is a waste of money.

If you're going to ignore chilling effects, then by that reasoning the NSA surveillance is totally harmless. That's a ridiculous argument. The Beltway sniper killed 10 people in 2002, a fraction of the number who died in car accidents that year. But tens of thousands of people had their lives disrupted as they ducked down while filling up at gas stations.

I don't see how your logic follows at all.

Car crashes in 2002 were in the range of 30,000 deaths. Which is orders of magnitude higher than the sniper.

So in my opinion we shouldn't waste money on NSA wiretapping that doesn't stop terrorism (because if it did it would have stopped the Boston Bombing) and instead invest that time and money into transportation infrastructure.

By doing that we would save more lives, improve our economy and most importantly still have constitutional freedoms.