Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matasano hacked. A humbling lesson, even the pros are vulnerable.

seclists.org

Post reply on HN
Print view View original

11–20 of 33 posts

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#11

Post by jpierce420 »

jrockway wrote: post #2

Who cares? It's not like they wrote or consulted on whatever was hacked, and there isn't enough time in the day to write every piece of software you use from scratch. This is what you get for writing your OS in high-level assembly.

Um...I assume you're speaking of Linux? Every major OS is written in C with a little asm. I think like one subsystem in Windows is in C++, but most of the code in every major OS is written in C. Which means your claim suggests that every major OS vendor is wrong, which is a very broad claim, my friend. Obviously C is best for the job.

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#12

Post by defen »

ankp wrote: post #7
viraptor wrote: post #3

I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…

What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…

I'm a bit confused - how are you supposed to ssh in if sshd is not internet-accessible? If you're suggesting only allowing access through a VPN, what's the advantage? Is a VPN significantly less likely to be exploitable than SSH? Or are you saying that you should only be able to SSH in via the local network?

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#13

Post by apgwoz »

defen wrote: post #12
ankp wrote: post #7

Earlier quoted context omitted.

What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…

I'm a bit confused - how are you supposed to ssh in if sshd is not internet-accessible? If you're suggesting only allowing access through a VPN, what's the advantage? Is a VPN significantly less likely to be exploitable than SSH? Or are you saying that you should only be able to SSH in via the local network?

A common solution is to whitelist IP addresses, or a range of them. This is obviously inconvenient in many cases, but is much more secure than allowing all to connect, especially in situations where there is a new 0 day.

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#14

Post by timf »

apgwoz wrote: post #13
defen wrote: post #12

Earlier quoted context omitted.

I'm a bit confused - how are you supposed to ssh in if sshd is not internet-accessible? If you're suggesting only allowing access through a VPN, what's the advantage? Is a VPN significantly less likely to be exploitable than SSH? Or are you saying that you should only be able to SSH in via the local network?

A common solution is to whitelist IP addresses, or a range of them. This is obviously inconvenient in many cases, but is much more secure than allowing all to connect, especially in situations where there is a new 0 day.

Or use portknocking.

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#15

Post by pavs »

sailormoon wrote: post #8
ankp wrote: post #7

Earlier quoted context omitted.

What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…

"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet." Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine. But yeah, for a "security" business .. it's pre…

Security is not supposed to be convenient.

If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#16

Post by [deleted] »

defen wrote: post #12
ankp wrote: post #7

Earlier quoted context omitted.

What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…

I'm a bit confused - how are you supposed to ssh in if sshd is not internet-accessible? If you're suggesting only allowing access through a VPN, what's the advantage? Is a VPN significantly less likely to be exploitable than SSH? Or are you saying that you should only be able to SSH in via the local network?

[deleted]

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#17

Post by ankp »

defen wrote: post #12
ankp wrote: post #7

Earlier quoted context omitted.

What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…

I'm a bit confused - how are you supposed to ssh in if sshd is not internet-accessible? If you're suggesting only allowing access through a VPN, what's the advantage? Is a VPN significantly less likely to be exploitable than SSH? Or are you saying that you should only be able to SSH in via the local network?

Is a VPN significantly less likely to be exploitable than SSH?

Yes, for a few reasons.

First, a VPN provides defense in-depth -- compromising a server now requires finding two unpatched vulnerabilities:

* You must find a vulnerability in the VPN implementation that allows you to leverage the VPN or the VPN host to forward your traffic.

* You must then find an additional vulnerability to use against the actual secured hosts made available over the VPN connection.

There should be a firewall between the VPN entry-point and your internal networks, to limit access to unapproved services.

As a single point of entry, a VPN is also easier to secure. If all servers are inaccessible except for approved services, then a single server running an unapproved vulnerable service (or an account with a weak password or key) does not open the door to immediate external compromise.

This single entry point also allows you to offset the likelyhood of user failure (such as choosing poor passwords) by using additional two-factor authentication. RSA SecurID or PKCS#11 are often too heavyweight for using every time you want to SSH'ing into a host, but they're far more reasonable for initially connecting to the VPN.

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#18

Post by there »

viraptor wrote: post #3

I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…

If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real).

matasano isn't a firewall or antivirus company, their main business is code auditing and penetration testing. they are paid to find bugs in their customers' code before the "bad guys" do to minimize the risk of 0-day vulnerabilities.

i know it's not practical for them to audit every line of code in every piece of software that their web server runs, but this type of attack looks much worse for this type of company than it probably would for any other.

They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done.

in the output posted on the site, one user has a bunch of zip files in his home directory with "playbook" in the name (playbook is their firewall revision control product). some "real harm" could come from this attacker distributing the source code to their product, if that is indeed what was in those files.

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#19

Post by gchpaco »

pavs wrote: post #15
sailormoon wrote: post #8

Earlier quoted context omitted.

"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet." Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine. But yeah, for a "security" business .. it's pre…

Security is not supposed to be convenient. If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.

So I'm guessing you mail hard drives around, rather than use the net 'cause somebody might have cracked sshd or OpenSSL? Wait, you don't? Gee.
Post reply on HN