My servers' SSH isn't publicly accessible, you first need to be logged in to VPN (OpenVPN). I don't why Matasano couldn't secure their system like this, especially that some "0-day SSH exploit" is circulating around web. And if you're paranoid (or security expert on war-path with whaddyacallthem anti-sec movement) you have even more simple ways to secure yourself - port knocking for example?
Your system's security weakest link should be human not software.
Matasano hacked. A humbling lesson, even the pros are vulnerable.
21–30 of 33 posts
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#22Earlier quoted context omitted.
Security is not supposed to be convenient. If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.
So I'm guessing you mail hard drives around, rather than use the net 'cause somebody might have cracked sshd or OpenSSL? Wait, you don't? Gee.
I agree with your point, but I do want to point out that mail theft (by postal workers, errant receivers, and malicious thieves) is not so uncommon. I have had a few things mailed without tracking numbers that I strongly suspect were stolen (mailed from post offices with complaints of theft or undelivered mail).
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#23Why do people insist on giving these idiots the attention they want?
There's nothing valuable or productive about their inane, impossible-to-read 'hack logs' and they're not encouraging any sort of useful discussion.
It's just dick-waving, and it's stupid for people to continually post links to their latest escapades on sites like HN and reddit.
I mean seriously. How can you feel good about linking to a thread that has tripe like this in it?
"Death to the Jews, death to the whitehats. All parasites must be destroyed in kind!"
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#24I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…
I'd agree that this is mostly a PR problem; but for a security company, having your public site hacked is somewhat embarrassing. But it is humbling, since this was probably set up much better than the average linux webserver. If these guys can still be vulnerable then noone can be confident. When it comes to computer security we are for the most part working with very poor tools and even less understanding when it co…
No one should be confident. Given enough time and resources, practically any system will fall, typically due to human error (bad passwords being the biggest problem). I'd imagine more resources would be required to hack into a web server set up by a security company, but the rewards, in the form of publicity, for anti-sec are much greater.
Anyone who believes they can have a "secure" system connected to the internet is largely kidding themselves. There are ways to minimize this risk, but there really isn't any way (as far as I'm aware) to completely eradicate it.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#25I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…
What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…
There's nothing wrong with leaving SSH open on a web server - provided it's locked down. How that gets locked down is down to the risk appetite of those responsible.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#26Earlier quoted context omitted.
I'm a bit confused - how are you supposed to ssh in if sshd is not internet-accessible? If you're suggesting only allowing access through a VPN, what's the advantage? Is a VPN significantly less likely to be exploitable than SSH? Or are you saying that you should only be able to SSH in via the local network?
Is a VPN significantly less likely to be exploitable than SSH? Yes, for a few reasons. First, a VPN provides defense in-depth -- compromising a server now requires finding two unpatched vulnerabilities: * You must find a vulnerability in the VPN implementation that allows you to leverage the VPN or the VPN host to forward your traffic. * You must then find an additional vulnerability to use against the actual secured…
Not necessarily. What about exploiting VPN clients? http://www.zerodayinitiative.com/advisories/ZDI-09-024/
There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server?
Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#27My servers' SSH isn't publicly accessible, you first need to be logged in to VPN (OpenVPN). I don't why Matasano couldn't secure their system like this, especially that some "0-day SSH exploit" is circulating around web. And if you're paranoid (or security expert on war-path with whaddyacallthem anti-sec movement) you have even more simple ways to secure yourself - port knocking for example? Your system's security we…
I don't quite understand. What if there is an exploit for OpenVPN?
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#28Earlier quoted context omitted.
"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet." Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine. But yeah, for a "security" business .. it's pre…
Security is not supposed to be convenient. If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.
If you're at home, running OpenBSD on your own computer, then security can be inconvenient as you want it. But if you run security for a business, you have to balance confidentiality and integrity with availability (and sometimes some other concerns). Shell access from the internet could be important to availability--obviously, this was the wrong way to do it, but it wasn't a wrong objective.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#29My servers' SSH isn't publicly accessible, you first need to be logged in to VPN (OpenVPN). I don't why Matasano couldn't secure their system like this, especially that some "0-day SSH exploit" is circulating around web. And if you're paranoid (or security expert on war-path with whaddyacallthem anti-sec movement) you have even more simple ways to secure yourself - port knocking for example? Your system's security we…
I don't quite understand. What if there is an exploit for OpenVPN?
First, a VPN would best be used as an additional layer of security for the whole network, not as a shell for one particular box. Second, a group very publically announced, by hacking imageshack, that they were going after full-disclosure security blogs. A little later, they warned that they had an ssh 0-day. The prudent thing for a full-disclosure security blog to do would be to put some additional security around their internet-facing ssh.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#30My servers' SSH isn't publicly accessible, you first need to be logged in to VPN (OpenVPN). I don't why Matasano couldn't secure their system like this, especially that some "0-day SSH exploit" is circulating around web. And if you're paranoid (or security expert on war-path with whaddyacallthem anti-sec movement) you have even more simple ways to secure yourself - port knocking for example? Your system's security we…
I don't quite understand. What if there is an exploit for OpenVPN?
It depends. If it's the same box and you can get root from exploiting OpenVPN than nothing. But if you are doing this correct - running OpenVPN on non-critical server that serves as entry point for the rest of the network than you just got yourself extra layer of security. It's like probability that there are two bombs on the plane.
Well, my point is, why anyone would leave SSH open like that on critical server. Don't want to set up whole VPN or using things like port-knocking? Just configure your damn firewall to accept only connections from your IP. Wow, I mean, there's million things I can think of to minimize your risk from single ssh 0-day exploit and I'm not even sys admin.