Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

krebsonsecurity.com

Post reply on HN
Print view View original

101–110 of 350 posts

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#101

Post by nrmitchi »

falcolas wrote: post #90
nrmitchi wrote: post #4

Earlier quoted context omitted.

SolarWinds is a 21-year-old publicly-traded company. They're not really "yet another startup". I also don't think that the departments of the US Government are all going around all willy-nilly dropping tools from "yet another startup" into their core infrastructure. While your overall point may be valid, it's tough to come to the conclusion that it is applicable here.

I believe that you have mis-read their comment - they aren't saying Solar Winds is "yet another startup", they're saying that SolarWinds is incorporating 3rd party technology (the so-called supply chain attack on their build) without vetting it. And, if we're being honest, those technologies probably are based off startup tech; SolarWinds purchases and incorporates startup companies (such as Vivid Cortex recently).

That is entirely possible.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#102

Post by hsbauauvhabzb »

NovemberWhiskey wrote: post #78
kodah wrote: post #68

Earlier quoted context omitted.

Citation? I couldn't find anything on the web or here: https://pages.nist.gov/800-63-3/sp800-63b.html edit: I wasn't calling OP a liar, I just couldn't find it.

It's right there in section 5.1.1.2: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)."

Harmj0y, who is probably the best public AD hacker right now suggests 3 month rotations, IIRC.

My guess is the idea is to mitigate compromise of very old passwords, spray attacks using breached site creds, reduce insider threat and at least offer some mitigation for compromised hashes.

I think this is wise compared in work environments - 90 days, 180 or even 360 would be a good mitigation over _none_ to too many.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#103

Post by mcguire »

notabee wrote: post #99
mcguire wrote: post #40

Earlier quoted context omitted.

Willy-nilly dropping tools into core infrastructure is largely how government IT works. Corporate IT, too, from what I've seen.

That's very true, In my limited experience, they are tools sold to non-technical leadership that are either thrown to technical staff to deal with and implement or require letting yet another vendor have network access to manage. It adds up to a hot mess.

My favorite comment from a (authentication system) vendor, during a meeting where we were trying to figure out why users were having trouble logging into an internal app: "Do I have a charge code for this?"

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#104

Post by dcolkitt »

textech wrote: post #58
random5634 wrote: post #14

A couple of quick notes: 1) The OPM hack and now this all illustrate - if govt gives itself the big backdoors into everything, it's likely they will give it to russia, criminals, ex-boyfriends stalking ex-girlfriends etc. 2) My own impression of govt IT is largely security theatre in the area I was involved. In particular such massive complexity that agency staff think going around the rules is normal, because it's t…

Incompetence runs through every facet of American government, corporations and even private businesses. There's an insane amount of bureaucracy and people doing IT who have no business doing IT. As for the corporations, the established ones get taken over by the MBA types who have no clue about software or security nor do they care as long as the numbers look good for the next quarter.

I'd bet dollars to donuts that firms run by professional managers almost certainly have better security practices than family or founder run firms. I say this because research shows that professionally managed firms excel in virtually every other facet of operations and management[1].

[1] https://hbr.org/2011/03/family-firms-need-professional

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#105

Post by lovecg »

aaomidi wrote: post #26
swalsh wrote: post #5

So, am I reading this right? the Russian government had the ability to impersonate the credentials of ANYONE in the marjoity of the fortune 500, the US Government, the US DOD, and our telecomm infrastructure... and they likely had this access for a while. How is this NOT an act of war?

Lmao act of war. You going to fight? This is just what countries do to eachother. Welcome to the 21st century.

And 20th, 19th, 18th, etc. The methods change, the spying is constant.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#107

Post by SystemOut »

random5634 wrote: post #14

A couple of quick notes: 1) The OPM hack and now this all illustrate - if govt gives itself the big backdoors into everything, it's likely they will give it to russia, criminals, ex-boyfriends stalking ex-girlfriends etc. 2) My own impression of govt IT is largely security theatre in the area I was involved. In particular such massive complexity that agency staff think going around the rules is normal, because it's t…

I hated this part of being on-call for government customers. I had to go through some crazy adjudication process all for the privilege of having to change my passwords every 60 days. And even though I used a password manager for them I couldn't paste them in because the VM I was required to use to access the systems didn't allow pasting from the outside.

So I just typed them into notes on the VM and left them there.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#108

Post by acdha »

hsbauauvhabzb wrote: post #102
NovemberWhiskey wrote: post #78

Earlier quoted context omitted.

It's right there in section 5.1.1.2: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)."

Harmj0y, who is probably the best public AD hacker right now suggests 3 month rotations, IIRC. My guess is the idea is to mitigate compromise of very old passwords, spray attacks using breached site creds, reduce insider threat and at least offer some mitigation for compromised hashes. I think this is wise compared in work environments - 90 days, 180 or even 360 would be a good mitigation over _none_ to too many.

I think those concerns are better addressed elsewhere with tools like MFA, automatically disabling inactive accounts, or monitoring public services like HIBP to deactivate accounts quickly. Attackers can move quickly so you hit diminishing returns on rotation policies trying to avoid usability issues incentivizing worse passwords while not rotating long after the account has been compromised.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#109

Post by mumblemumble »

Jtsummers wrote: post #67
vngzs wrote: post #59

Earlier quoted context omitted.

NIST no longer suggests such a rotation policy. They have accepted that it weakens security. Anecdotally, colleagues have successfully lobbied to drop (or not enforce) password expiration policies from other government bodies on the strength of this recommendation from NIST.

Yeah, I know it's not actually recommended anymore, but the policy makers don't care. They're doing CYA policy. They do whatever seems to be the strongest possible thing, users and reality be damned. I was in a team whose security group eliminated the use of DVD drives for reading (not writing) data except for a few permitted individuals. Creating a massive chokepoint in every process where data had to come from off-…

> They do whatever seems to be the strongest possible thing

It's not that, it's inertia and poor incentive structures.

In a large organization, if a policy was set in place by someone else, then, even when you know it's a sub-par policy, it's still in your interest to leave it alone. Doing so gives you a way to deflect blame in the event of a breach related to that decision. You can just blame the policy itself. If, on the other hand, you change the policy, you're more likely to be held personally accountable.

That said, you're also absolutely right about the expertise problem. I don't know much about government, but, in private industry, I've observed that the best way to get put in charge of cybersecurity is to start from somewhere completely outside of IT, and become good friends with the CEO.

Post reply on HN