Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanksgiving 2023 security incident

blog.cloudflare.com

Post reply on HN
Print view View original

131–140 of 336 posts

Re: Thanksgiving 2023 security incident

#131

Post by elashri »

toyg wrote: post #111
kccqzy wrote: post #103

> Analyzing the wiki pages they accessed, bug database issues, and source code repositories, it appears they were looking for information about the architecture, security, and management of our global network; no doubt with an eye on gaining a deeper foothold. For a nation state actor, the easiest way to accomplish that is to send one of their loyal citizens to become an employee of the target company and then have t…

Not if such citizens are sanctioned. Code Red. Hint hint.

I think this probably was a name after the famous Code Red worm [1], not a reference to China.

[1] https://en.wikipedia.org/wiki/Code_Red_(computer_worm)

Re: Thanksgiving 2023 security incident

#132

Post by meowface »

barkingcat wrote: post #40
sevg wrote: post #5

> Even though we believed, and later confirmed, the attacker had limited access, we undertook a comprehensive effort to rotate every production credential (more than 5,000 individual credentials), physically segment test and staging systems, performed forensic triages on 4,893 systems, reimaged and rebooted every machine in our global network including all the systems the threat actor accessed and all Atlassian produ…

I think they did have to do that far though. Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit. Imagine getting in at the centre of a new Meet-Me room ( https://en.wikipedia.org/wiki/Meet-me_room ) and having persistent access to key switches there. Cloudflare datacentres tend to be at the hub of insane amounts of data traffic. The fact that the attacker knew how valuable…

>Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit.

I can just imagine the attackers licking their lips when they first breached the data center.

Good reminder to use "Full (Strict)" SSL in Cloudflare. Then even if they do get compromised, your reverse-proxied traffic still won't be readable. (Of course other things you might use Cloudflare for could be vectors, though.)

Re: Thanksgiving 2023 security incident

#133

Post by lavezzi »

Aeolun wrote: post #11

Reading this 2 months after the fact feels a bit late, but I guess it’s better for your stock price if these revelations happen with remediation already in hand? Since they didn’t really have reason to believe my data was accessed, maybe that’s ok. I know from firsthand experience how hard rotating all your credentials across the whole org is.

Since December 18, new SEC rules require companies to report “material” cybersecurity incidents on a Form 8-K within four business days of their materiality determination.

The rule does not set any specific timeline between the incident and the materiality determination, but the materiality determination should be made without 'unreasonable delay'.

Re: Thanksgiving 2023 security incident

#134

Post by BytesAndGears »

kccqzy wrote: post #92
BytesAndGears wrote: post #47

Earlier quoted context omitted.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

You use so many personal accounts for work that it's unfathomable for me. If some hacker manages to hack into your account and find so much valuable information about your work, your work is going to be mightily pissed about it. Imagine you are working on an upcoming product launch and the attacker used your personal account to leak the launch. Or imagine they just decided to leak your company's internal source code.…

It’s a fair concern, but there really isn’t so much there. If they compromise my trello account then they know I have some meetings coming up with people, and that I’m starting on ticket 927109 and planning to deploy ticket 901223 on Tuesday. Just referencing items in our ticket management system with very sparse details.

My notes are text files on the computer, so we’d have problems regardless if they got that. But maybe I should’ve left it out of the list above in that case… nothing else seems very damning.

But you do raise a valid concern, and it’s worth reevaluating!

Re: Thanksgiving 2023 security incident

#135

Post by [deleted] »

BytesAndGears wrote: post #27
marcinzm wrote: post #6

> we were (for the second time) the victim of a compromise of Okta’s systems I'm curious if they're rethinking being on Okta.

My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no management software on it, from the “Early Days” when there was no IT and we just got brand new untouched laptops. They offered me an upgrade to an M1/M2 pro, but I refused, saying that I wasn’t willing to use Okta’s login system if I have my own personal passwor…

[deleted]

Re: Thanksgiving 2023 security incident

#136

Post by [deleted] »

sevg wrote: post #5

> Even though we believed, and later confirmed, the attacker had limited access, we undertook a comprehensive effort to rotate every production credential (more than 5,000 individual credentials), physically segment test and staging systems, performed forensic triages on 4,893 systems, reimaged and rebooted every machine in our global network including all the systems the threat actor accessed and all Atlassian produ…

[deleted]

Re: Thanksgiving 2023 security incident

#137

Post by da768 »

michaelt wrote: post #108
samcat116 wrote: post #46

Earlier quoted context omitted.

> new laptops that are preinstalled with Okta’s management system Okta doesn't make device management software, thats made by companies like Jamf. Okta can integrate with them but Okta isn't what manages your laptop at all. > I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Do not do this, its not a personal device.

> Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you coul…

Nothing a smartphone can't do.

Even companies with these policies preinstall Spotify on work computers.

Re: Thanksgiving 2023 security incident

#139

Post by da768 »

pizzalife wrote: post #71
Symbiote wrote: post #48

Earlier quoted context omitted.

A Github account, for one possible example.

Well, why? It just seems risky. Everything you make on your work laptop / during work hours is typically owned by your employer. If your employer is paying you to contribute to OSS, don't use your personal github account. Just don't ever mix personal and company accounts on company hardware.

The typical work contract also extends to outside work hours and personal devices.

Re: Thanksgiving 2023 security incident

#140

Post by ownagefool »

meowface wrote: post #132
barkingcat wrote: post #40

Earlier quoted context omitted.

I think they did have to do that far though. Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit. Imagine getting in at the centre of a new Meet-Me room ( https://en.wikipedia.org/wiki/Meet-me_room ) and having persistent access to key switches there. Cloudflare datacentres tend to be at the hub of insane amounts of data traffic. The fact that the attacker knew how valuable…

>Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit. I can just imagine the attackers licking their lips when they first breached the data center. Good reminder to use "Full (Strict)" SSL in Cloudflare. Then even if they do get compromised, your reverse-proxied traffic still won't be readable. (Of course other things you might use Cloudflare for could be vectors, though.)

Cloudflare is essentially a massive mitm proxy. If you manage to pwn a key, you have access to traffic.

I'm sure they're better than this than me, but ipxe & tftp are plain text, so it wouldn't be shocking if something in the bootstrap process was plaintext.

At the very least you need to tell the server what to trust.

Post reply on HN