Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanksgiving 2023 security incident

blog.cloudflare.com

Post reply on HN
Print view View original

141–150 of 336 posts

Re: Thanksgiving 2023 security incident

#141

Post by bsimpson »

yjftsjthsd-h wrote: post #109
Symbiote wrote: post #48

Earlier quoted context omitted.

A Github account, for one possible example.

Okay, I'll bite; what about a github account? You don't generally own code you write for an employer, so why would you be an personal repos from a company machine? (Likewise, there's generally no good reason for the company to have access to personal repos, so those security domains should never overlap)

Even among engineers, most people don't think like a security engineer.

I'm sure there are plenty of people who have access to their company's private repos through their personal GitHub accounts.

Re: Thanksgiving 2023 security incident

#142

Post by cqqxo4zV46cp »

_boffin_ wrote: post #83
Symbiote wrote: post #48

Earlier quoted context omitted.

A Github account, for one possible example.

Doesn’t matter. No personal stuff on company devices. I just don’t understand any rational otherwise.

I have personal stuff on my work machine. I don’t need to say any more than that because in your eyes it’s inherently unjustifiable.

So, would you care to more explicitly tell me what you think about my intelligence or ability to behave rationally compared to you? Or is there potentially some room for nuance here?

Re: Thanksgiving 2023 security incident

#143

Post by meowface »

ownagefool wrote: post #140
meowface wrote: post #132

Earlier quoted context omitted.

>Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit. I can just imagine the attackers licking their lips when they first breached the data center. Good reminder to use "Full (Strict)" SSL in Cloudflare. Then even if they do get compromised, your reverse-proxied traffic still won't be readable. (Of course other things you might use Cloudflare for could be vectors, though.)

Cloudflare is essentially a massive mitm proxy. If you manage to pwn a key, you have access to traffic. I'm sure they're better than this than me, but ipxe & tftp are plain text, so it wouldn't be shocking if something in the bootstrap process was plaintext. At the very least you need to tell the server what to trust.

>If you manage to pwn a key, you have access to traffic.

That's why I mentioned "Full (Strict)" SSL. If you configure this in Cloudflare then the entire user Cloudflare origin path is encrypted and attackers can't snoop on the plaintext even if they have access. They'll get some metadata, but every ISP in the world gets that at all times anyway.

Re: Thanksgiving 2023 security incident

#144

Post by cqqxo4zV46cp »

pbhjpbhj wrote: post #98
deathanatos wrote: post #73

Earlier quoted context omitted.

The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.) Also, people just d…

>From a technical standpoint, my employer could hack/compromise my personal laptop. From a legal and trust standpoint, I presume they won't.) You trust all personnel with access to your employers network? What's more surprising is that they trust you to setup adhoc ssh connections to arbitrary endpoints; unless you're the person in charge of network security? Would anyone notice if you, or an intruder, dumped terabyt…

Honestly it sounds like you’re sheltered due to working in a certain sort of organisation and have had no exposure to the myriad ways in which organisations tend to be run. You’re acting like this is a big surprise, but it’s not.

Re: Thanksgiving 2023 security incident

#145

Post by cqqxo4zV46cp »

sneak wrote: post #89
deathanatos wrote: post #73

Earlier quoted context omitted.

The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.) Also, people just d…

It's not extreme at all, it's the bare minimum that professionals do. Absolutely none of my personal stuff ever touches a corporate machine. Ever. I wouldn't even log in to the W2 downloading app as an employee from the work machine. Granting work ssh keys access to your personal machine is crazy; if your work machine gets compromised, they steal your entire personal system's home directory too. Why would you unneces…

I love these sorts of comments. Could you please just be more direct and call GP “not a professional” for not working in the way that you do? It’s so unnecessarily passive-aggressive.

Re: Thanksgiving 2023 security incident

#146

Post by bsimpson »

pbhjpbhj wrote: post #98
deathanatos wrote: post #73

Earlier quoted context omitted.

The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.) Also, people just d…

>From a technical standpoint, my employer could hack/compromise my personal laptop. From a legal and trust standpoint, I presume they won't.) You trust all personnel with access to your employers network? What's more surprising is that they trust you to setup adhoc ssh connections to arbitrary endpoints; unless you're the person in charge of network security? Would anyone notice if you, or an intruder, dumped terabyt…

I've used a corp laptop to SCP data onto a non-corp device. Technically both devices were corporately owned, but nobody logging the packets would have known that.

Re: Thanksgiving 2023 security incident

#147

Post by 2devnull »

yjftsjthsd-h wrote: post #43
BytesAndGears wrote: post #27

Earlier quoted context omitted.

My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no management software on it, from the “Early Days” when there was no IT and we just got brand new untouched laptops. They offered me an upgrade to an M1/M2 pro, but I refused, saying that I wasn’t willing to use Okta’s login system if I have my own personal passwor…

> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?

HR forms require personal information and do not allow anyone to access from anything but a corporate device.

Re: Thanksgiving 2023 security incident

#148

Post by curiousgal »

elashri wrote: post #131
toyg wrote: post #111

Earlier quoted context omitted.

Not if such citizens are sanctioned. Code Red. Hint hint.

I think this probably was a name after the famous Code Red worm [1], not a reference to China. [1] https://en.wikipedia.org/wiki/Code_Red_(computer_worm)

It's the tech scene on the Internet, everything is a reference to the CCP! /s

Re: Thanksgiving 2023 security incident

#149

Post by foobarian »

BytesAndGears wrote: post #97
_boffin_ wrote: post #84

Earlier quoted context omitted.

Let me get this straight… you’re taking privileged company information and transferring it to personal… I’m now understanding how people get sued when going from company to company.

Certainly nothing privileged! Moreso just reminders about “follow up with person x” and that kind of thing

We are probably all little people here, and nothing like this would ever happen, but say you were high profile enough like that Google self-driving guy that Uber poached, and there was a lawsuit - anything you did on that computer would be up for grabs. All your personal projects, documentation, DMs.. it would be super messy. I’m pretty sure companies like having this kind of situation because it gives them legal ammo in the rare case where there is an action.

Re: Thanksgiving 2023 security incident

#150

Post by 2devnull »

electroly wrote: post #95
pizzalife wrote: post #71

Earlier quoted context omitted.

Well, why? It just seems risky. Everything you make on your work laptop / during work hours is typically owned by your employer. If your employer is paying you to contribute to OSS, don't use your personal github account. Just don't ever mix personal and company accounts on company hardware.

Note that if you do make a second account, at least one of them must be a paid account. A single person cannot have multiple free accounts and GitHub does not care if it's because one is for work; it's in the TOS.

There is no way around that restriction either.
Post reply on HN