Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maersk, Me and NotPetya

gvnshtn.com

Post reply on HN
Print view View original

21–30 of 59 posts

Re: Maersk, Me and NotPetya

#21

Post by zaat »

All and all very interesting, however, some of strongly stated opinions in the article lack justifications and that's pity.

I don't mean that the author is wrong, just that he is stating his opinions strongly as facts, for an instance regarding ADFS vs SSO with Hash Sync, the statement that the latter is much better is stated as an obvious fact, without much of explanation of justification.

Since not everyone would agree, for instance some security teams I have the pleasure of working with/against, more facts and reasons and less assertions could have done better.

Re: Maersk, Me and NotPetya

#22

Post by jiggawatts »

tialaramex wrote: post #12
terom wrote: post #11

As someone with very limited Microsoft/Windows background, I would be curious to somehow better understand how these lessons would apply to the Linux world. What are the Linux equivalents of pass-the-hash, TAM/PAM/PAWs etc?

I'm guessing you know what a password hash is and roughly how password hashing works? Microsoft's systems don't like to send your plaintext password over the network. Rather than either get rid of passwords or at least secure that so it isn't a problem any more, they do the hashing on your machine and send the hash to wherever it needs to be authenticated. This behaviour enables Pass-the-hash. Since we can authentica…

Linux isn't vulnerable by default, because it's missing features by default. It has no equivalent of Active Directory, and doesn't use Kerberos or anything like it by default.

However, it can, at which point you're back to the same problem. The vulnerability is with the protocol, not the operating system.

Modern versions of Active Directory enable strong protections for Kerberos that almost entirely stops the majority of the Pass-the-Hash or the Golden Ticket attacks. However, this isn't on by default even in Windows Server 2019 running a domain in 2019 mode for "compatibility" reasons.

I put that in air quotes because it's an excuse, and this is where Microsoft has consistently dropped the ball. They refuse to change security defaults, even when it starts getting absurd, and then lay the responsibility (and blame) at the feet of their customers.

For example, domain trusts between two Windows Server 2019 DCs will use NT4-era RC4 ciphers by default, downgrading all AES-capable devices across the trust.

Similarly, newly created accounts will always default to RC4, allowing downgrade attacks.

SMB is neither signed, nor encrypted by default.

Up until very recently, Windows Server has TLS 1.1 and 1.2, but they were disabled. Now, they're enabled, but so is TLS 1.0!

So on, and so forth.

That's the real issue. It's not that Windows is "crypto illiterate". That's like a person who can't read. No, it's like a person that can read but refuses to.

Re: Maersk, Me and NotPetya

#23

Post by mrweasel »

threentaway wrote: post #17
Iwillgetby wrote: post #14

devops should be done from 2 systems. Dev (local administrator access ok, production access not ok) Ops (local admin access not ok, production access ok)

Nobody should directly have access to production, it should be controlled via CD flows which are gated on approvals from other team members or metrics.

I can see that being somewhat impractical in real life, but you’re not wrong.

In the ideal setup NotPetya would have been less of an issue for Mærsk should only have allowed whitelisted software to run on computers controlling critical infrastructure. It’s just a solution very few choose to deploy.

Re: Maersk, Me and NotPetya

#24

Post by Thorrez »

threentaway wrote: post #16
awd wrote: post #13

Earlier quoted context omitted.

They don't directly translate due to the inherent differences in between the two systems. In short, pass-the-hash is a technique by which it is possible to authenticate to a windows system using the hash of a password, instead of the password itself. The NTLM hash is the secret, and does not need decrypting to authenticate. NTLM authentication over the network can be redirected to other machines if they don't have tr…

> It contains all private keys to all systems Hopefully it doesn't? That would be poor design. It typically is just on a network segment that the firewall rules allow it to access the other servers.

If it contains all private keys that would indeed be a bad design. Maybe what awd meant is that it contains a private key that all systems trust. That would make more sense.

Re: Maersk, Me and NotPetya

#25

Post by Veserv »

Why would any of the proposals provide any meaningful protection against this threat model?

Maersk claims NotPetya cost them $250M to $300M [1]. Assuming a criminal organization could demonstrate to Maersk that they could do an attack with similar effects they should be able to extort Maersk for a similar amount of money. If we discount due to unknown information, ROI, etc. I think it is reasonable to say that an extortion demand for $100M, assuming a credible demonstration that the criminal organization could pull off such an attack, would be an economically sound demand and likely to be paid. A criminal organization, considering their own ROI, would probably be willing to invest $30M for a $100M return. For $30M an organization could hire 30 full-time security specialists for 3 years at SV wages to identify an attack with similar effects.

Does anybody here think that their new system could resist such an attack even assuming they adopted all recommendations proposed?

Does anybody here think that there is any deployed system in the world that could resist such an attack?

Does anybody here think that even adopting and correctly practicing all practically deployed recommendations of the security industry that a system could resist such an attack?

All of my research points to no on all of those fronts. And, assuming the answer is no, then adopting all of the recommendations provides no meaningful protection to Maersk or any other company in a similar position since it would still be extremely profitable to attack them. Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack.

If the answer to any of those is yes, could you provide an example and evidence that supports that claim? I would sorely like to find a credible deployed case.

[1] https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

Re: Maersk, Me and NotPetya

#27

Post by omnibrain »

jiggawatts wrote: post #22
tialaramex wrote: post #12

Earlier quoted context omitted.

I'm guessing you know what a password hash is and roughly how password hashing works? Microsoft's systems don't like to send your plaintext password over the network. Rather than either get rid of passwords or at least secure that so it isn't a problem any more, they do the hashing on your machine and send the hash to wherever it needs to be authenticated. This behaviour enables Pass-the-hash. Since we can authentica…

Linux isn't vulnerable by default, because it's missing features by default. It has no equivalent of Active Directory, and doesn't use Kerberos or anything like it by default. However, it can , at which point you're back to the same problem. The vulnerability is with the protocol, not the operating system. Modern versions of Active Directory enable strong protections for Kerberos that almost entirely stops the majori…

> They refuse to change security defaults, even when it starts getting absurd, and then lay the responsibility (and blame) at the feet of their customers.

They changed a lot of security defaults with Windows Vista and literally(figuratively) everybody dumped on them. It got called worst Windows ever, unusable, and names I don’t want to spell out from the public and the press. That made them reluctant to attempt such drastic measures again. But at least they disable SMBv1 by default nowadays.

Re: Maersk, Me and NotPetya

#28

Post by brazzy »

Veserv wrote: post #25

Why would any of the proposals provide any meaningful protection against this threat model? Maersk claims NotPetya cost them $250M to $300M [1]. Assuming a criminal organization could demonstrate to Maersk that they could do an attack with similar effects they should be able to extort Maersk for a similar amount of money. If we discount due to unknown information, ROI, etc. I think it is reasonable to say that an ext…

This is ridiculous. You're basically saying that having any security at all is pointless because someone will always still be able to break into your system in some way.

Nothing could be further from the truth. Only ignorant amateurs believe that security is an all-or-nothing game.

By making your system more difficult to break into, you:

* increase the effort and thus cost for the attacker, thereby reducing the number of opponents that can successfully attack you

* reduce the damage they can do before the attack is discovered and stopped

* make yourself a less attractive target compared to others

> Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack.

That is simply not an option. You'd increase operating costs far more than the damage caused by this attack, and at the same time lose capabilities that customers have come to expect. Most of the cost of this attack came from having to operate without connected systems.

Re: Maersk, Me and NotPetya

#29

Post by brazzy »

mrweasel wrote: post #23
threentaway wrote: post #17

Earlier quoted context omitted.

Nobody should directly have access to production, it should be controlled via CD flows which are gated on approvals from other team members or metrics.

I can see that being somewhat impractical in real life, but you’re not wrong. In the ideal setup NotPetya would have been less of an issue for Mærsk should only have allowed whitelisted software to run on computers controlling critical infrastructure. It’s just a solution very few choose to deploy.

How would that have helped? The finance software that started the breach was legitimately needed and would have been whitelisted.

Re: Maersk, Me and NotPetya

#30

Post by [deleted] »

brazzy wrote: post #29
mrweasel wrote: post #23

Earlier quoted context omitted.

I can see that being somewhat impractical in real life, but you’re not wrong. In the ideal setup NotPetya would have been less of an issue for Mærsk should only have allowed whitelisted software to run on computers controlling critical infrastructure. It’s just a solution very few choose to deploy.

How would that have helped? The finance software that started the breach was legitimately needed and would have been whitelisted.

[deleted]
Post reply on HN