Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. government probes VPN hack within federal agencies, races to find clues

reuters.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#21

Post by Jtsummers »

jcrites wrote: post #20
WaitWaitWha wrote: post #7

Earlier quoted context omitted.

>The government has no authority to demand a software bill of materials (SBOM) from everyone who publishes software. Speaking from US Gov perspective - if the company is part of a contract (and ~40% of the Gov are contractors), Gov certainly can. They can put nearly anything (legal) into the RFP/Q. Even if they do not say "give us your BoM", they can wrap it in requirements that in essence delivers the same exact res…

They could build in a requirement that the software has undergone penetration testing by a security firm, and that a copy of the penetration testing report along with any mitigations applied to the software be provided. I've never even heard of the software the government is using. Why aren't they using Cisco AnyConnect like literally every other company I've worked for who has a VPN?

Not all agencies, but the US gov't does use Cisco AnyConnect and pretty much everything they use for IT is COTS these days.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#22

Post by PeterisP »

godelski wrote: post #14
rossdavidh wrote: post #9

Prediction: at some point (if it isn't already happening as we speak), the government insistence on "we need to be able to hack into any software if it's important" will collide with "we need to be able to keep foreign powers out of our software", and there will be bitter internal fights about it, both sides claiming national security interests.

> at some point Hasn't this been the debate since encryption came around? I thought we've been having this debate for at least 50 years.

Encryption is a bit different debate with different tradeoffs. With encryption, the government can try to use different encryption than everyone else, and many sectors of industry don't rely on encryption. But vulnerabilities on common software apply to everyone; there's pretty much the same pieces of software and electronics (e.g. mobile phones) used by every country, by civilians and businesses and governments alike.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#23

Post by PeterisP »

TheOtherHobbes wrote: post #17
joe_the_user wrote: post #4

Earlier quoted context omitted.

This theme keeps coming up. Some cohort of HN is upset that software manufacturers aren't directly required to produce "secure software" [1] I would suggest people look at a very foundational essay on this [2]. Key quote: " Security is a process, not a product. Products provide some protection, but the only way to effectively do business in an insecure world is to put processes in place that recognize the inherent in…

Security is not a Boolean. It's on a continuum from "You must be fucking joking" (early versions of IE) to "Not perfect, but workable with training" (literal weapons-grade air gapping). Perfectly secure software does not exist. More secure and less secure software certainly does exist. Which is why software should be expected to provide some basic level of protection. In any org there will be a proportion of idiots w…

Can you elaborate on what exactly do you mean by " software should be expected to provide some basic level of protection." ?

In some sense security is binary - if your software happens to have even a single mistake that results in RCE or authentication failure, then it's totally exploitable and does not provide any level of protection whatsoever. And as experience shows, we seem unable to write any software without such mistakes, even if we try really, really hard by skilled people with security in mind, as far as I recall every popular piece of software that needed to be secure has had vulnerabilities.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#24

Post by AshWolfy »

PeterisP wrote: post #23
TheOtherHobbes wrote: post #17

Earlier quoted context omitted.

Security is not a Boolean. It's on a continuum from "You must be fucking joking" (early versions of IE) to "Not perfect, but workable with training" (literal weapons-grade air gapping). Perfectly secure software does not exist. More secure and less secure software certainly does exist. Which is why software should be expected to provide some basic level of protection. In any org there will be a proportion of idiots w…

Can you elaborate on what exactly do you mean by " software should be expected to provide some basic level of protection." ? In some sense security is binary - if your software happens to have even a single mistake that results in RCE or authentication failure, then it's totally exploitable and does not provide any level of protection whatsoever. And as experience shows, we seem unable to write any software without s…

Not every vulnerability will be exploited, most hacks use very simple exploits if at all. 80 percent of security can be achieved with 20 percent of the work

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#25

Post by NortySpock »

sbierwagen wrote: post #13
rossdavidh wrote: post #9

Prediction: at some point (if it isn't already happening as we speak), the government insistence on "we need to be able to hack into any software if it's important" will collide with "we need to be able to keep foreign powers out of our software", and there will be bitter internal fights about it, both sides claiming national security interests.

Bruce Schneier has been complaining about this tradeoff for more than a decade: https://www.schneier.com/blog/archives/2014/05/disclosing_vs... >The NSA can play either defense or offense. It can either alert the vendor and get a still-secret vulnerability fixed, or it can hold on to it and use it to eavesdrop on foreign computer systems. Both are important US policy goals, but the NSA has to choose which one to purs…

Makes me wonder if we should have a white-hat government org that notifies big corporations or software projects about critical vulnerabilities in their code.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#26

Post by WrtCdEvrydy »

rossdavidh wrote: post #9

Prediction: at some point (if it isn't already happening as we speak), the government insistence on "we need to be able to hack into any software if it's important" will collide with "we need to be able to keep foreign powers out of our software", and there will be bitter internal fights about it, both sides claiming national security interests.

Yeah, this was a problem back when NSA's directorate went from Defensive to Offensive. We would like to patch issues that are zero days but they are just so damn fruitful when attacking enemies of the state... the battle lines are already drawn on this.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#27

Post by WrtCdEvrydy »

NortySpock wrote: post #25
sbierwagen wrote: post #13

Earlier quoted context omitted.

Bruce Schneier has been complaining about this tradeoff for more than a decade: https://www.schneier.com/blog/archives/2014/05/disclosing_vs... >The NSA can play either defense or offense. It can either alert the vendor and get a still-secret vulnerability fixed, or it can hold on to it and use it to eavesdrop on foreign computer systems. Both are important US policy goals, but the NSA has to choose which one to purs…

Makes me wonder if we should have a white-hat government org that notifies big corporations or software projects about critical vulnerabilities in their code.

That was the point of the NSA, but the war on terror has corrupted that mission to the core.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#28

Post by godelski »

PeterisP wrote: post #22
godelski wrote: post #14

Earlier quoted context omitted.

> at some point Hasn't this been the debate since encryption came around? I thought we've been having this debate for at least 50 years.

Encryption is a bit different debate with different tradeoffs. With encryption, the government can try to use different encryption than everyone else, and many sectors of industry don't rely on encryption. But vulnerabilities on common software apply to everyone; there's pretty much the same pieces of software and electronics (e.g. mobile phones) used by every country, by civilians and businesses and governments alik…

I'm sorry, but what industry doesn't rely on encryption? Every financial service relies pretty heavily on encryption.

As an aside, I personally would argue that in the age of big data/information that your populous having security is extremely important. Modern warfare (or all warfare) depends highly on information. TOR only works if average people use it. The military suggests soldiers use Signal because many times they've gotten in trouble because adversaries intercepted SMS messages to loved ones (or just someone getting some strange).

There is of course a question of balance, but personally I don't see one. Safer to encrypt everything imo.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#29

Post by godelski »

rossdavidh wrote: post #19
godelski wrote: post #14

Earlier quoted context omitted.

> at some point Hasn't this been the debate since encryption came around? I thought we've been having this debate for at least 50 years.

For sure, my point was that the debate, instead of being between government figures who are in favor of keeping the right to listen in vs. non-government figures who want to keep them out, it will shift (has shifted?) to a within-government debate. In the days after 9/11, I don't get the impression there was much of an intra-government debate at all.

By intra-government you mean like US vs China? (or any other competitors? We could say Israel and Germany) I think this has always existed though the information age has swung the balance to there being more importance for average citizens to have encrypted data in a more general sense and not just finance.

Re: U.S. government probes VPN hack within federal agencies, races to find clues

#30

Post by closeparen »

PeterisP wrote: post #23
TheOtherHobbes wrote: post #17

Earlier quoted context omitted.

Security is not a Boolean. It's on a continuum from "You must be fucking joking" (early versions of IE) to "Not perfect, but workable with training" (literal weapons-grade air gapping). Perfectly secure software does not exist. More secure and less secure software certainly does exist. Which is why software should be expected to provide some basic level of protection. In any org there will be a proportion of idiots w…

Can you elaborate on what exactly do you mean by " software should be expected to provide some basic level of protection." ? In some sense security is binary - if your software happens to have even a single mistake that results in RCE or authentication failure, then it's totally exploitable and does not provide any level of protection whatsoever. And as experience shows, we seem unable to write any software without s…

You don’t have to perfectly secure in order to raise the bar past your adversary’s level of sophistication. But you do have to stop doing the same stupid shit that’s in easy reach of anyone who can program.
Post reply on HN