Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

reuters.com

Post reply on HN
Print view View original

211–220 of 294 posts

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#211

Post by pts_ »

WalterBright wrote: post #112
WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

Some questions a security professional should ask: 1. What happens when the root password is guessed by a malicious person? 2. What happens when a trusted employee is really an enemy agent? 3. What happens when we download and install a malicious update from a trusted vendor? 4. What happens when the server room burns down? 5. What happens when a malicious USB stick is plugged into our secure network? 6. What happens…

Substitute all the parts in these hypotheticals with humans and the answer is constant tracking and vigilance.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#212

Post by freeone3000 »

TheRealDunkirk wrote: post #169
ayewo wrote: post #157

Earlier quoted context omitted.

These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. Without providing the context of how expensive or cheap it will be to adhere to each of these best practices, it will be hard to convince those with decision-making authority to do the right thing, unless they are in a highly regulated environment to begin with. An aircraft on the other hand is already very exp…

> These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. I've argued this to well-placed people in two Fortune 250 companies. At the first place, the conversation led to a cleanup up the IT policies, so that they were more consistent and reasonable, but they still weren't grounded in reality. The reaction at the second place has caused me to realize that IT securit…

Microsoft seems to do pretty well, at least in the sense their security is effective and still allows people to get work done. Lots of effort put into policy automation so it's easier to comply with policy than not.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#213

Post by adrr »

kerng wrote: post #197
adrr wrote: post #80

Earlier quoted context omitted.

I thought MSFT was compromised due a netlogon exploit not Solarwinds. They hacked office365 which got them into Solarwinds.

https://www.pcmag.com/news/microsoft-hit-by-solarwinds-breac... “We have been actively looking for indicators of this actor and can confirm that we detected malicious SolarWinds binaries in our environment, which we isolated and removed,” the company said in a statement.

It sounds like Microsoft hack happened before Solarwinds.

https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#214

Post by fsflover »

WalterBright wrote: post #101

I've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure . Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a funda…

> Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?"

This is also the principle behind Qubes OS, security-oriented OS based on security through isolation.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#216

Post by jorblumesea »

heresie-dabord wrote: post #189
nimbius wrote: post #30

Earlier quoted context omitted.

Absolutely agree. Solarwinds focuses a disproportionate amount of effort in ensuring it shows up favorably in Gartner magazine reviews and trade publications. As a monitoring platform its a monolithic, expensive, slow and rather dated monitoring solution. Agile does not come to mind, and you certainly wouldnt use it for anything approaching "observability." But the concerted marketing effort pays dividends. Solarwind…

The attacker in this case new the exact moves to insert a backdoor into .NET software. It wasn't hard to do, requiring no science. But Microsoft's "system of trust" was undermined. The attacker was even inside Microsoft and Azure. No anti-virus, no "defender", no amount of basic or advanced telemetry caught this. FireEye alone caught it... By accident. The real "elephant in the room" is that software security continu…

> is that software security continues to be marketing theatre

Overall I tend to agree with your general points, but, this statement.

Would you say that seatbelts are "safety theatre" because some people die in car accidents while wearing a seatbelt?

I really don't think it's fair to attribute all software security as BS, especially given the resources state actors throw at breaking software. It's like arguing your seatbelts don't work because your 4 door sedan was hit by a bus.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#218

Post by jjk166 »

unishark wrote: post #135
llaolleh wrote: post #109

Earlier quoted context omitted.

That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. If there is a loophole on one server OS, then it's everywhere deeply ingrained in software. Even if you split the data, wouldn't the underlying platforms all have that flaw? Ironically the greatest advantage of softwa…

> That's an interesting thought but I'm not sure if it can be applied to software. Part of what makes security hard seems that it only takes a single point of failure in a chain of dependencies to go bad. I think this is the point. Software is about operating at the top level predominantly, packaging together stuff other people wrote using only simplified API's which abstract away their internal complexity. So you ca…

> Engineering is about starting from physical principles and building a product that fits the understanding of those fundamental principles at work. The engineer generally stays with a set of fundamental domain principles their entire career (e.g. sticks with bridges as opposed to transmission lines) while programmers tend to stay at the top layers while the technologies below the surface change radically.

That's not how engineering works at all. The vast majority of engineering is working at a high level to take systems other people have long since perfected and slapping them together to solve new problems. If you need a solenoid valve, you don't design one, you buy one. And engineers do not stick to narrow domains - I've personally designed a seismic rated tv mount and a machine for testing helicopter flexbeams in the same day. How many bridges would need to be built for people to do nothing but bridges for 40 years?

No, "I did not care enough to read the documentation and understand what I was working with" is not a valid excuse for making something that fails catastrophically. Of course there are going to be little idiosyncrasies that you would never expect if you weren't down in the weeds, but that's true of every field, and the solution is to assume that such issues will inevitably exist and design with appropriate factors of safety and redundancy.

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#219

Post by ethbr0 »

freeone3000 wrote: post #212
TheRealDunkirk wrote: post #169

Earlier quoted context omitted.

> These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. I've argued this to well-placed people in two Fortune 250 companies. At the first place, the conversation led to a cleanup up the IT policies, so that they were more consistent and reasonable, but they still weren't grounded in reality. The reaction at the second place has caused me to realize that IT securit…

Microsoft seems to do pretty well, at least in the sense their security is effective and still allows people to get work done. Lots of effort put into policy automation so it's easier to comply with policy than not.

The problem with IT security orgs is that they get to estimate the costs of not following their own recommendations.

Which trend towards infinity, because... well, they want the thing they're advocating for to happen.

This tends to attract toxic, political people who thrive in this sort of environment, and push out more reasonable, technical people who don't want to deal with that.

At some point, you get a critical mass of toxic IT security managers covering each other... and then everyone starts ignoring and/or hating security.

The real loss is that most IT security orgs I've seen are extremely deficient in developers. The kind of person you actually need to automate things, so that they're quicker, so that people use them, so that the organization is more secure. :(

Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president

#220

Post by Craighead »

cookiengineer wrote: post #62

If the password for your "military grade" secured infastructure is literally "solarwinds123", I wouldn't say it's a sophisticated attack. It's a more complete picture of how much modern businesses value security or pentesting audits. The answer to that is exactly zero effs. As long as businesses think there is no ROI in security, this will stay the same. The only thing sophisticated about this was that from code to d…

You seem undereducated in the timeline of the attack. Supply chain attack came first.
Post reply on HN