Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanksgiving 2023 security incident

blog.cloudflare.com

Post reply on HN
Print view View original

291–300 of 336 posts

Re: Thanksgiving 2023 security incident

#291

Post by this_steve_j »

This is an excellent report, and congratulations are due to the security teams at CS for a quick detection, response and investigation.

It also highlights the need for a faster move in the entire industry away from long-lived service account credentials (access tokens) and toward federated workload identity systems like OpenId connect in the software supply chain.

These tokens too often provide elevated privileges in devops tools while bypassing MFA, and in many cases are rotated yearly. Github [1], Gitlab, and AZDO now support OIDC, so update your service connections now!

Note: I’m not familiar with this incident and don’t know whether that is precisely what happened here or if OIdC would have prevented the attack.

Devsecops and Zero Trust are often-abused buzzwords, but the principles are mature and can significantly reduce blast radius.

[1] https://docs.github.com/en/actions/deployment/security-harde...

Re: Thanksgiving 2023 security incident

#295

Post by jen729w »

MichaelZuo wrote: post #265
jen729w wrote: post #234

Earlier quoted context omitted.

I’m not being snarky, but have you ever worked for a company the size of, say, HP? The tools are the tools. There’s nothing me or my boss or theirs can do about it. They just don’t care. But I care, because if nothing else it’s my reputation. (HP used purely for size comparison. I’ve never worked there.)

Then why not leave if there's no prospects of change in the near future and if you really care?

Because I was working with friends, on a project that was interesting, mentally valuable, and in the national interest.

Just because the org that hires you is a shambles doesn’t mean you give up and quit. Thank fuck we don’t all think like that.

And, again, reputation. I have a stellar reputation because I stick it out, and I care. I’ve worked with people who quit because ‘it’s shit here’. Nobody will ever work with them again.

Re: Thanksgiving 2023 security incident

#296

Post by 2OEH8eoCRo0 »

vikramkr wrote: post #271
2OEH8eoCRo0 wrote: post #155

Earlier quoted context omitted.

I'm sure we do. I don't agree that we attack private civilian enterprise.

If the usa does I don't understand why you expect we'd know about it. Also the us totally does and we do know about it - the nsa buys zero days - it's not exactly a secret lol

The same way Cloudflare can report on foreign state hackers, other countries can discover and report on ours, no?

Re: Thanksgiving 2023 security incident

#297

Post by aenis »

_boffin_ wrote: post #185
cqqxo4zV46cp wrote: post #142

Earlier quoted context omitted.

I have personal stuff on my work machine. I don’t need to say any more than that because in your eyes it’s inherently unjustifiable. So, would you care to more explicitly tell me what you think about my intelligence or ability to behave rationally compared to you? Or is there potentially some room for nuance here?

or if you take it another way... i currently don't understand any rational that has been presented that allows me that frame of thought, but i'm always wanting to learn more.

I'd propose the following line of reasoning:

- people tend to use company devices for private stuff, even when its explicitly prohibited, - draconian policing leads to employee dissatisfaction; you won't be able to fire that great engineer you spent 3 months hiring because he logged in to Spotify running within Chrome, and if you can - and do - soon you will be unable to hire top talent,

Thus, even with those policies in place, end user devices still need to be considered un-trusted. Specifically, that they can be key-logged and remote accessed by the attackers.

Hence, (a) anything sensitive should involve transaction level validation, not just end user authentication, (b) for logging in an out, as well as for confirming sensitive operations, proper MFA needs to be in place (physical key + token on a mobile device, for instance), (c) apply lightweight, reasonable restrictions to reduce the chances of device compromise dramatically (e.g., no downloading of 3rd party apps or binaries - but do whitelist things like Skype or Spotify, force strong password for devices, etc).

This means reasonable personal use is perfectly fine, employees happy, and you are safer vs. assuming local devices are clean.

Re: Thanksgiving 2023 security incident

#298

Post by pbhjpbhj »

cqqxo4zV46cp wrote: post #144
pbhjpbhj wrote: post #98

Earlier quoted context omitted.

>From a technical standpoint, my employer could hack/compromise my personal laptop. From a legal and trust standpoint, I presume they won't.) You trust all personnel with access to your employers network? What's more surprising is that they trust you to setup adhoc ssh connections to arbitrary endpoints; unless you're the person in charge of network security? Would anyone notice if you, or an intruder, dumped terabyt…

Honestly it sounds like you’re sheltered due to working in a certain sort of organisation and have had no exposure to the myriad ways in which organisations tend to be run. You’re acting like this is a big surprise, but it’s not.

Fair comment, probably true.

Re: Thanksgiving 2023 security incident

#299

Post by xmcqdpt2 »

michaelt wrote: post #108
samcat116 wrote: post #46

Earlier quoted context omitted.

> new laptops that are preinstalled with Okta’s management system Okta doesn't make device management software, thats made by companies like Jamf. Okta can integrate with them but Okta isn't what manages your laptop at all. > I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Do not do this, its not a personal device.

> Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you coul…

All your examples are blocked on my employer's network. So yeah.

Re: Thanksgiving 2023 security incident

#300

Post by de-moray »

tptacek wrote: post #256
elitistphoenix wrote: post #232

Earlier quoted context omitted.

Was the self hosted environment running a AV like the Crowdstrike agent? Or was it running different AV and that's why you chose to use Crowdstrike as someone different? I guess no need to specific names. I'm just using that as examples.

What's an AV going to do about the fact that Okta got popped?

Perhaps the parent commenter was referring to the section in the report which stating the IOCs indicated that the attackers used the known third-party command and control system named Sliver. There are multiple public yara signatures for Sliver.
Post reply on HN