Hackers who broke into Equifax exploited a flaw in open-source server software • Hacker News Board

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#31

Post by munin » Sat, Sep 09, 2017, 2:09 AM UTC

sillysaurus3 wrote: post #14

mistercow wrote: post #12

Earlier quoted context omitted.

If it was not a zero-day, it means the attack was preventable, which points away from a world where a hundred million people's private information is unavoidably vulnerable. In either case, it's a very small amount of evidence anyway, but in that respect at least, hoping it wasn't a zero-day makes sense.

If it was not a zero-day, it means the attack was preventable, which points away from a world where a hundred million people's private information is unavoidably vulnerable. Working in the security industry quickly cures you of this illusion. It is unavoidably vulnerable in most cases. If someone wants to pop your network, they can usually find a way. The most clever code won't prevent someone from strolling in and p…

There are many networks where having a raspi on the network gives you no particular advantage.

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#32

Post by nol13 » Sat, Sep 09, 2017, 2:19 AM UTC

sattoshi wrote: post #24

nol13 wrote: post #22

Earlier quoted context omitted.

So if someone takes this data and just keeps the whole dataset exposed publicly on a tor site, is that pretty much the end of data breaches? Like, some random website: "we just got hacked, all you pii was taken, but don't worry nothing thats not already available in that public database" other than new credit card #'s it'd be basically pointless right?

Well... no. Everybody on that list will change their CC and life carries on until the next breach.

well ya thats the point, credit card breaches may still happen but those are easy to cancel, but all the PII would be permanently in the public domain.

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#33

Post by DominoTree » Sat, Sep 09, 2017, 2:34 AM UTC

sillysaurus3 wrote: post #14

mistercow wrote: post #12

Earlier quoted context omitted.

If it was not a zero-day, it means the attack was preventable, which points away from a world where a hundred million people's private information is unavoidably vulnerable. In either case, it's a very small amount of evidence anyway, but in that respect at least, hoping it wasn't a zero-day makes sense.

If it was not a zero-day, it means the attack was preventable, which points away from a world where a hundred million people's private information is unavoidably vulnerable. Working in the security industry quickly cures you of this illusion. It is unavoidably vulnerable in most cases. If someone wants to pop your network, they can usually find a way. The most clever code won't prevent someone from strolling in and p…

This is why 802.1x exists.

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#34

Post by sillysaurus3 » Sat, Sep 09, 2017, 2:37 AM UTC

munin wrote: post #31

sillysaurus3 wrote: post #14

Earlier quoted context omitted.

If it was not a zero-day, it means the attack was preventable, which points away from a world where a hundred million people's private information is unavoidably vulnerable. Working in the security industry quickly cures you of this illusion. It is unavoidably vulnerable in most cases. If someone wants to pop your network, they can usually find a way. The most clever code won't prevent someone from strolling in and p…

There are many networks where having a raspi on the network gives you no particular advantage.

The network isn't necessarily the target. Developer machines are prime candidates for pivots. Most devs don't bother installing security updates, and many laptops are badly configured or running tools like Jenkins which in certain cases gets you remote code access. Equally promising is to set up a honeypot wifi AP and then wait for someone to accidentally connect to it.

Most devs have creds littered throughout their system. Some subset of the creds will get me access to your network. If you let me rifle through your box for a few hours I'd likely find a way to pivot somewhere else.

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#35

Post by haimez » Sat, Sep 09, 2017, 2:49 AM UTC

sillysaurus3 wrote: post #27

hossbeast wrote: post #26

Earlier quoted context omitted.

Sure, if you don't have physical security, you have no security. Goes without saying.

Unfortunately ~nobody does. The effectiveness of red teams was one of the most surprising aspects of working in security. The most common way to break into someplace was to pose as a construction worker: http://i.imgur.com/ZjnGmZ5.png If you're dressed as one of them, you can go wherever you want and people rarely ask questions. Another approach is to pose as an interviewee. That's how you get into the building, but…

So, every time, he took a pic in the exec's chair, stole a file from the server room, and also did whatever he wanted? What is the 'N' factor here, because it sounds like your friend is a bold high schooler who achieved N=1,2,3(tops). Pretty boring security stuff.

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#36

Post by bodz » Sat, Sep 09, 2017, 2:49 AM UTC

a3n wrote: post #21

bodz wrote: post #13

Earlier quoted context omitted.

> points away from a world where a hundred million people's private information is unavoidably vulnerable Regardless of this specific situation, we already live in this world. We all just need to get used to it.

Which way to the frog sauna?

I have to be honest, I have no idea what you mean. I tried googling "frog sauna" but all I got were advertisements for actual saunas for frogs. Lol ‍️

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#37

Post by grzm » Sat, Sep 09, 2017, 2:51 AM UTC

bodz wrote: post #36

a3n wrote: post #21

Earlier quoted context omitted.

Which way to the frog sauna?

I have to be honest, I have no idea what you mean. I tried googling "frog sauna" but all I got were advertisements for actual saunas for frogs. Lol ‍️

I think it's an allusion to boiling frogs.

https://en.wikipedia.org/wiki/Boiling_frog

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#38

Post by sillysaurus3 » Sat, Sep 09, 2017, 2:55 AM UTC

haimez wrote: post #35

sillysaurus3 wrote: post #27

Earlier quoted context omitted.

Unfortunately ~nobody does. The effectiveness of red teams was one of the most surprising aspects of working in security. The most common way to break into someplace was to pose as a construction worker: http://i.imgur.com/ZjnGmZ5.png If you're dressed as one of them, you can go wherever you want and people rarely ask questions. Another approach is to pose as an interviewee. That's how you get into the building, but…

So, every time, he took a pic in the exec's chair, stole a file from the server room, and also did whatever he wanted? What is the 'N' factor here, because it sounds like your friend is a bold high schooler who achieved N=1,2,3(tops). Pretty boring security stuff.

To clarify, the companies he penetrated were the ones that hired him in the first place. Red teaming is when a company hires you to perform physical pentesting. You're legally allowed to break into their company within a set of defined rules. Usually the rules are straightforward: no breaking stuff (though sometimes there are exceptions), achieve the objective, carry a "get out of jail" envelope with two emergency contacts from inside the target company who will verify they paid you to break in if anything goes wrong. Other than that, you're free to be as creative as you want in achieving whatever the customer asked for. Think Ocean's Eleven.

These gigs are highly paid and secretive. The coworker I mentioned went on dozens of assignments like this. Admittedly he was legendary, but only because he was so experienced. If you were motivated and malicious, you could do many of the same things to attack a target network. People rarely do that, but it's the ultimate proof that none of us are secure against motivated adversaries.

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#39

Post by dmoy » Sat, Sep 09, 2017, 2:58 AM UTC

haimez wrote: post #35

sillysaurus3 wrote: post #27

Earlier quoted context omitted.

Unfortunately ~nobody does. The effectiveness of red teams was one of the most surprising aspects of working in security. The most common way to break into someplace was to pose as a construction worker: http://i.imgur.com/ZjnGmZ5.png If you're dressed as one of them, you can go wherever you want and people rarely ask questions. Another approach is to pose as an interviewee. That's how you get into the building, but…

So, every time, he took a pic in the exec's chair, stole a file from the server room, and also did whatever he wanted? What is the 'N' factor here, because it sounds like your friend is a bold high schooler who achieved N=1,2,3(tops). Pretty boring security stuff.

I mean GP that you're replying to literally said N~=dozens, meaning probably 25+

Side note, that sounds like something one of my old bosses would do on his red team excursions (he also told me to get my teeth pulled without anesthetics at all, so... yea).

Re: Hackers who broke into Equifax exploited a flaw in open-source server software

#40

Post by Nomentatus » Sat, Sep 09, 2017, 4:20 AM UTC

(Also posted in the discussion for an article re the lawsuits being filed vs Equifax for the leak)

Credit card companies could provide other businesses such as Equifax distinct mere-reference numbers which the customer doesn't see and which can't be used for purchases - just to absolutely identify which card, for all parties. These could be added to the magnetic stripe or chip in the card, for example. (It might be gilding the Lilly, but many such reference numbers could be used for a given card, re privacy issues or otherwise. But then those numbers couldn't be usefully passed between companies for all purposes.) There's no need for anyone but the customer and Credit Card company itself to retain the actual credit-obtaining-number (other than to allow future purchases with permission, which is the rarer case, often needs to be prevented not facilitated, and doesn't excuse Equifax having more than a reference number.) Yet the credit card companies don't do this. Why not? 'Cause humans are idiots, all of us, that's why. PS - run to the patent office and you might be able to make a ton of money patenting this, since patents are now given to whoever shows up at the patent office with the appropriate fees first. Precedence doesn't matter. You would be implying that you thought the idea up independently, of course, but you're smart, right? That's totally the sort of thing you could think of independently. Then when you're rich, you too can help choose what the patent laws look like, and whether rich people should pay taxes.