Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What can we learn from the matrix.org compromise?

medium.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: What can we learn from the matrix.org compromise?

#31

Post by bifrost »

pm90 wrote: post #28

This is such a poorly written article: * no detailed analysis of how the attack was undertaken. Its not even clear how the attacker managed to get in (was it a publicly exposed Jenkins? vulnerable bastion? what?) * no analysis of what the existing matrix.org security perimeter looked like or how it could be made better. * repetition of security tropes. Use VPN. Use Github Enterprise (wait wtf? Why not private repos i…

If you click through to the GH Issues I linked to there are some pretty good data points as to what happened. I didn't feel the need to copypasta.

But yes, publicly exposed jenkins and repos lead to the compromise, not an uncommon story unfortunately.

Perimeter - I didn't see much evidence of one existing and I didn't go probing their networks to find out.

Security tropes are real for a reason, you don't have to believe me though.

Private repos in GitHub are still publicly hosted and are orders of magnitude easier to get into than having an in perimeter repo. They've leaked before and they'll keep on leaking. GitHub even made it harder for people to fork private repos to their own public accounts but it still happens.

Re: What can we learn from the matrix.org compromise?

#32

Post by acct1771 »

ubercow13 wrote: post #25

Why is it considered safer to expose a VPN to the internet than SSH? Is it just that there is one exposed service for the organisation rather than one per machine?

That'd probably be a solid question that the people implementing WireGuard in Linux kernel/supporting that can cover.

Re: What can we learn from the matrix.org compromise?

#34

Post by scurvy »

nine_k wrote: post #20
inetknght wrote: post #2

I have gone on some long verbal rants about the dark patterns (bordering on malicious behavior) exhibited by key agents such as SSH agent, GPG agent, Pageant, and the like. What can you learn from the compromise? Never use an agent. Kill it with fire^H^H^H^H -9.

How about using hardware tokens instead? With a right setup, private keys never leave it.

Smart cards? They were designed for this.

Re: What can we learn from the matrix.org compromise?

#35

Post by bifrost »

KirinDave wrote: post #33

Why aren't people reporting the fact that Matrix.org actually lost control of their network a second time within hours of their first all clear sounding? I feel like this is an important part of the story for anyone looking for teachable infosec moments.

I guess I technically glossed over that but I did say "One of the more interesting pieces of this was how Ansible was used to keep the attacker in the system". The attacker was persisted via CM and their public repo, I'm actually surprised this doesn't happen more often.

Re: What can we learn from the matrix.org compromise?

#36

Post by bifrost »

scurvy wrote: post #34
nine_k wrote: post #20

Earlier quoted context omitted.

How about using hardware tokens instead? With a right setup, private keys never leave it.

Smart cards? They were designed for this.

Ever seen anyone working in a Coffee shop using one? Me neither.

Good security technology exists, the problem is that people don't want to use it because its easier to ignore it.

Re: What can we learn from the matrix.org compromise?

#37

Post by driminicus »

KirinDave wrote: post #33

Why aren't people reporting the fact that Matrix.org actually lost control of their network a second time within hours of their first all clear sounding? I feel like this is an important part of the story for anyone looking for teachable infosec moments.

Because the second tine was a dns hijack, not a network compromise. I'm a little fuzzy on the details, but it had something to do with cloudflares API not revoking some access token.

Either way, a DNS hijack is not great, but not nearly as bad as the initial compromise.

Re: What can we learn from the matrix.org compromise?

#38

Post by pm90 »

bifrost wrote: post #31
pm90 wrote: post #28

This is such a poorly written article: * no detailed analysis of how the attack was undertaken. Its not even clear how the attacker managed to get in (was it a publicly exposed Jenkins? vulnerable bastion? what?) * no analysis of what the existing matrix.org security perimeter looked like or how it could be made better. * repetition of security tropes. Use VPN. Use Github Enterprise (wait wtf? Why not private repos i…

If you click through to the GH Issues I linked to there are some pretty good data points as to what happened. I didn't feel the need to copypasta. But yes, publicly exposed jenkins and repos lead to the compromise, not an uncommon story unfortunately. Perimeter - I didn't see much evidence of one existing and I didn't go probing their networks to find out. Security tropes are real for a reason, you don't have to beli…

> They've leaked before and they'll keep on leaking. GitHub even made it harder for people to fork private repos to their own public accounts but it still happens

Can you provide some actual instances of this happening? Genuinely curious, as my org is currently migrating from enterprise to cloud.

Re: What can we learn from the matrix.org compromise?

#39

Post by bifrost »

krupan wrote: post #21

Can anyone explain the Jenkins vulnerability that was used to initially gain access? Reading the CVEs didn't give me the impression that they enabled remote exploits

My 5 second lazy summaries of the CVEs:

CVE-2019-1003001, CVE-2019-1003002 -> Anyone with read access to Jenkins can own the build environment.

CVE-2019-1003000 -> I didn't get a lot of the details on this but it basically looks like "broken sandboxing, you can run bad scripts".

This is also a good resource: https://packetstormsecurity.com/files/152132/Jenkins-ACL-Byp...

Re: What can we learn from the matrix.org compromise?

#40

Post by KirinDave »

driminicus wrote: post #37
KirinDave wrote: post #33

Why aren't people reporting the fact that Matrix.org actually lost control of their network a second time within hours of their first all clear sounding? I feel like this is an important part of the story for anyone looking for teachable infosec moments.

Because the second tine was a dns hijack, not a network compromise. I'm a little fuzzy on the details, but it had something to do with cloudflares API not revoking some access token. Either way, a DNS hijack is not great, but not nearly as bad as the initial compromise.

See, I'd like to know more too.
Post reply on HN