Matasano hacked. A humbling lesson, even the pros are vulnerable. • Hacker News Board

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#31

Post by ankp » Sun, Jul 26, 2009, 8:23 PM UTC

_b8r0 wrote: post #26

ankp wrote: post #17

Earlier quoted context omitted.

Is a VPN significantly less likely to be exploitable than SSH? Yes, for a few reasons. First, a VPN provides defense in-depth -- compromising a server now requires finding two unpatched vulnerabilities: * You must find a vulnerability in the VPN implementation that allows you to leverage the VPN or the VPN host to forward your traffic. * You must then find an additional vulnerability to use against the actual secured…

Not necessarily. What about exploiting VPN clients? http://www.zerodayinitiative.com/advisories/ZDI-09-024/ There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server? Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server.

Not necessarily. What about exploiting VPN clients?

IPSec is a disaster, one aspect of which is having a client daemon listening on an open port for isakmp/ike key exchange.

There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server?

Provisionally "yes", but I'd actually use OpenVPN, wired into our existing directory infrastructure.

Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server.

Why do you consider it a net win to reduce the entry barrier to only one exploit, one bad user password, or one misconfigured host?

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#32

Post by viraptor » Sun, Jul 26, 2009, 10:11 PM UTC

ankp wrote: post #7

viraptor wrote: post #3

I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…

What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…

Agreed on the first point. It's true that minimising the amount of random input will help your security. That will always be true. It was only their fault that they don't limit the access.

OTOH, they have to run public services in an accessible way. Someone could just as well find a bug in their webserver, or mail server. It's bad for PR of course, if their webserver is hacked. But not all servers are equal. (here starts the IMHO part) If you want to spend your time on making everything perfectly secure, you're a full time sysadmin, not a security researcher ;) I think that there are a lot of test, web, mail, etc. servers that people just don't treat as very valuable. Every webserver could be virtualised and the whole system could be checked in a loop by a securely signed checksum verifier which sends (every cycle) results using PKI to a vpn'ed server which sends you an sms if your index.php checksum doesn't match (and snapshot + suspend the machine along with memory, then bring a failover up via a non-lan channel). Is it worth their time though?

People can think that makes the company look bad, I don't...

Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.

#33

Post by devicenull » Mon, Jul 27, 2009, 9:48 PM UTC

hachiya wrote: post #5

Since they are against disclosing vulnerabilities, it seems more likely that these intruders did not gain access through an unknown SSH exploit, but some other way. Once obtaining root, they could paste some proof of being on the system, and simply combine that with the top portion of their log which may be completely fabricated to appear as a 0-day exploit. Again, if there really is a SSH 0-day, why is an anti-discl…

Saying that there is a vulnerability is nowhere close to revealing it. For example, I can say that Windows has a vulnerability allowing me to crash the system. If you are a Microsoft developer, does that information help you track down the issue? Not in the least, as you don't have any idea where to look