Tally of Cyber Extortion Attacks on Tech Companies Grows • Hacker News Board

Re: Tally of Cyber Extortion Attacks on Tech Companies Grows

#41

Post by existencebox » Tue, Jun 24, 2014, 12:14 AM UTC

dsl wrote: post #22

codeddesign wrote: post #3

i dont get it...why not just switch your dns to cloudflare or a similiar service and run under their protection?

Because centralization is bad for the internet. CloudFlare unwraps every single SSL connection, they see every cookie, they can modify every response. It is a goldmine for a bad actor to compromise.

I'd love to see every market segment have its share of competition, but at this point, cloudflare comes pretty close to "doing magic" in terms of dealing with the increasing volume of DDOS, and I frankly don't know anyone else who offers the services or results they do. (my only connection to them is that they've pulled a few sites I follow out of the fire over the last few months, and getting to see the before/after more firsthand convinced me a bit more of their importance.)

Basically, I'd rather there is _some_ company that can shut down these exiting known bad actors than avoid it on the off chance that it becomes a bad actor down the road. Better to use the time that buys us to look for better ways to deal with DDOS, both policy and tech based, as other comments suggest.

Re: Tally of Cyber Extortion Attacks on Tech Companies Grows

#42

Post by Mandatum » Tue, Jun 24, 2014, 12:32 AM UTC

troels wrote: post #39

One thing I don't quite understand - wouldn't it be possible to unravel a botnet? If you acquire one of the infected machines, a bit of reverse engineering (or perhaps just monitoring its network traffic) should presumably be able to reveal where it gets instructions from. It would probably take the cooperation of law enforcement, but assuming that, wouldn't it be possible - even practical - to do?

Yes, in the past when they were more centralized with only a few IRC/C&C's this was an easy solution.

However now, a botmaster is able to generate thousands of C&C centers's from hacked boxes, via hidden TOR or I2P nodes, or shared hosting, as well as hundreds of thousands of varying infected malware almost instantly. The only thing that requires effort from the botmaster now is spreading and constantly updating their slaves so they can keep them in control longer.

The actual implementation is the easy part of it.

Re: Tally of Cyber Extortion Attacks on Tech Companies Grows

#43

Post by mpyne » Tue, Jun 24, 2014, 3:17 AM UTC

NotAtWork wrote: post #33

mpyne wrote: post #29

Earlier quoted context omitted.

http://icontherecord.tumblr.com/post/82416436703/statement-o... But also, straight from the mouth of a USCYBERCOM strategist speaking to our class the other week. And also, just plain logic. I pointed out here on HN even before the ODNI released the statement I linked above that Heartbleed is far more damaging to the USG itself than any intel value NSA could have hoped to achieve from it. With the other vulns NSA wou…

> This Administration takes seriously its responsibility to help maintain an open, interoperable, secure and reliable Internet. > When Federal agencies discover a new vulnerability in commercial and open source software – a so-called “Zero day” vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather…

> > This process is called the Vulnerabilities Equities Process. Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities.

> Nothing about this statement makes me believe that they were unaware of Heartbleed, specifically because it seems to imply that they don't stockpile vulns that they find, which we know that they do.

Are you just trying to be obtuse here? The very paragraph you quoted says they are biased towards disclosing, not 100% committed to disclosing. They admit right there that it's possible they would discover a vulnerability and not disclose it.

But the part of the statement you left out is that Heartbleed in particular would only have met their criteria for disclosure due to the great danger to USG systems and systems used by private U.S. persons and entities.

> I suspect that this isn't true, especially if the US government isn't using OpenSSL for their internal security.

The USG uses OpenSSL everywhere. Even USG can't run MS everywhere, and there's not exactly a ton of options for their many Linux, BSD and UNIX-based systems.

Even worse, they likely use OpenSSL in places that no one in particular knows about. It wouldn't surprise me one bit to find out that some of those 300,000 systems still vulnerable belong to government agencies.

> If we're going with anecdotes, I've met a couple of military contractors who claimed to have known of Heartbleed ahead of the public disclosure by non-trivial periods of time.

Non-trivial as in? If they hear about it while Google is developing a fix (and logo) as you seem to be implying, that's preferential disclosure, not NSA holding onto a vuln from the day it came out.

Re: Tally of Cyber Extortion Attacks on Tech Companies Grows

#44

Post by troels » Tue, Jun 24, 2014, 10:48 AM UTC

Mandatum wrote: post #42

troels wrote: post #39

One thing I don't quite understand - wouldn't it be possible to unravel a botnet? If you acquire one of the infected machines, a bit of reverse engineering (or perhaps just monitoring its network traffic) should presumably be able to reveal where it gets instructions from. It would probably take the cooperation of law enforcement, but assuming that, wouldn't it be possible - even practical - to do?

Yes, in the past when they were more centralized with only a few IRC/C&C's this was an easy solution. However now, a botmaster is able to generate thousands of C&C centers's from hacked boxes, via hidden TOR or I2P nodes, or shared hosting, as well as hundreds of thousands of varying infected malware almost instantly. The only thing that requires effort from the botmaster now is spreading and constantly updating thei…

I see. Still, the attacker has multiple surfaces to try and trace them through. Unless they are very careful, you would expect that they tend to slip every now and then, making it possible to find them? I would imagine that a dedicated security team within law enforcement would be able to get a pretty good success rate, but that doesn't appear to be the case?

Re: Tally of Cyber Extortion Attacks on Tech Companies Grows

#45

Post by nitrogen » Wed, Jun 25, 2014, 5:03 AM UTC

jgrahamc wrote: post #20

nitrogen wrote: post #8

DDoS attacks like this wouldn't be so easy if governments actively fixed backdoors in hardware and software instead of creating and stockpiling them. Much harder to build a botnet if there are fewer vulnerable systems to recruit via exploits.

A. I don't see how "the government" is behind botnets. B. You don't need many machines to create DDoS attacks because of reflection/amplification. C. You can rent machines without having to use a botnet.

A. I never said the government was "behind botnets." Nor did I refer to any singular government. Yet, Stuxnet did create, in effect, a botnet.

B. A government interested in network security would inform managers of reflection- and amplification-vulnerable systems (such as misconfigured DNS resolvers), as well as design and release open, verifiable, trustable specifications for filtering hardware and packet matching algorithms to block DDoS attacks at the same points they currently tap network traffic.

C. Rented machines can be shut down far more easily than a botnet.