Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Story of the SolarWinds Hack

npr.org

Post reply on HN
Print view View original

71–80 of 139 posts

Re: The Story of the SolarWinds Hack

#71

Post by askl56 »

encryptluks2 wrote: post #70
covidthrow wrote: post #15

Earlier quoted context omitted.

I fear that you're being downvoted for pointing out the even bigger threat of our national media's exceedingly more dangerous acts of propaganda, presumably because readers either don't recognize it or are wilfully blind to it because it reflects their own biases. The SolarWinds hack was a devastating attack on our sovereignty. And so is the other.

The SolarWinds hack in addition to election interference should easily be seen as an attack worthy of taking out Putin IMO.

Yes, let's assassinate a world leader of the country with the most nukes in the world based on unfounded claims of election interference and a hack.

Do you have any idea what America did in Russia in the immediate aftermath of the fall of the Soviet Union? The 1996 election in Russia which was majorly "interfered" with by Clinton: https://archive.is/R7i5u, not to mention the fact that most Russian hacking activities are done using NSA backdoors which were leaked?

I'm surprised and disappointed to see such flagrant ivory tower imperialism on HN.

Re: The Story of the SolarWinds Hack

#72

Post by comboy »

tptacek wrote: post #55

Network monitoring software is a key part of the backroom operations we never see. [...] By its very nature, it touches everything — which is why hacking it was genius. This is frustrating to read, since plenty of people did in fact warn that these kinds of systems were easy targets.

I was just playing with Grafana a few days ago, their cloud version. When you install agent, it opens up ports with unprotected metrics on a public IP. Opens up ports on your production without info about it whatsoever, because it is in theory a push agent. Why would you do that?

Support response:

"Regarding your second message about port 12345 on the Grafana Agent -- the HTTP server only exposes the Agent's internal metrics and provides an API for the Agent's status. The gRPC server is used for agents to communicate with one another, if the scraping service is used. It does not allow anyone to get access to their metrics.

That said there's we understand the concern and upon review will look at documenting that agents listen on 0.0.0.0 by default, and that you can change it by setting http_listen_address and grpc_listen_address in the Agent's server config to 127.0.0.1: (...)"

Also, sometimes I feel like I'm the only person in the world who is not comfortable in running tons of untrusted docker containers. If I put a link to a binary here and tell you to run it, I doubt any HN reader would. But 400MB of binaries? No worries, I have just the right tools to run them as root.

Re: The Story of the SolarWinds Hack

#73

Post by comboy »

tptacek wrote: post #68
bostonsre wrote: post #63

Earlier quoted context omitted.

Yea.. not sure I'd call it genius. Think if you ask anyone that is a little knowledgeable about what would be the juiciest target for a nation state to hack, a large portion of people would have said something like SolarWinds. It seems like SolarWinds should have known better themselves as well. There is no way that their upper management didn't know that they would be an amazing target for a hack. Supply chain attac…

Ninety-nine times out of a hundred, defenders call attacks "genius" as a way of subverting accountability. What makes this particular incident pernicious is that it already had a built-in deflection of accountability --- the responsibility for ensuring that SolarWinds was fit for purpose was diffuse; hundreds of giant companies with large security teams all believed it was someone else's job to verify that SolarWinds…

Also their security team can just be a subgroup of coders who have some idea how their software executes.

IMHO most sane vendors who want you to install something on your machine make it open source and use existing tools as much as possible. Doing it this way also decreases chances of some "temporary fix" changes on even otherwise secure software. Companies optimize for money, management tries to align with company values and engineers often just have to follow it. It's inevitable what trade-offs will be made unless there's some direct negative impact. For everybody selling their time and not being heavily invested, ignoring black swans and basically "eating tons of sugar" is the natural move.

Re: The Story of the SolarWinds Hack

#74

Post by Godel_unicode »

meowface wrote: post #69
trulyme wrote: post #64

Earlier quoted context omitted.

Wait... What do you mean by PyPi runtime downloads???

Not exactly sure what they meant, but maybe just that it's often hard to install a single Python package if the machine can't reach PyPI. If you download a tarball or wheel of some Python package on a different computer and transfer it to the isolated computer, there's a pretty good chance the package is going to have at least one third-party sub-dependency, in which case trying to install it with pip or setup.py wil…

python -m venv temp && temp/scripts/activate && python -m pip install -r requirements.txt && tar -czf temp/Lib/site-packages

You're ready for offline install!

Re: The Story of the SolarWinds Hack

#75

Post by tedunangst »

tptacek wrote: post #68
bostonsre wrote: post #63

Earlier quoted context omitted.

Yea.. not sure I'd call it genius. Think if you ask anyone that is a little knowledgeable about what would be the juiciest target for a nation state to hack, a large portion of people would have said something like SolarWinds. It seems like SolarWinds should have known better themselves as well. There is no way that their upper management didn't know that they would be an amazing target for a hack. Supply chain attac…

Ninety-nine times out of a hundred, defenders call attacks "genius" as a way of subverting accountability. What makes this particular incident pernicious is that it already had a built-in deflection of accountability --- the responsibility for ensuring that SolarWinds was fit for purpose was diffuse; hundreds of giant companies with large security teams all believed it was someone else's job to verify that SolarWinds…

Compare and contrast SolarWinds and Determina, I guess.

Re: The Story of the SolarWinds Hack

#76

Post by sundarurfriend »

tkinom wrote: post #57
makomk wrote: post #24

Earlier quoted context omitted.

Like, say, that backdoor someone wrote an article about recently which ran from RAM and had a sophisticated self-destruct mechanism that erased all traces if anyone tried to dump its memory? I wonder how many companies had exploits like that which they either didn't notice or didn't have the sophistication to actually catch and dump.

There are defences for this: If one controls/monitors for every app in system for network access, as soon as any unusually network access are triggered, it is investigated and block. In my home windows setup, only windows defender, firefox and chrome are allowed out going internet access in regular base. Everything else are blocked. Windows update are only allowed when I in the mood for it (~once a year). Anyone can…

> If one controls/monitors for every app in system

Quis custodiet ipsos custodes? Who monitors the monitor?

What happens when it is compromised, loopholed through, gets its inputs tampered with, etc.? For a home setup and its threat model, this sounds a simple, workable plan. When you're dealing with attacks of the level of sophistication described in the OP, trusting trust [1] becomes complicated and difficult.

[1] http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...

Re: The Story of the SolarWinds Hack

#77

Post by exporectomy »

zaphar wrote: post #38
exporectomy wrote: post #5

Earlier quoted context omitted.

The worst nightmare of the vice president of security at SolarWinds, not of the average person.

An attack directed at your own govt is potentially a nightmare for the average individual. If the wrong information is stolen it could be used much farther down the road. Your govt may find itself at a disadvantage at a critical moment. I'm a sense it's only not a nightmare if you aren't paying attention.

A worst nightmare for normal people would be something like a foreign country hacking all the US nuclear missiles and launching them against themselves. You know, an actual war caused by it, not just some minor intelligence advantage with no particular direct effect on normal people.

Re: The Story of the SolarWinds Hack

#78

Post by grosswait »

askl56 wrote: post #71
encryptluks2 wrote: post #70

Earlier quoted context omitted.

The SolarWinds hack in addition to election interference should easily be seen as an attack worthy of taking out Putin IMO.

Yes, let's assassinate a world leader of the country with the most nukes in the world based on unfounded claims of election interference and a hack. Do you have any idea what America did in Russia in the immediate aftermath of the fall of the Soviet Union? The 1996 election in Russia which was majorly "interfered" with by Clinton: https://archive.is/R7i5u , not to mention the fact that most Russian hacking activities…

Your cited article is interesting but does not support your assertion of major interference IMO. Policy maneuvers for political purposes are the norm for all countries right or wrong.

Re: The Story of the SolarWinds Hack

#80

Post by dmcgee »

This is the line that got me:

>And so we are fairly broadly deployed software and where we enjoy administrative privileges in customer environments.

There is a lot of talk about shoring up security practices by many of the people quoted here. But something that would be hard to admit is that maybe they should not have administrative privileges in customer environments. Maybe they should not install agents on your machine. They would never recommend you to do so with anyone else, except them of course, because you can trust them.

Post reply on HN