Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanksgiving 2023 security incident

blog.cloudflare.com

Post reply on HN
Print view View original

71–80 of 336 posts

Re: Thanksgiving 2023 security incident

#71

Post by pizzalife »

Symbiote wrote: post #48
yjftsjthsd-h wrote: post #43

Earlier quoted context omitted.

> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?

A Github account, for one possible example.

Well, why? It just seems risky. Everything you make on your work laptop / during work hours is typically owned by your employer. If your employer is paying you to contribute to OSS, don't use your personal github account. Just don't ever mix personal and company accounts on company hardware.

Re: Thanksgiving 2023 security incident

#72

Post by deathanatos »

Symbiote wrote: post #48
yjftsjthsd-h wrote: post #43

Earlier quoted context omitted.

> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?

A Github account, for one possible example.

This is why I use a separate Github account for work?

(& then just rotate the credentials on it when you part ways with the employer.)

Some of my co-workers even do a Github account per employment.

Re: Thanksgiving 2023 security incident

#73

Post by deathanatos »

verve_rat wrote: post #42
BytesAndGears wrote: post #27

Earlier quoted context omitted.

My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no management software on it, from the “Early Days” when there was no IT and we just got brand new untouched laptops. They offered me an upgrade to an M1/M2 pro, but I refused, saying that I wasn’t willing to use Okta’s login system if I have my own personal passwor…

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.)

Also, people just do things for convenience. (Although I tend to pipe these passwords over an SSH connection, so that they're not resident on the work laptop. Though there is a good argument to be had about me permitting my work laptop SSH access to my personal laptop. From a technical standpoint, my employer could hack/compromise my personal laptop. From a legal and trust standpoint, I presume they won't.)

Re: Thanksgiving 2023 security incident

#74

Post by Hrundi »

nolok wrote: post #70
barkingcat wrote: post #40

Earlier quoted context omitted.

I think they did have to do that far though. Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit. Imagine getting in at the centre of a new Meet-Me room ( https://en.wikipedia.org/wiki/Meet-me_room ) and having persistent access to key switches there. Cloudflare datacentres tend to be at the hub of insane amounts of data traffic. The fact that the attacker knew how valuable…

> It would be a company ending event Given they got out of cloudbleed without any real damage let alone lasting damage, I disagree. (I don't disagree with your point about how bad of a problem this would be, I'm just insisting that security failure is not taken seriously at all by anyone)

I don't remember any companies that ended thanks to cloudbleed, but I'd be happy to be proven wrong

Re: Thanksgiving 2023 security incident

#75

Post by hinkley »

BytesAndGears wrote: post #47
verve_rat wrote: post #42

Earlier quoted context omitted.

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

* Jetbrains

* Stack Overflow

* Job Search sites

I don't remember if Jetbrains needs a password to get to personal licenses, but they definitely do to use their bug database. I suspect they're not the only one.

Letting other people blow off steam can be an act of self-preservation. Insisting that people only ever do 100% work things at work or on work hardware slightly raises your low-but-never-zero chances of being murdered by coworkers. Or less ironically, hilariously intense bridge-burning activities.

Also most of this conversation is happening during work hours so I think we can infer that grandparent is being a little hypocritical.

Re: Thanksgiving 2023 security incident

#76

Post by sneak »

barkingcat wrote: post #40
sevg wrote: post #5

> Even though we believed, and later confirmed, the attacker had limited access, we undertook a comprehensive effort to rotate every production credential (more than 5,000 individual credentials), physically segment test and staging systems, performed forensic triages on 4,893 systems, reimaged and rebooted every machine in our global network including all the systems the threat actor accessed and all Atlassian produ…

I think they did have to do that far though. Getting in at the "ground floor" of a new datacentre build is pretty much the ultimate exploit. Imagine getting in at the centre of a new Meet-Me room ( https://en.wikipedia.org/wiki/Meet-me_room ) and having persistent access to key switches there. Cloudflare datacentres tend to be at the hub of insane amounts of data traffic. The fact that the attacker knew how valuable…

> Imagine getting in at the centre of a new Meet-Me room and having persistent access to key switches there.

This wouldn't get you much. We already assume the network is insecure. This is why TLS is a thing (and mTLS for those who are serious).

Re: Thanksgiving 2023 security incident

#77

Post by Xeyz0r »

MichaelZuo wrote: post #52
BytesAndGears wrote: post #47

Earlier quoted context omitted.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?

Why carry a second laptop when you can log in wherever you need to on your work laptop? It's easier for me to store all my passwords in a password manager and log in to the websites I need from my work laptop.

Re: Thanksgiving 2023 security incident

#78

Post by pkkim »

belltaco wrote: post #9

Great write up. > Over the next day, the threat actor viewed 120 code repositories (out of a total of 11,904 repositories > They accessed 36 Jira tickets (out of a total of 2,059,357 tickets) and 202 wiki pages (out of a total of 14,099 pages). Is it just me or 12K git repos and 2 million JIRA tickets sound like a crazy lot. 15K wiki pages is not that high though. > Since the Smartsheet service account had administra…

At least 25% of that is a single Jira project consisting of formulaic tickets to capture routine changes in production, and a large portion of that is created by automated systems. There may be other such projects too.

Source: former Cloudflare employee

Re: Thanksgiving 2023 security incident

#79

Post by swyx »

akira2501 wrote: post #66
tptacek wrote: post #49

Earlier quoted context omitted.

This is why old secops/corpsec security hands are so religious about tabletop exercises, and what's so great about BadThingsDaily† on Twitter. Being prepared to do this kind of credential rotation takes discipline and preparation and, to be frank, most teams don't make that investment, including a lot of really smart, well-resourced ones. If Cloudflare is in a position where their security team can make a call to rot…

It'd be more impressive if they actually got all the credentials. It's good that you think you can absorb a complicated security task, it's useless if you have no way to test or verify this action.

yes but this is a nice #2. not many fortune 500s would 1) even know they were breached and 2) if they were breached, have the breach be so contained.

Re: Thanksgiving 2023 security incident

#80

Post by pests »

jen729w wrote: post #69
MichaelZuo wrote: post #52

Earlier quoted context omitted.

Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?

I’ve been in the same situation. With two laptops you lose the ability to, say, send email directly to your task system. It’s really easy to say ‘don’t use your personal stuff at work’, but when work is some locked-down behemoth whose view of productivity software is ‘just use Office’, and you’re really trying to be better at your job, using your own tools can be the only solution. And in my situation, yeah, they did…

Then you need to let the employer see your lack of productivity when you are limited by the locked-down system.

Finding solutions to work around the systems, on your own time and dime, only hurts in the long run.

They think everything is fine. Nothing will ever get fixed. Voice these concerns.

Post reply on HN