U.S. Treasury breached by hackers backed by foreign government – sources | Hacker News Reader

U.S. Treasury breached by hackers backed by foreign government – sources

reuters.com

773 pointsre_re362 comments

Another current thread is https://news.ycombinator.com/item?id=25413053. Both discussions are good, but I don't think we'll merge them, because the other one is oriented around the more specific information in the fireeye.com article.

I'm always skeptical of these "nation state" claims, it seems like an easy way out of any tough question about the security of these systems.

"No, no, you don't understand, it's not that our systems are insecure, it's that the attackers where highly sophisticated and had the resources of a nation state, otherwise it would never have worked out".

I suppose "we think it could be done by a group of two or three teenagers with decent knowledge of wget" doesn't have the same ring to it.

WaPo reporting it is APT29.

https://www.washingtonpost.com/national-security/russian-gov...

I wish we had more concrete evidence than "according to people familiar with the matter" though. That's kind of my issue: if these attackers are so sophisticated, how can they be sure it's this particular group?

I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and how solid these claims are.

Exacty. And we also know that the NSA/CIA have placed Russian language inside their exploits to frame other countries.

Source?

I've heard this in the "right rooms" to know this to be likely true, but I'd like something to link to, too.

Marble Framework from Vault 7 leaks.

https://wikileaks.org/ciav7p1/cms/page_14588467.html

I totally agree with your point (and would trust a hazy dream more than anything coming from this government), but I'd add that even if they claim to identify these parties forensically, they're often using parallel construction through their own espionage. like in the mueller investigation, they had a lot of firsthand knowledge of the IRA's business from inside the building (and the names of everyone that worked there). It's often not a technical conclusion based on the intrusions, but a conclusion reached by evidence gathered through other means

bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market

Sounds reasonable but I don't remind reading it from the released pdf of the investigation. I actually read the whole thing, it's long but rather interesting from the hacker and espionage spirit.

> bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market

Wow, I just looked some stuff up on bellingcat. It appears that Russia is pretty bad at covering its tracks. This is a good example: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...

A very common source of information to reporters are people who aren't authorized to speak about an issue, or people who have informal relationships with the press and don't want their names revealed publicly.

There are indeed many good reasons why specific people aren't cited in these articles, but who you're trusting is the Washington Post, not these individuals. The trust comes from what the Washington Post does when it finds out it has published false information, and its track record of making sure what it publishes as news is accurate, or corrected when discovered to be false.

As a overly generic rule, trust (or don't) the Institution over the individuals.

I'm perfectly willing to trust that the WaPo is reporting truthfully and that their sources are legit, but without concrete evidence it's hard to judge how serious the allegation really is.

Is it "they forgot to switch their VPN on once and we got a direct connection from an IP that belongs to the Russian state" like that other time (still manipulable but fairly conclusive IMO) or is it "that really looks like the modus operandi of those damn russians and we really need somebody to pin it on right now"?

To be clear I'm not making one of those "fake news" pro-russian rants, I can totally believe that Russia would very much do the things being reproached here if given the opportunity, I just have a really hard time taking the word of an anonymous source without concrete elements in these matters because the potential for manipulation is so absolutely tremendous.

I tend to consider news reports more akin to a, “here’s what we know now” report than a, “this is the definitive explanation of what’s taken place.”

So in that spirit I agree with you. What this looks like, so far, is a sophisticated Russian attack. From here, we’re going to learn more, and that new info may change how we understand what’s happened substantially.

Though I will say I personally don’t care much that the source is anonymous, because I trust WaPo to vet what they’ve said with other sources. It’s not a perfect system, but it’s not like journalists are unaware of the groups trying to manipulate them.

> As a overly generic rule, trust (or don't) the Institution over the individuals.

That is precisely the same line of reasoning that started the Iraq War based on lies. The New York Times claimed to have intel from anonymous sources showing that Saddam Hussein had nuclear weapons, and their false reporting is what led the US to declare war. That snafu didn't happen all that long ago, and yet most people in 2020 seem to have blocked it out of their minds.

The difference is that it wasn't hard to work out the claims were nonsense. WMDs are hugely expensive, and the Iraqi economy was running on fumes at that point. That combined with US belligerence against Iraq made the claims improbable.

But Russia actually does have a strong black hat culture, with links to the political establishment. Putin is a technologically savvy kind of despot who likes sneaky low-cost high-return actions. So this fits the profile - both as a workable hack and also as a proof of concept for future attacks.

Consider the cost/benefit. Instead of physically blowing up infrastructure and security systems you can cripple them, possibly permanently, for the cost of - what? - 20 or 30 specialists, some PCs, and maybe some supercomputer time. Although even that may be optional.

It's unlikely conclusive evidence will be released, because that might reveal too much information about defence strategies. So circumstantial evidence will be as good as it gets.

But whatever the cause, clearly - clearly - all countries and larger orgs need to work much harder on security. Some decorative pen-testing isn't going to be nearly enough in the 2020s.

That's all well and good, but it fails to account for potential action by state actors other than Russia. Everything you have said applies just as much to China, if not more so.

Vetting and sourcing information accurately is a Hard Problem. I don’t expect WaPo (or anyone) to get it right all the time, but I do trust WaPo reporters to be very aware of the best ways to do it, and to let me know when they end up getting it wrong.

At some point you have to trust others to be good at their jobs, and when an org like WaPo demonstrates their proficiency over and over again, their believability rises.

Often, people who "aren't authorized" are used to plant an idea in the press, without the agency in question having to make an official statement. Whether that information is reliable depends on whether you trust the agenda of whoever decided to leak the information.

The Washington Post's record on verifying the claims of the US national security apparatus is poor. The newspaper uncritically reported false claims by the Bush administration about Iraqi WMD. Many people people at the time found those claims extremely dubious, but critical voices were belittled or shut out of most mainstream reporting. More recently, the Washington Post has been all-in on Russia paranoia. That doesn't mean that everything they publish about Russian hackers is wrong, but it very well may be misinformation leaked by US intelligence officials, or something insignificant blown out of proportion and presented without any context. In December 2016, for example, the Washington Post reported that the Russians had hacked a Vermont utility. That story turned out to be complete nonsense, but the Washington Post never fully retracted it. If you look at the story today, you'll still get the impression that the Russians attempted to hack the utility, even though that aspect of the story completely fell apart. The Washington Post on Russia is a bit like Bloomberg on Chinese hackers (e.g., Supermicro).

But you should also keep in mind that organizations (or factions within organizations) will use these channels for their own purposes, to test public opinion before an official announcement, as propaganda channel or to undermine elected officials who are politically in charge.

Because those people would lose their jobs, possibly do jail time, and possibly the story would never have broken in the first place if reporters were required to always give up their sources in the article. Usually they do vetting or it's people they've worked with before and they trust.

You either believe it or you don't. There have been instances where more details were released (the Clinton campaign hack, IIRC), and it just gave more opportunity for people who did not want to believe it to nitpick details.

Whoever does such things doesn't exactly sign their exploits to prove ownership. So the evidence might be something like IP addresses in log files: totally convincing if it's your log file, but so easy to manipulate it's useful to convince someone who does not trust you.

So far as I understand it, "hacker groups," private or state-level, are generally identified by the tools they use. The same groups will re-use the tools and exploits they have over and over, including some known libraries. Security researchers capture the malware sent out from those groups and reverse engineer them. These allow groups of malware signatures to be created, which allows researchers to start to identify potential actors. It didn't take long for the security community to start blaming certain organizations for Stuxnet, despite there being little proof of their claims...

Right. There are situations where we can see that the only apparent way to do something needed very considerable resources, which suggests a state actor.

Equation Group is presumed to be (a front for) the NSA. It forged a (code signing) certificate that otherwise shouldn't exist, using an MD5 collision. But not the MD5 collision painfully created by researchers a little earlier to demonstrate that MD5 was vulnerable, it used a brand new collision purpose made for this attack. That's a considerable investment.

Then also, we can look at who benefits from what was done. Equation Group's "Flame" malware damaged the Iranian nuclear programme. That's something the US government, Israel, some other countries wanted, but it isn't something a bored teenager wants, or a drug cartel, or most for-profit corporations.

As described so far I don't see either the resource needs or the outcome satisfying this conclusion.

Didn't Dan Kaminsky and others have tools to produce nearly arbitray collisions by the early 2000s?

Perhaps? I can't find any evidence easily that Dan did have such tool, but "by the early 2000s" it's not at all unthinkable certainly. If you have a link that'd be great.

However the trouble is MD5 collision isn't like that hilarious "Send all zeroes" Microsoft bug from a few weeks back where you just try it a few times then it works because someone was very stupid - the MD5 collision is pretty hard, the Merkle–Damgård construction actually works, your attack avenue is hammering on the compression function, everything else in MD5 (and any other Merkle–Damgård construction) works because of mathematics unless you can break that compression function - so having a program that when you run it spits out an MD5 collision with your preferred shape is great, it's a cryptographic breakthrough - but maybe it'll take 5000 years to run on a typical home PC. If you're a government or a big crime boss then money turns that into 5 days or (if you've enough of it) 5 hours instead, but if you're a bored teenager or small time crook not so much.

And like I said, Flame depends on a never before seen collision, so it isn't like they just re-used work somebody else had done.

Do you have any idea what time window they had to generate collisions in?

The MS article on the collision says the attack required knowledge of, among other things, the predictable serial numbers. They could have had as little as the usual inter-cert issuance time, or in the worst-case scenario with entirely predictable numbers could have had months or more.

Depending on the window the funds required would change dramatically.

I agree that there is a wide range of costs for the attack, however for the sake of the discussion I would point out that the lower bound of that cost is likely to still be prohibitive for a teenager.

As far as I know you can reliably change a few bits and get a collision, not create arbitrary data with padded info whose hash collides with the original data.

The HashClash tool [1] was written back in 2006 and can construct chosen-prefix md5 collisions. Don't know if it has anything to do with Dan Kaminsky though.

[1]: https://www.win.tue.nl/hashclash/

FWIW, I'm also sceptical of comments like yours. A nation state involved in a lot of hacking would be interested in spreading your kind of doubts on social media. I'm not trying to accuse you personally, I don't know you from Putin, I'm just wondering why this response has become so popular recently.

Lack of trust.

> I'm just wondering why this response has become so popular recently.

Nihilistic cynicism sounds a lot like smartitude to stupid people.

I'm not usually very distrustful of mainstream news (at least, by internet standards) but I am very distrustful of the news' capacity to vet very technical issues correctly. Remember that Bloomberg "the Chinese put spy microchips on our motherboards" story?

I'm not accusing the WaPo of being distrustful here, I just think that in these cases the potential for manipulation, half-truths and technical mistakes from their sources is very high, and without either knowing who these sources are or what are the concrete element they're using to make their conclusions I find it very hard to blindly trust these sources.

I have the exact same attitude. Reading WaPo, Bloomberg, and even NYT (though I think NYT has a slight edge here) report on technical issues make me cringe. You can tell they're trying to hardest to understand and to explain it in a comprehensible way but it's just so bad. Then I think to myself, if that's the way it is for computing, what about other technical/STEM/specialized fields? I trust them for their reporting on those but what if they have missing the important nuances there too?

> "I'm just wondering why this response has become so popular recently."

There is a huge divergence in understanding of the purport of recent events, starting with the Wikileaks release of DNC emails in 2016, and continuing through to Hunter Biden's laptop

One camp believes or suspects that Russia is more of a useful bugbear and scapegoat for certain political factions in the US, used cynically as FUD to manipulate public perceptions, than something to be so worried about

The other believes in good faith that Russia is a dangerous and sophisticated adversary with assets in the highest levels of the US government, and finds the first camp to be incomprehensibly obtuse at best

It's difficult for these 2 camps to communicate effectively for some reason

> the attackers where highly sophisticated and had the resources of a nation state

Also, the attack was carefully crafted. How could anyone expect or defend against a carefully crafted attack, by a nation state no less.

Well, one would presume our own nation state could, for starters.

Maybe someone with more familiarity on the topic can chime in, but I don't think it's the effective PR move you think it is. Nobody, I think, actually cares who from a blame perspective.

The idea that there's face saving to be had by blaming it on someone sophisticated just doesn't ring true to me. It still happened, the details specifically about who and how don't make your board, your boss, or Wall St. care.

It's way more relevant how you react to the breach, than it is that the breach took place.

It's easier to get congress to pump the relevant parts of the military industrial complex with $$$ when it's "cyber warfare" too.

I thought all the script kiddies were using curl ? :)

Your comment didn't age well.

https://www.fireeye.com/blog/threat-research/2020/12/evasive...

If this is not sophisticated, I don't know what is.

This attack is a supply chain attack on enterprise software used by huge government organizations. Where can teenagers with wget pull that off?

When a leading security group (FireEye) says it's a state-level actor, I don't think they are doing PR.

It's fine to be skeptical, but why are you being skeptical? Perhaps it's lost on me but I don't think the claim that PR would look bad _if it were teenagers_ is a good reason to promote widespread distrust of ???.

I see the compromise of SolarWinds Orion software as far more likely to be carried out by state level actors than by script-kiddies. What would script-kiddies stand to gain?

It seems like this incident has impacted not only the U.S. Treasury, but other U.S. government agencies.

The Washington Post also stipulates that the group behind it also hacked FireEye [1].

Makes me wonder if the TTP used for this attack is similar to the FireEye breach (if of course it really was APT29 behind both attacks).

Edit: Reuters reporter Chris Bing says he is hearing the way FireEye got hacked is similar to these government agencies [2].

[1]: https://www.washingtonpost.com/national-security/russian-gov...

[2]: https://twitter.com/Bing_Chris/status/1338233592347045892

Here’s the FireEye write up: https://www.fireeye.com/blog/threat-research/2020/12/evasive...

All these systems are just too complicated. We keep adding features on features to software without a second thought, because it's invisible and you can't immediately tell from looking at it how insane it is, in a way that you wouldn't be able to ignore if these were mechanical systems.

Also, not that it would have prevented this attack, but as a community we desperately need a fully open source FPGA-based ultra simple firewall appliance. The absolute minimum set of configuration options, the simplest possible hardware architecture; something you could actually trust with your life. Right now I have zero confidence that any of the commercially available security appliances are actually secure against nation-states.

Who would be trusted to design and procure the hardware for such a device?

Good question :).

Maybe layers? For government agencies, the government could manage procurement.

For non-government organizations, realistically, maybe some sort of public-private/foundation partnership, if the NSA is willing to bend a little. Which at this point might be in their best interest.

https://leanprover.github.io

While it is difficult to design a secure procurement chain all the way to the SiO2, we could at least design simple enough hw/sw systems for which formal verification is an economical option. And then force government entities to use formally verified systems instead of the bug ridden crap most shops, especially the sw ones, have to ship under intense deadline pressure. The market has led us into a broken local optima, no way to get out short of state level action.

> force government entities to use formally verified systems instead of the [current commercial options]

When do we complain about the even more expensive defense budget in this story?

It's been done for the OS (vis a vis seL4[0]), why not take a similar approach for the hardware? CSIRO[1] would happily take the funding!

[0] https://github.com/NICTA/seL4

[1] https://ts.data61.csiro.au/

This isn't going to help if the discussed is essentially tunneled through the Nat using legit protocols and traffic to the vulnerable service, where most of the attacks actually happen on the software side. How do you architect a firewall to accurately know if the application layer traffic is legit or not? It might not even be possible to fully implement something like this. Sounds complicated already. There is a reason firewalls are complex because the application landscape is extremely complex.

Source: Am Sr. Systems Engineer.

Isn't that what Apple is doing by forcing these "phone home" checks on all applications?

I agree with the concerns over complexity. That said, I see nothing in the article that indicates that a firewall appliance is the correct countermeasure. Defense in depth is likely what you need (and may ultimately get) here.

I am a huge open source fanboy, but there's nothing magical about open source that makes it secure against nation states.

> as a community we desperately need a fully open source FPGA-based ultra simple firewall appliance

Firewalls are sort of an anti-pattern. The idea of firewalls to most people is "let's make sure they can't get past this one network control and then we can stop thinking about security." But we've known for a long time that defense-in-depth is the only real black-box security strategy. Yes, it would be nice if we could get high-performance packet inspection and analytics for cheap, but by itself it's next to useless.

More than a "firewall" we need 1) federated authentication+authorization protocols to stick in between the network and application-layer protocols (these basically exist but nobody uses them, so it's time to make something trendy), 2) a standard for ephemeral credentials tied to identities (tied to #1), 3) a standard for supply chain verification in modern technology stacks along with a simple way to certify they've been followed. This ensures better integrity of network boundaries (authn+z rather than network security) and that the software along the way is secure against supply-chain attacks.

I don't know if #3 is even possible, but theoretically it is. Just maybe not with any network we have today.

This stuff doesn't have to be complicated. Large organizations should have an internal CA to handle authentication and it should be a policy to use any other method.

MITM is getting harder due to TLS improvements. Most traffic is TLS encrypted over a handful of destination ports.

I don't want to oversimplify, because there is of course an uncountable number of software packages and a lot of noise on any network. However, "super simple FPGA network firewall" is not going to save us. Trustworthy logging, least-privilege account credentials and a competent SOC, among a number of other things, are critical.

Many orgs know how to be secure, they just can't or won't be due to some financial or usability constraint.

https://www.cm-alliance.com/consultancy/compliance-gap-analy...

https://blog.cipher.com/hs-fs/hubfs/NIST%20Cybersecurity%20F...

The "have been hacked by" scale seems to have two settings:

0. Forgot to secure access with password.

100. Nation state.

I’m so glad to see more immediate skepticism now.

I really dislike how deflection pretty much absolved the actual hacker of any scrutiny or liability.

Its like the old bugs bunny cartoons where the hacker - bugs bunny - puts on a disguise and says “he went that way”

Seems about right, maybe add in 0.1 didn't patch 14-month-old RCE.

Excuse me, sir, all of our IT systems are always patched up to the most recent approved version. It says so right here on this contract.

0.09 - Installed the patch, just couldn't get Management approval for the downtime to reboot the machine for it to apply.

This is absolutely my favorite thing. I at one point had a weeks long debate about what "patched" means with the vuln scanning team. They couldn't understand why I thought checking the running kernel in addition to the file on disk might matter.

It's always a nation state. A great way to increase defence budgets and not have to admit incompetence.

I have seen a couple of corporate hacks (not publicized) who happened to be Russian groups hosted in Syria....

By state 'sponsored' it can mean many things, even if the countries just let them be and some officials get bribed to not do anything.

In this case it was in Syria, which is a fundamental mess, but the fact that it was Russian groups and they have military presence there, it is enough to put it 'state sponsored' label...

Edit: This was a purely commercial/blackmail type of thing, so I doubt it was the Russian government/Putin involved directly, but it could just be a side hustle of the same people that do try to hack government targets.

If they have the facilities and the state protection, might as well make some money on the side.

don't underestimate Putin's greed the very friends who are known to be connected to "private" militias operating in Syria, also own companies making money from all sorts of activities of regular people, like 2% of all regular household transactions goes through their bank etc

the Americans are making billions from raytheon, the Saudi coalition. The Obama administration sold weapons to saudi to kill yemen people.

greed comes worse from the other side.

he said putin specifically. An oligarch who stole a nation's wealth in a period of mass destabilisation; and is likely the richest person in the world.

I’ve seen these things, including large DDoS attacks from both sides, black hat and white hat. I’ve also been recruited by Cyber Command, NSA, etc. The one thing that rings true is that governments and corporations vastly overestimate the capabilities of nation states, and vastly underestimate the capabilities of unaffiliated hacking groups and individuals. Most of the cutting edge InfoSec work is being done in OSS and the public domain. The Snowden NSA leaks, although ancient history at this point, confirmed a lot of this for me. The only exception would be where the government can flex muscle in low tech applications they can throw money or legal resources at (MiTM/interception, obsolete tech like SCADA) but otherwise I’ve never been been impressed.

And if you arent RPCing into a random Russian computer 5 minutes after browsing darknet markets, what are you doing aside from being discriminated against by captcha’s all day?

I would not trust any declaration of “state sponsored hack” and it is a distinction that doesn't really matter but causes more harm than good

>...obsolete tech like SCADA...

...wow. you're aware that "obsolete tech" is what basically all critical infrastructure uses, right? The world is bigger than FAANG webapps...

>>...obsolete tech like SCADA...

>...wow. you're aware that "obsolete tech" is what basically all critical infrastructure uses, right? The world is bigger than FAANG webapps...

Wow! 2010 called. They want their ideas about what makes the world go back.[0]

That's just crazy talk. Everyone knows that hardware has been completely deprecated. It's all clouds. Mostly cumulo-nimbus, in fact.

Power plants, chip fabs, heavy machinery, machine tools, factory automation and logistics systems are completely obsolete and never, ever used anymore.

Because there's cloudiness, hardware is just a waste of money and space, which is why we can stack 600MB of js libraries on top of each other so we can have the browser render an opaque 40x40px box.

[0] https://en.wikipedia.org/wiki/Poe%27s_law

(Please refer to the above link reference to resolve any confusion.)

It's the hardware that's the problem so we should have an fpga cloud so you can run whatever hardware you want.

What would make that 600MB of javascript secure would be to auto-generate a random CPU architecture and recompile your server to run on it!

Stop it, you're giving Amazon ideas.

Id hazard a guess that unaffiliated hacking groups don't have the same capability as the following codewords protect.

FORBORNE PENDLETON PIEDMONT

They all seem to suggest some level of breakthrough with regards to cryptography, including public key cryptography.

Yeah if I were a blackhat I would launch all my attacks from a cheap VPS in Tehran and sprinkle random Russian gibberish throughout my binaries.

Guaranteed nobody will come looking for me.

Sincerely yours,

Evil mastermind

Twenty-five year ago that would fool people. Now things are complex enough that you can't help but leave clues even as you're trying to plant them.

The DPR was caught in part from a post on Stack Overflow where he was asking a question unique to his platform. Imagine how hard it would be to write the Flame malware. Now imagine the NSA and CIA hunting for traces afterword. Building that malware required deep information on many system that would likely require badges or intensive social engineering to access, both of which leave traces. Do you really think you could hide?

I'm an expert (of sorts) and I'm not sure that I could buy drugs on the dark web 100% securely if those resources were hunting me.

You can try to blame somebody else (or even multiple people) by leaving deliberate traces. Cyberwarfare is the most assymetric warfare that we have.

No, virological warfare gets that award.

And I don't mean computer viruses.

Yeah I'd be safe. If they were looking for me they would find me, but as soon as somebody shouts "Teh Russianz Did It!" everybody stops looking!

Key fact of government is that it NEVER fails, NEVER.

It always just a matter of spending a few more billions in tax payer money, you see the program/agency/task/what ever would have work perfectly if we just spend more money

What if it's Lupus instead?

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted and audited apps are run on the system, there will always be zero day exploits. Science has come up with no possible way to provably secure network connected computers. So do not trust them any more. Please prove me wrong, but I doubt you can. The most trusted computers in the world have repeatedly been hacked. And even if you could make a secure computer, people can not be trusted because there is always some way to compromise them. Maybe the best we'll ever be able to do is assume a system will eventually be compromised and concentrate on minimizing damage and fast recovery. Removing the incentive to compromise computers could be a solution, but that seems even less likely given our million year history.

To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured."

It's an open problem in science to prove security of a network connected computer. It's well known.

Really? What's that problem called? As you stated it, it seems too vague to be considered "open" or "closed".

Provable Security:

https://en.wikipedia.org/wiki/Provable_security

If you read that article you'll see that current approaches don't even attempt some kinds of proofs such as proof of security against side channel attacks. It goes by other names as well such as proof of code correctness:

https://www.schneier.com/blog/archives/2009/10/proving_a_com...

A major problem with current attempts at proofs is you can at best create a proof based on a system specification and what you want it to be secure against, which basically means you have to already know all possible attacks including zero day attacks. So far the field has resulted in nothing practically useful as far as I know. Homomorphic encryption might be close to being practical for a limited set of problems and could be provably secure for a limited set of attacks, though I don't know if anyone has attempted such a proof yet.

Thanks. That sounds about as fruitful as I would have guessed.

>To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured."

How so?

In fact, competent InfoSec folks will tell you that you should assume that "if you connect a device to the Internet, eventually it will be compromised."

That's not to say a device will be compromised, but making such an assumption, given the history of Internet connected devices is an eminently reasonable one.

I've yet to see any formal proof that computers connected to the Internet can be secured.

If you have, please link a reference. I'd love to see it.

Extraordinary claims require extraordinary evidence.

But even ordinary claims require ordinary evidence.

The burden of proof is on the claimant, not the defendant. I believe that's the point parent was addressing.

>The burden of proof is on the claimant, not the defendant. I believe that's the point parent was addressing.

Absolutely. I was pointing out that in this specific case (whether or not devices connected to the internet can be secured), the converse is also true.

You bring up a very good point and it's worth reiterating that the Kremlin reverted to use paper instead of computers to discuss sensitive topics. [1]

I wouldn't be surprised if any network connected device is vulnerable to being exploited, even if not directly connected to the internet, by association of other devices on the network.

[1] https://www.usatoday.com/story/news/world/2013/07/11/russia-...

>It's time to admit that computers connected to the internet can not be secured.

That ship sailed a long time ago.

It was normal back in the 1990s for InfoSec folk to assume that "if it's connected to the Internet, eventually, it will be compromised."

The goal (then, as now) is to implement layered (defense-in-depth) mechanisms to deter such activities -- at perimeters, network and systems infrastructure platforms and software implementation.

This is (and has been for a long time), a well-defined, although usually poorly (if at all) implemented set of processes and procedures.

The levels of complexity for Internet resources have vastly increased over the past 25 years. Info Security techniques have advanced as well, but again are often poorly or not at all implemented.

However, far too many organizations implement a "Skittles" type defensive posture rather than defense-in-depth posture.

There are a variety of reasons for this:

1. Those responsible are ignorant of good security practice;

2. Those responsible are aware of the risks, but ignore it as it negatively impacts profit;

3. Those responsible are aware of the risks, but implement inadequate defenses because of the impact on time-to-market and/or profit.

4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration.

There are other reasons, but those are the big ones, IMHO.

True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not.

The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.

>True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop.

Perhaps I'm a little dense, but I'm not sure what you're arguing here.

Are you asserting that since sophisticated threat actors exist, security processes and procedures are useless, and as such, shouldn't be adhered to or implemented?

No, I'm saying researchers ignored APT's for decades and now that they are available to everyone many current security processes and procedures are less effective, and yes possibly useless, _regardless_ of whether sophisticated threat actors exist (because their tools have been exposed). Current processes and procedures should still be used because they are all we have, but something new is also needed. Part of that something new should be an acknowledgement that systems are unprotectable, so instead of just security procedures we need, for example, faster recovery procedures (not just restore from backup). Another example might be dual implementations of systems, built with different technologies, so that when one is compromised the other is less likely to be susceptible to the same compromise. Expensive, but that may be what it takes to keep the world running. Splitting the internet into layers of VPN's with everything having it's own VPN might be useful too. The internet is fragmenting anyway, might as well fragment it in a useful way. Maybe everyone should have multiple physical computers as well, one for each work project, one for play, one for home finances, etc., each with tailored protections and no connections between them. I'm not sure what the answers are but it's obvious what is being done now is not good enough. I do fully expect to see the IRS hacked, chemical plants destroyed, factories stopped, etc. the way things are going now. Simple ransomware is already causing major problems and there seems to be no way to stop it and it's going to spread to all sectors and it seems likely there will be ransomware without the ransom too, just pure destruction. Already happened in Saudi Arabia.

>No, I'm saying researchers ignored APT's for decades

That isn't even close to being true. In fact, that statement is ridiculous on its face.

Research into detecting, mitigating and countering such attacks go back at least 30 years.

That APT actors have often been successful is more a function of effective execution and poor security practices than lack of knowledge/research around such attacks.

How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for.

>How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for.

Police are credited with making arrests, but are almost never credited with treating people with respect.

By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community.

Doing the right thing for the right reasons is (or should be) a thing. That it isn't doesn't say much for those who ignore an important aspect of software design.

I've always striven to meet the ideal that "if it's worth doing, it's worth doing properly."

I suppose that I shouldn't hold others to the standards I set for myself, but sometimes I still do.

Feel free to be offended, but I stand by my original statement:

"4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration."

> Police are credited with making arrests, but are almost never credited with treating people with respect.

> By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community.

No, by their argument, to the extent your first quoted sentence is true, police are (not “should be”) encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community.

Which seems pretty accurate.

>Which seems pretty accurate.

Exactly. Which is why it was a good analogy WRT the lack of security baked into the design of most software.

> the most egregious offenders are software developers

Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it.

>Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it.

I get that a variety of pressures are put on developers to add features and ship quickly.

But whether it's corporate development done internally (e.g., LOB applications), a web app or a SaaS offering, not designing security into the software is a disaster waiting to happen.

So many times I've seen businesses have their crown jewels ripped off due to poorly implemented/weak or non-existent security practices in application design/development.

Even when the infrastructure is reasonably well secured, with defense-in-depth, including strong authn/authz, separation of duties, as well as strong security processes and policies in place, software that lacks designed-in security can render all of it useless.

Whether that's because the software doesn't/can't integrate with the security tools in use (often requiring applications to run with much higher privilege than they should) or because little or no thought was given to secure coding mechanisms or access controls.

I absolutely understand that there are always security trade-offs, regardless of where in a multi-layered infrastructure/management/application environment.

And it's always important not to expend resources beyond what's appropriate for the assets being secured.

That said, application software is the most frequent culprit in enabling compromises (followed closely by poor security implementation in the infrastructure and a lack of policy/process in securing it -- usually through ignorance/incompetence).

My argument is not that developers are stupid or ignorant, but that security isn't baked-in to their design decisions as a guiding principle.

And that often leads to insecure software and/or sloppy/insecure integration of security after the fact.

If more developers thought about security as a feature rather than an inconvenience to be given little thought or just lip service, that would make a big difference.

Edit: Clarified verbiage and fixed typos.

Show me a single project where the functional specs were complete when given to the developers and external concerns didn't dictate any implementation details. All of the projects I've been on have had changing specs, right up to and through release.

I love the architecture weenie role. It's tons of fun. But eventually you need to build something and only with experience do you discover the first set of complications, then marketing starts promising features and you've got the next, and management refuses to allocate more time.

Did you do something wrong at step 1 by building a prototype before knowing it would be perfect? And if so, how could you know that and what would you do to get there?

I write the code, and tag releases, but I don't determine what ships. I, and 95% of us, are not engineers and even those who are have abrogated their responsibility to make the bridge stand - we're all just building individual struts because someone told management that things done in a vacuum will all fit together properly in the end.

So I agree I guess, but don't at the same time.

>So I agree I guess, but don't at the same time.

I suppose I do too.

While a lack of designed-in security is often the (sometimes disastrous) result, I posit that it's more about a lack of knowledge/education around good software security design/implementation than spec changes or scope creep.

If good security design practices were stressed when teaching software development (and/or included in resources for autodidacts) and given the same value as other development concepts, developers would incorporate those concepts from the start, rather than having to bolt them on (or not) later on.

As such, it's more about lack of knowledge/focus/value placed on security in software design/development.

Given the value of data that being secured with software, good security practices should be, if not just as integral, to software development as performance or UX design, it should at least be a consideration before prototyping.

> I posit that it's more about a lack of knowledge/education around good software security design/implementation than spec changes or scope creep.

It probably depends on what your team is good at. I tend to work in fairly security conscious teams. They check the length of buffers, don't rely on anything from the user, etc. So most of our issues tend to be from our architecture being drastically changed to integrate our solution into something else, or vice versa. Stuff is dropped on us, opaque libraries and internal code, and entirely new goals created around the big stuff, data persistence, key management, and so on.

But when I had an actual stable product that could not get spec changes (it was custom hardware) we knew from the beginning how the project would go and how all of the pieces would fit and it went together cleanly. But, it turns out many embedded engineers don't (didn't maybe, it was a while ago) program as defensively because they're used to owning the entire scope. If they put a value somewhere they expect it to be there, unmolested, when they want it. That project was full of buffer overflows and bad crypto.

> If good security design practices were stressed when teaching software development (and/or included in resources for autodidacts)

Yeah. I'm not sure how but it does tend to be lacking. Everyone probably needs a different hook. For me it was quality. How could I say my software does X if you have a way to break it?

This is equivalent to me saying I blame security researchers because they don't develop software which forces all software paradigms to follow rules that implement perfectly secure software

> It's time to admit that computers connected to the internet can not be secured.

Iranian centrifuges were air-gapped (ie no internet connection) and they still got hacked by Stuxnet via USB. https://en.m.wikipedia.org/wiki/Stuxnet

We are well past the point where even stuff that's not connected to the internet can not be secured.

I am bit skeptical of the accidental USB insertion story.

A secure air gapped network won't have open USB ports . Only privileged users who know what they are doing should even have access to a port.

there is a saying in infosec, "not if, but when". no one is under the dissolution that we can keep a network perfectly safe, we just implement layers to mitigate damage

I think it is just a problem between theory and practice. In theory it is possible, but in practice it has proven to be so hard, that I am not sure if there ever was or will be a secure computer that is connected to the internet.

Another problem is that the complexity in modern systems is increasing and designing secure systems on top of complexity is next to impossible. I think Unikernels have a good chance of delivering secure systems from a software perspective, but it seems even modern hardware has enough vulnerabilities to thwart those plans.

My company was the target of a rather interesting office 365 hack. I would not be surprised if the hackers gained access to the Treasury the same way.

A link sent from an existing trusted sender was sent to one of our employees from a vendor’s procurement director, inviting us to an RFP. The link took the user to a “notion.io” page. I do not recall the contents of the page (may have been a login spoof, but it didnt matter).

The hackers then appeared to hijack the “remember me” login session from our employees Chrome.app. Within a few hours, online webmail logins (edit sessions not logins) were occurring all over the world for this user’s mailbox. The hackers then spread the “virus” by emailing this employee’s known contacts the same spoof.

I don’t think Microsoft ever fixed the bug, as far as I know. Our method to protect ourselves was to upgrade to IP restricted logins on a higher level of Microsoft 365, and disable the “remember me for 30 days” feature. We’re debating turning off access to web-mail entirely because it does scare me that I think its still possible to do.

Anyone else experience this?

How did you determine that the attacker hijacked the existing O365 session rather than logging in with the phished username and password? For an app like O365, usually that kind of cookie-stealing doesn't happen without malware on a user's computer.

This was about 6-9 months ago and I didn’t lead the postmortem, so to be honest I don’t recall how we determined that.

However anecdotal, the user who was compromised is aware enough not to re-enter their credentials outside URL schemes that match our password manager database, and they wouldnt have entered anything.

“Oh but how can you trust the user, they clicked a bad link?!”... again this email came from a very reputable vendor who we email with regularly, and the link would have been completely normal for a Monday morning in Q1 2020.

I also think part of our reasoning for why the credentials were not re-used was because all the sessions seemed to be headless chrome sessions, but no logins.

I’m not a data security expert, but in my best summary, it seemed they: - Had a “virus” that spread really well. I’m assuming they had two kinds of users. Spreaders, and targets. Our employee was a spreader, sending this bug out to his/our network. Once the targets were hit, they’d be selected out of the spreader pool (so the hackers could remain undetected). - The hack relied upon identifying ,mutually high volume (trusted) email senders. - The hack had something to do with leveraging the platform of Notion.io. Unsure if there is a bug on that platform which was also being abused, or if they just have a good system for hosting phishing pages. - The user’s authenticated sessions seemed to be hijacked and replicated across the globe in headless chrome browsers, which appeared to renew the session until the hack ended.

I sympathize, it's difficult to get a satisfying answer in a situation where you trust the user to accurately remember and own up to a mistake. You need both good logs (Microsoft's default logging and retention usually don't cut it) and a security vendor that knows O365, AAD, and the attacks on them well enough to make useful conclusions.

Notion.so is popular for phishing pages because it's a "reputable" "enterprise" application that doesn't raise the spam score when it's linked to in an email, can require signing in to view the page which further deters spam filters that actually check the links, and has less robust anti-phishing systems than Google Docs and Sharepoint (which are still used for the same purpose but require more tweaking of the template to avoid being auto-flagged).

We actually had something similar happen, almost to a “T”.

Individual’s account was compromised and was used to send emails to their address book asking them to review an RFP. They would then delete the emails that were sent and the account owner was none the wiser.

I am not 100% certain as to how the initial compromise happened, but it was an O365 environment and MFA was on. O365 did pick it up and send an alert, but due to a configuration error it did not disable the account.

Anyways, it worked out and we transitioned to M365 as well.

Would either of you be willing to chat about your experience?

I work for Abnormal Security (https://abnormalsecurity.com), and we build products to try and catch these type of account takeover attacks.

You can reach me at egreenstein@abnormalsecurity.com.

Would MFA have prevented this from happening?

Unsure the user did not have it enabled.

Edit:: Another commenter in this thread indicated MFA did Not protect them.

If this is really an exploit of Microsoft's authentication services, then who knows what all got hacked. More likely, a Treasury IT admin got phished for their password, no?

And if this is a hack of data hosted on Microsoft Office 365 servers, how does it get detected?

Does Microsoft implement traffic monitoring for high-value clients?

Or do sophisticated organizations embed tracking pixels in emails to see what clients load them, and then check that those are authorized clients?

Yes, I’m quite certain they can/do, as it is a requirement for FedRAMP.

However, the US government has their own IDS/IDP that they use for the .gov domain, namely EINSTEIN (and its variants).

Don't confuse the .gov DNS/email domain and network monitoring tools like Einstein. The brave new world of govt cloud computing use makes this not as straight forward as it might have been 10 years ago.

That’s a good point and one I had thought of afterwards. That being said, I have to imagine there is some kind of perimeter established, which cloud providers would exist within (at least the FedRAMP accredited segments).

Then again, I have seen crazier things and sometimes government takes quite a while to catch up with technology implementations.

So apparently Russian hackers were able to infiltrate the Office 365 accounts of multiple federal agencies.

They were able to do to this by targeting one of the government's suppliers, a company called "SolarWinds" in Austin. The hackers were able to slip their software into a software update from SolarWinds over the summer.

And get this: "SolarWinds says on its website that its customers include most of America’s Fortune 500 companies, all top ten U.S. telecommunications providers, all five branches of the U.S. military, the State Department, the National Security Agency, and the Office of President of the United States". Yikes.

curios as to how Russian hackers slipped their software into solar winds. sounds like a major breach.

If I had to guess, probably some kind of social engineering attack. Identify the supplier. Go on LinkedIn, look for employees of that supplier with a title that would imply sufficient privileges to enable the attack. Then get to know that person and target them personally.

Or become employed there and go for the long con. How many companies check in go vendor code or pip install from CI? Ripe targets for abuse

Where I work we forbid this kind of behavior but you would not believe the kind of pushback we get for "making things too difficult".

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques.

The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.

It was very sophisticated and I’m glad I fell for it during a simulation rather than in a “real life” situation. It was a learning experience and a situation I’m way more paranoid about now. I could easily see admins and developers anywhere falling for it if they were specifically targeted.

Organizations that are serious about security should not allow random OAuth apps. Both G Suite and O365 admins can restrict what OAuth apps are allowed.

Agreed. However some service providers (like GitHub) allow a user with admin access to approve any OAuth app the first time it’s “launched” if they are the ones initiating the request, rather than using a pre-defined allowlist approach which I believe is what Office 365 does.

My wish would be for some sort of multi-person approval process rather than allowing anyone who is an admin to authorize an app. Even admins can be susceptible to a targeted and advanced attack.

Also, many people (like myself before my own “failure”) simply aren’t aware of OAuth apps as a serious attack vector. Most remedial training around phishing campaigns covers things like fake login pages but not “An attacker has spoofed an internal domain and an OAuth app with your company’s name in it”.

Domain spoofing takes care of any such restriction.

> The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.

This sounds like a post I saw on Reddit a few days ago.

This person's IT organisation had been talking about migrating to Github Enterprise, they got an email saying that it had been rolled out from an internal IT mailbox to an OAuth application that had been pre-approved on their Github Organisation.

For that particular scenario - if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway, since to approve the application they probably needed Admin rights anyway.

> if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway

In my case the email came through due to a “bad” DMARC configuration so they were able to spoof our domain from an external server and the OAuth app in question had our company’s name on it.

And on a personal front, I was busy that morning and didn’t pay enough attention to the permissions being requested by the app before I clicked “allow”. So it was a failure of both systems and people controls.

My new rule is that if I get an email asking me to do any sort of action, automated or not, I’m going to sit on it for 1-24 hours before doing anything about it. If it’s actually urgent then someone will get ahold of me through some other method than email.

Looks like LinkedIn is a big security concern, I won't miss it. Imagine if companies require that you're ~not~ on it.

Not only linkedin but all job portals.

The security heads of the previous companies I worked at all obfuscated their LinkedIn profiles.

don’t post current work place until it’s over.

An insider got them access to a trusted signing certificate would be my first guess.

PKI remains a pain in the ass and very few organizations do it well.

Shit, SolarWinds is how MS does a lot of its electronic software distribution. I've received multiple things from MS SolarWinds download links.

...and yet somehow people tell me I'm crazy when I demand that software not autoupdate without user intervention.

Automatic updates are RCE vulnerabilities.

In this case, it doesn't appear to me that having the update be a manual process would have made it any easier to detect.

No one is arguing a compromise of the update server doesn't allow compromising all customers. They're arguing that the benefits out auto-updating software (especially consumer software) outweigh the risk of a compromised update server, which is generally true.

What about users who don't consent to that, who would prefer to manually update in a safe manner?

Making the decision for a user is the issue. Consent to run software A on Monday is not consent to run unknown/unexamined software B on Tuesday.

In the vast majority of cases, receiving userspace updates in a timely fashion is not worth this real-time remote access vulnerability.

To be clear, given that one never knows if or when a provider has been compromised... is the plan to just not update? What if they were compromised before you initially obtained the software? There's not much that can stop attacks like this. Preventing lateral movement, escalation, exfiltration, detection, and remediation, among other things, would be the way to go.

Depends how you weigh timing. If attacker doesn't know when you update, they have to hang out and risk detection at the supplier. (Who added this update?) If they can push updates, they can move quickly and compromise the target.

This is the key. Additionally, updates can be verified to be the same thing that everyone else got, by checking them from multiple different clients/IPs/countries. Targeted attacks are much harder, and if the compromised update is untargeted, detection risk increases drastically.

Some companies (and even some individuals) are of the opinion that, since they are "good" or "smart" or spend $x amount for "security", they aren't going to get compromised. Even worse are the ones who still concentrate their efforts on their firewalls and assume that, inside the network, all is well. They're the ones whose networks and systems are going to be completely and thoroughly "pwn3d" when someone does eventually get in.

Nowadays, the general attitude amongst the "experts" is to assume that you/your company/organization WILL -- at some point -- get compromised and to, instead, plan for that eventuality and work to minimize the damage an attacker can do once they have gotten a foothold inside your network.

That means doing just the things you mentioned: preventing oateral movement, privilege escalation, and exfiltration of data, concentrating on RPO/RTO (a.k.a., getting things back up and running as quickly as possible once the shit hits the fan), and so on.

I've certainly not heard of anyone recommending that software and systems NOT be updated. There's only so much you can do, though. You can make sure that all of your software is only coming from "trusted sources", verify the published checksums (if any) and attached digital signatures, scan files with an up-to-date anti-virus (although, nowadays, that may not actually be worth anything), and yet STILL get hit by something like this.

So, you do what you can, try to protect yourself and your organization as best you can, and prepare yourself for when the day comes that it's your name in the headlines instead of the Commerce Department and Treasury Department.

(Personally, I'm of the opinion that if a nation-state wants in your network, they will -- one way or another -- get in. I'm looking forward to the day that hosts don't have a default route, are blocked at egress, and all "external" traffic has to go through firewalls and proxies before it can get out.)

> There's not much that can stop attacks like this.

Not giving people RCE on your machine will stop attacks like this.

That's not the case here. Updates going back as far as what, March?, with no indication that the update included this, were involved here. What I'm saying is that whether you, or an automated update process are performing the update... You still are susceptible.

Unless, as I said, your idea is to block updates completely, which is... not really viable.

What should these companies have done better for the update side? Sure, there were other controls that could have limited the effectiveness of this once the update was in place, but I'm not seeing anything that would block the update itself.

You gave the vendor RCE when you installed their software in the first place.

Automatic updates are overall a huge net positive for security, despite this hack.

Election officials in two counties claimed that an automatic update to Dominion machines was to blame for their multi-hour outage during the election. Automatic updates are not only vulnerabilities but can undermine trust in elections.

https://www.politico.com/news/2020/11/04/georgia-election-ma...

If Windows didn't autoupdate without user intervention, the number of hacks and breaches would be thousands of times higher than it is today. Ordinary people do not update if they're not forced to; it's unpleasant but true.

Interesting that they're called SolarWinds. They make netflow analysis tools... kinda like Stellar Wind.

I picked up on that too. I guess that means SolarWinds is a good target for nation-state level hacking

I believe it was an insider.

I have personal experience delivering software/software updates to the USG. I'm actually baffled as to how something like this can happen without an insider. I've never had any slight sliver of concern over the security of our supply chains.

The said it involved a manual supply chain breach. Sounds like an insider with a USB drive.

I believe not everyone always checks the checksums.

"Never ascribe to malice that which is adequately explained by incompetence"

I'm sure malicious people are very grateful that this platitude is in circulation.

Calling it a platitude is selling it short. Yes, it's a little strained in the context of people trying to deceive you, but the malicious are still vastly outnumbered by the incompetent.

In general, I agree that most bad things happen by accident, but I think generally it's an unhelpful statement. You should be slightly more suspicious of someone claiming innocence when they clearly experience benefits from the consequences of their actions.

Windows checks the signature.

My point was that without in insider there's probably 50 easier ways to drop malware than infiltrate the software supply chains that I've personally been a part of.

This is obvious not good, but just to note, when they say "the Office of the President of the United States", they're most likely referring to the Executive Office of the President (EOP), which consists of a few thousand employee, most of whom are non-partisan career civil servants. It's a much broader group than what it sounds like.

https://en.wikipedia.org/wiki/Executive_Office_of_the_Presid...

SolarWinds also owns some SaaS companies that seem popular among small-to-midsized tech companies; Pingdom and Loggly are a few that I’ve seen at more than one job.

"I asked Putin if he hacked us and he said they didn't."

Could you please stop posting unsubstantive comments to Hacker News? You've been doing it a lot lately and we're trying for something different here.

https://news.ycombinator.com/newsguidelines.html

So the NSC met yesterday about this hack, and yet they're already reporting attribution, including:

"...three of the people familiar with the investigation said Russia is currently believed to be responsible for the attack. Two of the people said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye"

Reuters obviously not going to get comment from Russia, but decided to throw this in: "The Russian foreign ministry did not immediately return a message seeking comment late Sunday."

"This is a huge cyber espionage campaign targeting the U.S. government and its interests."

"“This is a nation state,” said a different person briefed on the matter."

And yet: "The investigation is still its early stages and involves a range of federal agencies, including the FBI"

Everytime I hear about Office 365, it's always with respect to some vulnerability or downtime.

Or maybe some solid likely illegal spying on employees.

For me it’s usually complaining about what the fuck shit they have done to outlook. It’s like a train in Mumbai at rush hour these days.

Could you expand on that?

We're moving to 365 and I'd like to know what f*ckery to expect. =(

Just generally they spent the last 10 years cramming so much crap into the outlook desktop client that it’s horrible to use. The web client is better than the desktop one now.

Rest of office is pretty good. Do not worry about this. It works well.

That might also be a bias because very few companies or organizations use things like open office (or the google suite for that matter) so there would be fewer people interested in attacking those software suites. Also it’s more fun to report on bad stuff that happens to Microsoft then and stuff that happens to some relatively small and unknown software company.

Growth for Google Workspace (previously G Suite) and Office 365 is insane. Office 365 has >258 million paid seats[0], while Google claims they have 2 billion paid seats (or "users")[1]. Soon enough more businesses will be using one of these than those that aren't (as in, those that are using Exchange or another email server).

0: https://office365itpros.com/2020/10/28/teams-115-million-use....

1: https://www.axios.com/google-g-suite-total-users-9a6d3df6-c9...

Google claims 2 billion users across all their cloud services, not paid seats.

For example, if you have a hangout and invite 20 people, that's 20 users. You don't have to be logged in to use a hangout link, so if you join another hangout later, and still aren't logged in, you're a new user.

2 billion paid users would mean that 25% of the worlds population pays. I guess Android is probably a big part of that.

The axios article says:

>Soltero declined to offer a breakdown of how many of those 2 billion users are for products beyond Gmail or how many are paid versus free.

"System operating normally" isn't a story.

Too many snarky and overused jokes in this thread.

Anyway, was this hack related to the one for FireEye last week?

Fourth paragraph in the article:

> Two of the people said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts.

The hack involved the creation of counterfeit tokens, essentially electronic indicators that provide an assurance to Microsoft or Google about the identity of the computer system its email systems are talking to. By using a flaw that is extraordinarily difficult to detect, the hackers were able to trick the system and gain access.

Source: https://www.nytimes.com/2020/12/13/us/politics/russian-hacke...

That could refer to anything from an OAuth consent attack (not much more sophisticated and arguably easier than phishing a password but much less likely to be detected because most companies don't know they should be looking for it) to actual exploits against Azure AD or a third-party authentication provider. If the latter, I hope that Microsoft/FireEye decide at some point decide to be transparent about what was possible and how they're going to prevent it from happening again. I have enough doubts about AAD's ability to generate enough forensically useful logs as it is.

I find the timing of these reports interesting. They tell a story of a nation state adversary who has been behind our lines for months. If true, I assume we have known, but reporting up the chain and especially to the public has been...prevented. Now is the first calendar time- at the cusp of the electoral college vote- when these reports reaching the public may lead to positive action in response.

If these reports and this surmise bear some resemblence to reality, I look forward also to seeing more reporting about steps and countersteps taken in response to these breaches. The timing for this reporting is too neat to not be intended to spur some stronger response.

How do they know it was backed by a foreign government? I would immediately suspect China or North Korea but that seems too obvious and a bit of a setup?

Could be just about anyone. Knowing what USA has done, it seems that even this type activity is standard even between "friendly" governments....

Yeah, pretty much everyone has been doing this all time, as long as they have the capability...

Yup. Jon Pollard, for one. He spied for Israel.

Israel certainly has the chops to do something like this, but lots of other "friendly" countries with good geeks wouldn't mind having this kind of info.

I would bet on China, not Israel. Nation-states calculate risk/reward. With Jonathan Pollard, the reward was huge: getting your own nukes. Hacking the treasury? Not sure what Israel would gain from that; the costs of being perceived to attack a friend would be relatively higher. Whereas China has obvious reasons to want to know what US economic policymakers are thinking, and has little to lose in terms of reputation.

> and has little to lose in terms of reputation.

Nothing to lose at all. Deny the attacks and thank the news gods for publicity that distracts from reporting on their ongoing concentration camps.

> the costs of being perceived to attack a friend would be relatively higher.

Don't think israel is really concerned about attacking "friends".

https://en.wikipedia.org/wiki/USS_Liberty_incident

They live by different rules when it comes to the US due to their control/influence over our political parties, media, etc. But you already knew that.

I said they were concerned about the possible reputational loss. I am also skeptical of overblown arguments that Israel "controls the US media". These tend to shade into antisemitic conspiracy theories. The incident you link seems to be a good example: I see little to persuade me that the USS Liberty wasn't sunk by accident.

I don’t know a lot about how states conduct cyber espionage against one another, but it does feel a bit off to be told that this was the work of a nation state with zero proof as to why.

It worked (a lack of acknowledgement that identities can be spoofed) for the "Russian hackers / disinformation agents" on Twitter meme, it will likely work just as well here.

I think sometimes the proof they have isn't proof they're willing to publicly admit they have because they don't want to let on how they know.

After Jamal Khashoggi was assassinated, for example, it turned out audio of the entire murder had been recorded through surveillance. (I'm still not sure we ever found out how exactly it was recorded?) So there were lots of announcements that certain governments "knew" or "suspected" it was Saudi Arabia with little or no substance to back up their claims until the existence of the recording was later leaked.

I think there was similar discussion after MH17 when western governments "knew" Russia-backed rebels had shot down the plane and only later did we learn there was a recording of a conversation about what happened.

I guess even after Snowden governments like to do their best to pretend they don't have the entire world under surveillance at all times.

Don’t they usually have “styles” of intrusion? I’m certain I’ve read in the past where intelligence agencies could differentiate between Russian backed styles of hacking and Chinese backed styles of hacking. I’m sure Americans have their own style of hacking as well.

I would say it’s also quite likely that the US knows who did this or has known who has been doing it for a while. It’s highly unlikely that this press release wasn’t coordinated by the intelligence agencies to play into some advantageous scenario they’ve drawn up.

If there are such styles of exploit, which means it’s public knowledge, sounds like a great way to cover your tracks then. Just make it look like the other person.

Some of it is based on analysis of the actors motives - if you have 0-day works on fully patched Office 365, that took months/years to work, and throw it at a US government agency, you're clearly not in it for the money, _and_ you have no qualms about blowing your exploit.

Well if you are targeting Treasury it could be to act on information not yet made public in the stock market.

Maybe when they hacked it they accidentally left behind a todolist.txt of "First we hack Solarwinds, then we go after Moose and Squirrel..."

Attribution is tricky, but nation-state actors have resources that no other threat type (organized crime, hacktivists, etc.) can muster: multiple 0-days, advanced tools, obviously deep field of programming talent, inside info about targeted networks/apps, etc.

Not to mention, that forensic analysis of tactics, tools, etc. often clearly point to borrowing/surveiling of other APTs.

It's a good way to get the people banging war drums and funding defense budgets.

“The hackers are ‘highly sophisticated’”

Has anyone ever said they were hacked by a group of unsophisticated group of script kiddies?

FireEye, a Top Cybersecurity Firm, Says It Was Hacked by a Nation-State. The Silicon Valley company said hackers — almost certainly Russian — made off with tools that could be used to mount new attacks around the world.

https://www.nytimes.com/2020/12/08/technology/fireeye-hacked...

This is a tangential aside, but the school system our kids are in get "Your credentials have been leaked and should be changed immediately" warning from iOS devices when logging into their Microsoft 365 accounts.

Seems like a commonality between the two that happened recently (2 weeks ago for us).

This is just an observation, nothing more. I'm sure MSFT spends a fortune on securing that platform (among other things).

FireEye describes:

> "Multiple trojanzied updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website, including hxxps://downloads.solarwinds[.]com/...

So does this mean that the attacker masqueraded as SolarWinds and somehow (brute force?) forged the signature? Or that the attacker had agents working at SolarWinds?

By the way, is there a report on how many foreign governments are being hacked per year by the US (or Russia/China/etc.)?

This report reads like 'Russia attacked the US in cyberspace' when there is no transparency about the quantities of cyber attacks by governments in the world.

Has the US Treasury attempted to offer the hackers a $1000 bounty for discovering a security defect?

With all of the outrage being expressed from those in media and government about the dangers of free speech because of the potential for "disinformation", it would be nice if everyone took a step back and examined how this report is being discussed.

We're under attack by the Russians(again), according to anonymous sources(again) that are purportedly government officials. Where is the skepticism? Are we simply to, yet again, blindly accept evidence-free assertions made by anonymous government officials? As technically literate people know, it can be very difficult, if not impossible to determine who exactly intruded into a network, even in the best of circumstances. As historically literate people know, evidence-free government assertions of attacks by our "enemies" are often baseless, deliberately misleading, or outright fabrications.

The Treasury may very well have been hacked, and the culprits may have been Russians, but its madness to believe any of this without evidence that be scrutinized. There's been a lot of recent outcry for "gatekeepers" that sift through disinformation and decide what people are allowed to see and hear. As illustrated with this article(and the reception it has received), the problem isn't the existence of evidence-free assertions, its the uncritical acceptance of these evidence-free assertions. We need to maintain our skepticism and maintain the same demands for evidence regardless of what assertions are offered or who they are offered by. Lies and unsubstantiated statements are just as bad (if not worse) whether they come stamped with the approval of officially designated gatekeepers or not.

> people familiar with the matter

Not buying off on more than the fact the report was made.

Skepticism is the order of the day.

I wouldn’t be surprised if this was Fireeye figuring out how they got hacked, then them or federal investigators checking around to see if it was done anywhere else.

This is exactly what happened.

I wonder why more attacks are not attributed to businesses. They have lots of resources and would benefit from attacking government agencies and competitors.

A salaried employee has absolutely zero incentive to take on that risk unless ordered, and the same would go for whoever ordered them, so it just doesn't really happen. Companies would love it, but at the end of the day people just don't take risks like that when they could simply choose not to and likely be just fine.

But a company officer can just slip cash to a third party in another country to launch an attack. Maybe that's the explanation, that that kind of thing is difficult to attribute.

They totally could, but honestly if companies could get their employees to do even that they'd probably be a lot more efficient, for better or worse.

Most salaried employees aren't willing to risk going to prison for their paycheck.

Seems like the US Gov went all in on O365 and is now paying dearly for it.

Maybe trusting Microsoft with the keys to your kingdom is a bad idea.

The Australian Government has gone all in with O365 as well

To quote a Heavy Metal Icon:

"Peace sells, but who is buying?"

Let's start a war, based on this "hack"!

"Ramstein Air Base in Germany Experiences Potential Incoming Missile Scare"

https://news.ycombinator.com/item?id=25409459

Seems some are interested in keeping the populace scared. Wonder what scare tomorrow will bring.

"monitoring internal email traffic at the U.S. Treasury Department _and_ an agency that decides internet and telecommunications policy"

That's an interesting way of saying a U.S. organization. Does this mean the NSA? I would have assumed they were talking about the FCC, but why not name them?

The article mentions that the other organization is the National Telecommunications and Information Administration (NTIA).

No, the NTIA. It was probably described that way because most people wouldn't recognize the agency or acronym.

For anyone who's not familiar, the NTIA is basically the FCC for the federal government itself. They allocate spectrum, create policy, etc.

It’s mentioned further down

> Treasury and the Commerce Department’s National Telecommunications and Information Administration

https://sputniknews.com/us/202012131081447209-us-treasury-ha...

Does the US conduct offensive cyber operations like this?

I feel like we never hear about them in the news.

History is written by the victors, as they say

The United States has admitted to perpetrating coups to get a us-friendly dictator in otherwise democratic societies: https://www.youtube.com/watch?v=_2khAmMTAjI

Curious how this is connected at all to my question?

I know "America Bad" is trendy now, but I don't see the connection.

Espionage is less aggressive and overt than perpetrating coups in democratic societies.

His question was "does the US conduct cyber espionage", not "does the USA do bad things?"

Let's not let every post about international politics degenerate into a contest about which state is the wickedest.

Please, this isn't Reddit. The US just happens to be part of the list of bad guys together with Russia, North Korea, Israel, PRC, etc. The difference is that on sites with a lot of US users pointing the finger at the US is more often than not seen as someone being Edgy or whatever while pointing it at Russia is cool/patriotic/stating the facts/etc.

This. Over the past few months I've noticed HN slowly slipping into the reddit-esque, us-centric groupthink in the comments section.

The bias is apparent and I fear the trend is accelerating.

Yes. Stuxnet being the most famous which brought this to more daylight -'cat out of the bag.'

Trump admin also did a press push after changing policy to ramp up digital offense [1]. Notably these stories were obviously is coordinated and on purpose. e.g. not just someone leaker talking to reporter it was strategy.

[1] https://www.nbcnews.com/politics/national-security/under-tru...

That push was actually interesting, since they were intentionally being open about their cyber capabilities. They also had a "press tour" about how they hacked ISIS [0]. There's clearly some mind games going on by showing your hand like that.

[0] https://www.npr.org/2019/09/26/763545811/how-the-u-s-hacked-...

Totally interesting! Kind of similar mindset to nuclear weapons it seems being open about our capabilities; if you attack us, we attack you as a deterrent.

But that doesn't seem to stop Russia who doesn't give AF already under huge sanctions, or non-state groups like ISIS

All nations do. It's become very normal. On the surface relations are nice and respectful. But we even spy on our allies behind closed doors. Take the case of Germany, that became public knowledge because of wikileaks. We had Angela Merkel's office wiretapped, among other things[1]. After it became known, they hardly responded past some internal investigations. I think their Senate switched to storing documents offline too. But at this point it isn't something inexcusable. And you can be sure Germany does too[2]. Knowledge is power.

1- https://www.reuters.com/article/us-germany-usa-spying-idUSKC...

2- https://m.dw.com/en/how-the-uss-cia-and-germanys-bnd-spied-o...

This is actually pretty fucked up

Welcome to the world :)

Is it really? Theoretically with perfect information you don't need to go to war, you can just compute the result and start with treaty negotiations.

This. There's actually an argument that spying helps peace.

My dad (a journalist, RIP) was once at a UN conference in the 70s, and made the remark to a Chinese official in a light-hearted spirit: "of course you spy on us, we spy on you, and what's wrong with that?" This caused a major row and he was forced to apologize.

It's just business.

It seems like a fair game to me. You can always protect yourself by investing in cyber-security if you don't want to be spied on.

It's not like war where innocent people die and a there's a lot of human suffering. It's just a tech race where the nations doing a good job get a deserved advantage without doing direct damage to the population.

Unless someone exacts extensive damage to something like the electrical grid. In which case it would cause mass suffering and death. Don't underestimate the steel trap of that cold war mentality.

There are hacks that can cause extensive destruction. But it isn't good to talk about them lest we give people ideas.

All nations don't.

Some are too poor (take your pick). Others are rich, but small (the Vatican). Most just don't care enough to prioritise it over better things they could be doing.

And then, there are countries that simply consider the US an ally, and consider it morally dubious or practically unpromising to spy on them.

Add this up, and I'd be willing to give at least 10:1 odds it's one of a list of maybe ten suspects, even when adjusted for GDP or population.

As an aside, I'd really be curious why this "everyone does it" is used anytime something like this comes up? Is it just macho "I don't have friends but there are useful idiots that consider themselves my friend" talk? Is it nihilistic/cynical pretentiousness? International whataboutism to defend one's team?

Because it certainly isn't based on any actual data. If you add up offensive hacking by the USA, China, Russia, Israel, and maybe two or three others, you're pretty well done with the full list, but still close to <x> nations short, where <x> is the number of nations that exist.

Not all nations, just the bad ones.

Some does, some don't, is not a new normal, is mostly for power players. But anyway, none is even near at the scale and reach of what the US does. And for most of it they don't even need to hack, just handle a request for the customers data to any US based service (ask Lavabit about that).

Most large deals (e.g.: aerospace, defence contracts, infrastructure projects) are backed by diplomacy and/or various flavors of espionage.

There was a guy called "Edward Snowden" who revealed a bunch of offensive cyber operations a while back. You may have heard of him.

Trust me, you will not hear about them. Also, when the US government detects it's been infiltrated, it's also rare to hear about it. That's why whenever you see articles like this that make attribution, I recommend viewing them with skepticism, simply because the information is specifically selected.

They pretty much don't ever want you to hear about them in the news. They don't want compromised entities to know they are compromised so they will keep revealing sensitive information through the systems; they don't want specific vulnerabilities they are using to be known so they won't be patched, or even the general sorts of capabilities they have to be known; and at least traditionally it's thought like it makes the U.S. (or any other country) look bad to be breaking other country's laws and spying on them like this, when it's a country we theoretically aren't in hostilities with. It might make the attacked nations feel they have to retaliate in some way too, if it's public.

Perhaps if the NSA focused more on defense instead of offense, they'd have been better able to protect our own government against this sort of attack. Who can say if some of the vulnerabilities used were ones the NSA in fact knew about but was keeping in it's pocket for it's own use. A well-resourced expert federal agency actually focused on security could make everyone safer from snooping; when they instead prioritize snooping themselves, they instead help make everyone less safe from snooping.

is the monitoring of internal email traffic a form of attack?

> The hack involves the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said.

> The hackers are “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.

> “This is a nation state,” said a different person briefed on the matter. “We just don’t know which one yet.”

I bet it was someone on r/wallstreetbets

Microsoft Office. Of course.

Unexpected cloud security benefit, for foreign government!

they wanted to restart the print job?

That's a good one! :D

>"able to trick the Microsoft platform’s authentication"

So they social engineered the password, and if MFA was on it was push based MFA and the user just clicked OK to all popups on their phone?

Depends on how they do things. Clicking “yes” on a phone wouldn’t be happening at higher trust levels.

If they offload auth to a on-prem or third party IdP (common in big hybrid O365 tenants), there are often different paths, implementation screwups or bugs that let you bypass MFA. Microsoft’s position is “buy Azure AD, Buy M365, Buy ATP” and other paths are poorly tested, or they explicitly tell you to F off.

Also remember that federal agencies are bigger than most fortune 50 companies, are usually global in scope and have lots of collaborations with other agencies and other third parties, and may have independent pockets within the agency. Those friction points are where problems tend to happen!

This is my experience with Microsoft: they view all security features as binary. As in:

Encryption: Yes.

Multi-factor authentication: Yes.

Do they care if the MFA is simply the user pecking at buttons like a bird trained with seeds: No.

There is a real problem with Azure AD MFA. Unlike the consumer MFA, it shows you exactly zero information about the source of the information. None. You get a choice of "approve" or "do not approve". You don't get any input information for making this decision.

Hacking this is trivial. If you know someone's password, you just have to occasionally try logging in. Eventually the user will accidentally click approve even though they didn't trigger the authentication.

You'd assume that nobody would ever fall for something like this, because surely nobody would be so stupid as to approve an MFA prompt they didn't trigger.

Meanwhile, my Microsoft Authenticator app triggers randomly about 5-10 times per day because every single MS app insists on "reauthenticating" me every 24 hours. So I'll be sitting at my desk and my phone will pop it up randomly. I'll look up, and sure enough, Teams wants me to re-MFA for some stupid reason.

I'm paranoid enough that I'll always reject these MFA prompts and then start the login cycle manually, but most people would just peck the button like a trained bird.

Similarly, I've run scripts before that needed 6 MFA prompts to complete (don't ask). I ran the script once and it asked 7 times... uh-oh. Is this an Azure bug, or a hacker from China? How could I possibly know?! The information is not provided to me!

This is Microsoft's fault, 110%, and I dare anyone here to argue otherwise.

So instead of reaching for the downvote button, make your case on how "yes, yes, yes, yes" is not a security disaster below in the comments please.

That isn’t Microsoft’s fault. They are providing a tool and your admins did not set it up in the most secure or sensible way.

Your actions may make it some If these things happen as well. I can think of a few organizations where your script would have resulted in your account being locked down and a security incident.

How is it not Microsoft's fault if they don't provide the user with any information to decide whether the MFA request is legit?

There's literally no upside to hiding this information.

To be honest, though, if they did provide all the details, they'd criticized for "overwhelming" users with too much information -- most of which would probably be useless to the majority of users who either wouldn't (care|pay attention|understand) anyways.

That said, I'm sure there's a reasonable level somewhere in the middle. The current situation certainly doesn't sound like it, although I haven't used any form of Microsoft MFA, so I can't really say either way.

Imagine if an automobile manufacturer allowed you to configure the safety features of your car and had the defaults set to unsafe but convenient values to help sell vehicles... do you think the manufacturers should evade liability?

They absolutely do. In northern climates where there is snow and ice on the roads for 3+ months out of the year, a car MFG will GLADLY sell you a vehicle with sport/summer tires. If you try driving with those in the winter: at best you'll get stuck, at worst you'll slide through the first intersection you come to and die in a fiery crash.

Just about every business will have options that are a perfectly reasonable choice in some circumstances and really, really stupid in others.

I live in Alaska....litterally every car here is sold with summer tires.

I live in New York, where the speed limits on highways vary from 50 mph in NYC to 65 in the rural areas. My car is governed at 110 mph. Why? There is no reasonable scenario where that is smart to discover.

Microsoft has billions of users. The security needs of the US Department of Justice are not the same as my mom’s real estate office.

When you use 3rd party IdP, for example, how does Azure MFA know what the app is?

The configuration described was not out of the can. Somebody decided to make it the way it was.

> My car is governed at 110 mph. Why?

Most likely due to some physical (not legal) issue that would make it mechanically unsafe to operate the vehicle above that speed even in an otherwise appropriate location. (Or perhaps it's due to some obscure state law, or the manufacturer is just out to spoil your fun, or ... who knows?)

More generally, I agree with the point you make here about the responsibility to configure things correctly. However, it seems to me that Microsoft is also on the hook for failing to include the necessary context when an MFA request is sent. It's a bit like selling a car with seat belts that superficially appear to work but fail at the slightest provocation, no?

There is no setting available to enable additional information for MFA when used for Azure AD. It's not an option.

It is is on by default however when using the same mobile app for Hotmail or XBox live accounts.

Microsoft thinks the data of Fortune 500 companies is less valuable than your Minecraft skins.

What it means is that MS is no IBM, in the sense that you may very well get fired for buying MS.

If your IT department cared, they could disable the app notification MFA method in AAD and force you to either use passwordless or a TOTP code, both of which prevent you from blindly approving a sign-in you aren't involved in.

I ha e to fight tooth and nail to get Toto where I work. The inertia of "but push is eaaasy" is strong.

I authenticate with 10 different Azure AD directories, of which I my company controls 1, and I personally control zero.

Notably, Microsoft's consumer MFA, the type used to protect Hotmail and XBox accounts shows more information in the exact same mobile app!

It's not that they don't have the capability, or don't know that it's important. Microsoft has explicitly chosen to never ever show additional information of any type for enterprise customers only.

They care about the security of their own things, not you stuff, in other words.

You are right.

WaPo is reporting that this and the FireEye breach were via Solarwinds:

> All of the organizations were breached through a network management system called Solar Winds, according to three people familiar with the matter, who spoke on condition of anonymity because of the issue’s sensitivity.

https://www.washingtonpost.com/national-security/russian-gov...

Could have been CVE-2020-7984: https://nvd.nist.gov/vuln/detail/CVE-2020-7984

>SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information

Not knowing anything about this, this could be a good guess. Folks likely jumping the gun blaming a MS vuln above, when the real breach was via SolarWinds and then they were able to spoof/takeover some Active Directory server inside the network or something such thus gaining access to MS 365 emails etc.

The articles are referring to Solarwinds Orion, which is a different product to N-central.

I personally found and reported the unpublished CVE-2019-10690 in N-Central, but that was only local privesc.

More info on the attack here: https://www.fireeye.com/blog/threat-research/2020/12/evasive...

> They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software. This campaign may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft. The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security.

> I'm paranoid enough that I'll always reject these MFA prompts and then start the login cycle manually, but most people would just peck the button like a trained bird. Similarly, I've run scripts before that needed 6 MFA prompts to complete (don't ask). I ran the script once and it asked 7 times... uh-oh. Is this an Azure bug, or a hacker from China? How could I possibly know?! The information is not provided to me!

I'm just glad I'm not the only one who sees this as a problem.

I literally reported an issue a year ago where under some circumstances, logging out of Microsoft would not actually log you out if their JavaScript redirect fail to execute, which it did on some devices. Nothing. They didn’t give a shit. It made me so angry that we had to code our application around it.

Your assuming they had mfa enabled!

>> “This is a nation state,”

> I bet it was someone on r/wallstreetbets

Both could be true? ;-)

r/wallstreebets only skill is making really funny Memes and is exposing the Federal Reserve and printing machine.

So now that I think about it maybe they did do it... That's the only way to find out what the Fed is up to next.

Hack a hot stock tip.

My first thought on this was that it was an EvilginX hack, ala https://www.thecloudtechnologist.com/office-365s-mfa-is-vuln...

Yeah I had friends in college that did this kind of thing for fun.

Fortunately no classified information was compromised. All of the Treasury emails just said "brrrrrrr".

That is not entirely true. Receipts for ink orders come in over email.

gold

J POW

We need Gucci Mane to code break this ASAP.

> “This is a nation state,” said a different person briefed on the matter. “We just don’t know which one yet.”

So, how do they know then?

They probably don't but what better way to absolve themselves of any fault? If it's a nation state, then the attack is so sophisticated, that surely they can't be blamed for not having prevented it and following best practices would certainly not have been enough.

It's common to downvote questions/statements such as-"Has the United States government released evidence to back the claim that the hack was committed by Russia?" and "The word of the United States is not trustworthy to take on face value alone." on Hacker News?

Because that's what I believe.

Maybe we'll stop using microsoft office products.

Good thing we have Christopher Krebs, director of the Homeland Security Department's Cybersecurity and Infrastructure Security Agency, on the job......Oh,wait,, Trump fired the guy responsible for defending against just such at attack? Brilliant.

yes this is trumps fault

"The buck stops elsewhere".

krebs was fired last month (~11/17/20) and per the article:

> Staff emails at the agency were monitored by the hackers for months, sources said.

so krebs was in fact not defending against such an attack?

>The breach presents a major challenge to the incoming administration of President-elect Joe Biden as officials investigate what information was stolen and try to ascertain what it will be used for.

Damnit editors! First of all, don't end your sentence with a preposition. Second, nothing says the data was stolen. Here is a handy chart that will clarify between "stealing" data and accessing data without authorization:

  Stealing Data vs Unauthorized Data Access:

                    C - I - A

  Stealing Data     Y   Y   Y

  Unlawful Access   Y   !   N



  C=Loss of Data Confidentiality
  I=Loss of Data Integrity
  A=Loss of Data Accessibility
  !=Data may or may not have been altered depending on level of access.

> First of all, don't end your sentence with a preposition

There isn’t a real rule against that in English grammar. See https://www.merriam-webster.com/words-at-play/prepositions-e...

No, its not a hard rule, but it is a sign of bad writing and editors not paying attention. If your writing looks professional, so do you, and vice versa.

If you're going to lecture others on correctness, you should probably make damn sure that you've got every little detail exactly right yourself (since, apparently, anything less than absolute perfection is completely unacceptable).

(I believe you'll find that the "A" is for "Availability", not "Accessibility".)

When was it switched? You are technically correct because I can't find when the switch was made. My mind still recalls "Accessibility" from decades ago but it looks like both were used:

https://www.doc.ic.ac.uk/~ajs300/security/CIA.htm

https://www.pearsonitcertification.com/articles/article.aspx...

Certainly such information has value on the open (dark) market, and not only to nation states.

‘Nation state’ is such a stupid term for them to use as two of the usual suspects, Iran and Russia, are not nation states but rather multiethnic states. If they don’t have a clue who it is, it seems unlikely they would rule out these two states specifically and do so in this subtle way.

For some reason it is very common amongst people who are interested in cybersecurity (or national security in the US).

Russia may not be currently, but is aspirationally a nation-state.

Nation-state prevents confusing with lower level states. State is the more appropriate term, but it would cause a lot of confusion in the US.

Could just use "country".

Nation State suggests the nations government. If you just say country it might suggest organized crime or other randos from that country.

'Foreign government.'

Also a problem with many places. Think about Pakistan, where the military is not the government per se, but has the resources.

“Nation state adversary” says something without saying it.

> Pakistan, where the military is not the government per se,

A distinction without a difference? I don't know a whole lot about Pakistan, but that's the way it seems to me.

It doesn’t matter if you or I don’t see that distinction, but the US government needs to make whatever distinction it chose from a policy perspective.

Problem is that a country can be sovereign or part of a larger state. I think sovereign state is the correct wording to use in that case.

Comptia's Security+ exam refers to countries as "nation states" when it talks about government entities targeting businesses or other governments, and that nomenclature has become commonplace.

Sec+ is also a requirement for a lot of government related computer work, so it's not surprising that the guy they interviewed used the term.

Just because an attack originated in a certain place does not mean it was supported by a nation state. For some reason it seems like a large number of security folks don’t understand this. I know lots of intelligent Russian engineers who could easily break into US corporate or government systems or orchestrate a DDoS attack. And if they chose to do so there would be zero legal consequences since they live in Russia and are Russian citizens. Doesn’t mean they are on Putin’s payroll.

Yes, I don't understand why you would assume government backing, but you don't know which government. If you don't know who it is, it could be anybody.

I think people use Nation-State to suggest that they are not so incompetent that some random hacker could get access.

I had to look up the difference, and I don't think that distinction is something most people are aware of. I've only ever known "nation state" to mean "country", and suspect I'm in the majority. I don't think most people use that term intentionally, because few countries would qualify. That list gets even shorter when you limit it to countries that might be antagonistic to the US, and even shorter when you get to those that are threats. In addition to your two examples, China certainly doesn't qualify either, which basically just leaves North Korea.

Ya, I think I consume far beyond the average for political news and had never heard of that distinction until now. I just always equated nation-state to country.

Why do you think people said 'nation-state' if you thought it meant the same as the shorter and simpler word 'country'?

To sound geopolitically sophisticated. To pretend at the language of statecraft.

I always assumed it was a way to sidestep discussing whether certain contested territories were legitimately "countries" in their own right. By which I mean places like Palestine, Taiwan, and the way North and South Korea each kinda claim the other as part of their territory.

Because there are lots of synonyms.

But I could have been more specific that nation state tends to imply government of a country. Whereas country might include all citizens.

Nation-state: a sovereign state whose citizens or subjects are relatively homogeneous in factors such as language or common descent.

I think it's a mistake to limit the scope of consideration to countries that are antagonist to America. I doubt it was them, but at least in theory, might not Canada have an interest in having advanced knowledge of things the US Treasury might decide? Certainly the US economy impacts Canada as well, as it does nearly any other country to one degree or another.

Hahaha our military can't even figure out boots for the troops, you think we can hack the US Government?

As much as Canadians like to shit on America, one thing they gave going for them south of the border is that "Fuck yeah America" attitude that leads people to pursue excellence.

We don't have that in our public sector. We just have passive aggression, mediocrity and memes about being polite.

Well, maybe Canada is pretty unlikely I concede. But it seems possible that it might be some other first world nation that has friendly relations with America. I mean, America spied on Germany, right? Maybe Germany spies on America. I really haven't the foggiest clue who did it, but I wouldn't limit consideration to overtly adversarial countries.

You may not be aware, but Canada does have a sophisticated organization dedicated to electronic security:

https://en.m.wikipedia.org/wiki/Communications_Security_Esta...

I'm Canadian and am well aware of CSE's existence.

Do you think a Wiki article can capture the staggering incompetence that's endemic within the Canadian public sector?

And you’re holding up the US public sector as your shining city on a hill?

Canada is leading the world in procuring the vaccine, and has had a very well-considered response to the pandemic. How long did it take for CERB cheques to arrive? Days? Look at the cluster that was the US response, even at the basic “get money in people’s hands” level.

Getting back to the original point - I’m sure there are a dozen or more countries with the capability to pull off something this sophisticated, which would include Canada. Highly unlikely that it was us, obviously.

>And you’re holding up the US public sector as your shining city on a hill?

Certainly not. I'm only holding the US's cybersecurity complex as a shining city on the hill. Our government is so inept that I very much doubt CSE has the funding it needs or the ability to hire skilled people.

Happy to be proven wrong.

>Canada is leading the world in procuring the vaccine

Because we don't have any domestic production capacity due to decades of federal mismanagement. The same mismanagement that bought us used, obsolete fighter jets and submarines that catch fire at the slightest provocation. We lead the world in procuring those items too.

Copying my reply to GP:

This is a US-vs-everyone-else terminology difference. In most of the world "state" refers to a sovereign entity, "nation" refers to an ethnic group, and "nation-state" is a state identified with an ethnic nation.

But all of that terminology solidified in the 19th century, so outside of academic political science the US uses "state" to refer to individual entities in a federation (e.g. translating German "Bundesland" as "state"), "nation" to refer to non-ethnic bodies politick, and "nation-state" to specify "what we call a nation, what the Old World calls a state".

Which of course leads to a lot of confusion about the connotations of "EU member state", which in European discourse implies real sovereignty, but in US discourse implies a federalist Europe.

This confusion is easily avoided by saying “country,” or if you still want your writing to be verbose you could say “government” or “government-backed actor.”

"Country" is also ambiguous. Lots of "countries" are not independent, e.g. the UK is made up of four "countries" - England, Scotland, Wales, and Northern Ireland. Similarly, the "Land" example I used above for the German federal subjects literally means "country".

"Governmental actor" would be a better international-friendly term for use in computer security, outside of the parochial world of US national security discourse.

Having done a quick search for fun:

US law actually uses "state" in a sense closer to the European and broader international sense. e.g. a "state actor" includes both the states and the federal government, and is used to describe any entity bound by the restrictions of the Bill of Rights. (e.g. state actors are bound by the First Amendment, whereas private actors can restrict speech all they want)

> Iran and Russia

Or Israel. Israel is the nation state that has subverted the US govt more than any other.

Yeah but Israel isn’t in the intersection of usual subjects and countries that aren’t nation states.

I seriously doubt that. But it’s cool to bash Israel online so you’ll probably get upvoted.

In this context, nation-state means “people with the authority and budget to do stuff like this”.

Its used because it makes the victim seem less incompetent, and doesn’t misidentify the attacker, doubling the ownage.

Maybe they suspect Californians?

https://www.bnnbloomberg.ca/gavin-newsom-declares-california...

"Nation state" was a standard term in school going all the way back to fifth-grade Social Studies class.

But all of that terminology solidified in the 19th century, so outside of academic political science the US uses "state" to refer to individual entities in a federation (e.g. translating German "Bundesland" as "state"), "nation" to refer to not-necessarily-ethnic bodies politick, and "nation-state" to specify "what we call a nation, what the Old World calls a state".

Which of course leads to a lot of confusion about the connotations of "EU member state", which in European discourse implies real sovereignty, but in US discourse implies a federalist Europe.

Reply on news.ycombinator.com