Microsoft says it found malicious software in its systems
reuters.com
reuters.com
From yesterday:
> "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. Perlroth said the company stood by a statement it issued on Sunday saying it had no indication of a vulnerability in any Microsoft product or cloud service in its investigations of the hacking campaign."
Edit: Nobody else ever gave it instructions that went counter to mine, either. Security vulnerabilities are 100% non-exploitable without power. I should probably start an anti-APT business with that knowledge.
There's a reason the old go to for secure deletion was throwing your hard drive into a wood chipper... (though that's bad for the environment, please don't do that)
People were worried that it would be easy to grab the filled out forms and get a restaurant's guests' phone numbers and addresses (and it probably was). Predictably, one of the rushed web forms had non-existant security, making it easy to get all restaurants guests' phone numbers and addresses.
Rust is an accomplishment, but it’s also a very complicated language. It has a harsh learning curve and simply put, not all software written will benefit as much from the guarantees Rust provides. For a lot of software that will benefit the most, people are already experimenting with it.
seL4’s approach also seems interesting. It is doing C with proofs, which in theory should be able to offer stronger guarantees than even Rust if done correctly.
The language could be C, C++, Rust, Zig. But the design is more important than the language.
Of course, no one with enough resources to do this cares enough to do it.
The down votes come from those that feel personally attacked by your comment. :-)
I have a lot of trust in Microsoft & Amazon, but with the complexity of their organizations, there is no way they can provide the same kind of security assurances as if I were to have my own locked cage at some colo. Certainly, you could spin a fantastical tale about how AWS's 23+ layer physical security perimeter is superior to whatever is available at my local facilities. But, I have grown to classify this sort of stuff under the "what if 2 SHA256 hashes collide" category of fear-driven development.
I almost have to convince myself on a daily basis now that "everything is fine" with how we are currently using the cloud. The selling points for moving to the cloud are very powerful and I agree with most of them. But at the same time, the idea that you are locked into this same combined fate as everyone else leaves me with the constant sensation that I should have brought a parachute with me.
You type in Windows 10 search and it sends your keystrokes to Microsoft, you log into Windows 10 OS (and they push hard for this during setup, they actively make it hard to use an "offline" profile) and it records your every interaction with that computer; with "full" telemetry it records every web page you visit, every app you launch, every app that has an error (you can download an app from MS store to see what telemetry W10 is sending to MS, it's quite illuminating)
These days, more and more of society expects you to have a smartphone and "apps"; "please can you scan a QR code to enter this restaurant". A supermarket has an app and offers in-store discounts on food, your data subsidizes the cost of what you purchase. Many offers are locked behind a social contract of "you give me data and I'll give you some money off". It's amusing to see how 'cheap' people are and how much data they are willing to freely give away in the name of a very very small discount (the data is worth much more than the savings you are getting).
An always online, always connected fully digital society is prone to attacks, hacks and disturbances. We've seen hospitals held to ransom and have paid bitcoins to get critical machines working again, something that shouldn't even be possible, yet one person who opens $phishingEmail.exe can bring down an entire network.
Our life is essentially in the hands of crudely built machines, with absolutely no security against basic human errors - and we trust these with the very foundation of society. One day we will witness a truly devastating hack, a disturbance unlike anything we've known previously, and it'll likely be as devastating as the Beirut explosion. It's not an if, but a when.
I want to return to a time without cars or computers, even just for a brief period (the lockdown was so nice this year. the hum of the birds and not the thunder of engines was a blessing).
This isn't new to smartphones. Grocery stores have had discount cards for ages. You might even have one in your wallet.
You can see which offers people engage with most, how often they open your app, well timed push notifications and a reliance on that app. They can also purchase data from that smartphone and have huge data silos to perform studies on. An App provides access to a human being constantly, whereas a discount card is a stateless entity in a wallet that never gets used; it's unlikely someone loses their smartphone, it's a prized possession.
Quite honestly, discount cards are probably quite worthless vs smartphone data and the richness of what you can get. I am surprised they are even still used/offered these days (I know of supermarkets that just have apps now).
As a tracking mechanism, they rely on the customer cooperating and using the card as intended.
Yeah I recall Mikko Hyppönen in one of his talks describing how malware got encoded into DNA so it could propagate like a true virus. And there was a story recently of malware getting into some biotech lab and changing the genetic code to create mutant pathogens. If any malware authors are reading this: stop being so ruthless and unethical. You have a duty of care when you write code. You need to wield your technical prowess responsibly!
I only know this because the person in charge of internet at the house my girlfriend currently lives at was convinced by the ISP to set it up and now her machine has malware on it.
Actually, the Microsoft developers should think about that when they are trying to fall asleep at night.
It will be hailed as a hallmark of innovation. Any voices claiming that such a thing has always been possible will be tutted.
Eh nevermind. Psychopathic corporations don't need an invitation to view themselves as Sun gods.
I think this is the illusion of control.
"security assurances as if I were to have my own locked cage at some colo."
'Locked cage' - is not going to help us secure it from the kind of intrusion we are afraid of.
Scale means more layers of vms, more redundancy, more sophisticated security teams etc..
Physically, Fort Knox has never been robbed, whereas any mom and pop shop can be.
I'm really surprised the US Military has not been working with the FAANGS to produce a new OS that is fundamentally more secure and containerized, including a networking stack with identity built right in, and of course, working on easy solutions for the user side of the equation as well to thwart social attacks. And maybe possibly systems architecture groupings to bifurcate systems from one another.
By the way, what you're endorsing are essentially ASICS. They're fundamentally impractical as all hell. The logistics of security causes a verbosity explosion when you actually need to change something. Imagine the world we have now with 1000x the paperwork, and a bigger chunk of the populace devoted to just enabling somebody to go from point A to B to do something.
And even then. You're only as secure as your Users will tolerate.
We can't plug in USB drives either and our database queries are logged and suspicious queries (the heuristics for "suspicious" is not great admittedly) automatically get sent to your manager. Even the files on the hard drive are scanned. I've had so many false positives for the prior two things.
Also we're totally moving away from laptops. Everything will be a thin client. The performance on the things is miserable due to oversubscription and technical limitations.
Anyway, how do all those services authenticate your users? By checking their passwords in the MS AD server?
I’d love to trust Microsoft. They have a lot of talented people working on a lot of cool things.
But, they voluntarily collaborated with the US Government to spy on their users at home and abroad, and those people are still in charge, as far as I know.
That said, its really close to being possible. We are going to look at it hard next year. With the density coming out of AMD these days, we can probably solve the capex problem pretty easily.
Ten years after Stuxnet/Flame saga, USA is experiencing a same kind of attack and their stated preparedness has not improved from the levels stated in that book.
It’s fascinating.
Edit: No. I’m not enjoying this. There’s no schadenfreude.
It also layers this assumption with “we can prevent it at the firewall level so we can actually patch it while they can’t” idea.
As we all know, it’s an absolutely brilliant(!) idea.
Often the answer this group offers is yet another third party solution that is popular at the time. Then they give these tools the high level of permissions they need to function. Cycle repeats.
That book contains no corporate backing/advertising.
How do you think governments find these vulnerabilities? Accidentally, under the couch cushions?
What you actually seem to be proposing- in practice- is a ban on government-funded vulnerability research.
To be completely honest, I don't have a concrete answer to this question yet because I haven't finished the book and didn't give the hard think it requires.
However, I can see and both parties' perspective and reasoning. I just need to give these perspectives a good rub with my own views.
On the cybersecurity side, its effectiveness inherently reduced because any person with a laptop can conduct the same research in principle. So, other parties can find breakthroughs or leapfrog each other with relatively minimal effort.
On the other hand, NOBUS has an inherent ego attached. It considers other parties to be inferior permanently. It considers other parties are unable and will be unable forever unless we leak something. This is a flawed thinking in computer science / programming research.
The core of the irony has two layers. First the personal one: The timing of reading the book and how the events unfold.
Second irony is in the US government. They were aware that they're not ready to defend if someone uses the same weapon against them, however they were so focused to improve their offensive capabilities and failed to secure themselves. Moreover, the attack came via a national software company. They've hit from inside. It's like adding insult to injury.
They are already weaponized, and have been for a while. The time to start taking information security seriously was 15 years ago.
Yet we openly embrace hardware we don't understand riddled with flaws and software we can't see in to or audit and makes requests without our consent. When you login to $bankingApp are you aware of all the DNS requests, information it's POSTing?
Heck, Facebook's SDK derps and cripples many applications. Our software stack is built on a mountain of hacks, flaws and quite frankly, insanity.
Computing, from the hardware to the kernel needs completely revamping, because nothing else will be able to salvage our current environment.
This hack by itself should be proof that the NSA has no such capabilities. And, no, stopping this hack would not have compromised anything. They could have tipped off any one of a rather large number of security researchers, companies, or vendors affected who would have gladly made up a believable story as to how they noticed this.
Lots of these so-called "Cyber weapons" are operated by actors who are very effective at leaving no trace.
It's been in the background before but in the reports about this SolarWinds issue the "leaves no trace" angle is starting to be emphasised much more.
Not knowing if or what has been compromised means that the attacker can choose when or how to use the information they obtained and the victim will be surprised, even a long time down the line.
Its presence manifests a different set of skills. Exploitation is not necessary. Presence itself is enough of a warning.
It says “we’re equal now. We can be in your turf, sleep for a long time and even use your own companies as launch pads”.
Maybe the bigger you are, the more you think about security, but the bigger you are the more difficult it is to protect yourself
Now for a BUSINESS, I could see the advantage in less maintenance cost and being able to spin up/down services easily. It is easier and that cost is measurable (up to a point; when you get big enough AWS costs become obscene compared to self-hosting. I've been at more than one shop that moved things back on-prem to save money).
I’m actually dealing with an issue where one RDS instance in AWS costs more over three years than the entire infrastructure and software investment did on the on-prem.
Most of the projects I work on now have 1-2 IT people supporting 100 devs.
Will non-tech-competent companies without well-staffed security teams make it? How much individual, private digital data is likely to make it as long as say, a vellum manuscript?
The question is if any of these leads to lateral movement and access of sensitive information or modification of data and stuff. No company is required to tell you about every single piece of malware they find in their networks - unless something "bad" happened. Maybe we should require more transparency in general.
I guess investigations will show what happened or is happening still.
A cloud hack like the parent poster talks about assumes that you get access to the hypervisor layer and can look at the RAM of the guest machines.
This is not inconceivable. Rather, it seems quite reasonable given the complexity of hypervisors and the prevalence of CPU architecture bugs that makes these attacks easier.
This is what https://en.wikichip.org/wiki/x86/sme is for
Some of that is on AWS for initially making the defaults too open, but at the end of the day, S3 was doing what it was told.
Is there some case where S3 was locked down, and the data still leaked?
What? Their internal build system was comprised and the password for the FTP that hosted their software updates was "solarwinds123"
This had nothing to do with the cloud/a issue with a cloud provider.
Secrets in a public github repository is a leak, in the cloud.
Someone uploading their secrets to GitHub has nothing to do with the cloud and everything to do with the incompetence of the people using it.
"This is the clouds fault because one of our engineers made a mistake and 'the cloud' didn't stop them!" does not really hold up.
It's an untenable problem for organizations of any size. There aren't enough man hours to reverse engineer and vet all the third-party software that any sized organization uses. There's no community will to force vendors to do better either.
We need something like an Underwriters Labs for software. It probably will take the insurance industry coming down hard for things to change.
Amazon, G and MS generally do.
I believe that whatever data you have, it's more secure on AWS than anywhere but your hard drive not connected to the internet.
If the [inter]national infrastructure goes down, with the firmware on every device on every internet-connected computer bricked at the same time due to a large-scale cyberattack (perhaps followed by a military attack a little while later), we're f-ed.
All this would take is:
- One zero-day each on Windows, MacOS, and Linux.
- Nation-state level resources to create a bricking firmware update for all commonly-used devices.
- Nation-state level resources to create a spreading attack for all major routers and network devices.
- Nation-state level resources to deploy this rapidly enough that response systems can't respond.
With 200 nation-states, it's perhaps just a matter of time....
(And yes, there's a lot more i's to dot and t's to cross, but I think they're all doable, with nation-state level resources)
I think this is more "movie plot", though. "Smart Grid" security has gotten tons better than it was at the start. A lot of very security conscious and smart people have been working on it.
(1) Tank the economy
(2) Likely, be doable with resources totaling in the single-digit million dollars
Modern wars are largely about industrial capacity.
But if it is equally easy to compromise the grid, why not do both?
This may sound like a movie plot, but so did the invasion of Poland at the beginning of WWII, the attack on Pearl Harbor, nuclear bombs on Japan, the rape of Nanjing, or many other actual events which Actually Did Happen.
We tend to underestimate the impact of rare events: our brains are conditioned to discount anything which happens once or less than once per lifetime. That's likely why humanity will kill itself at some point.
Honestly, this is a weird fucking hack. The update went out signed by Solar Winds. Somehow, they got this payload into the build-chain their developers use.
The other thing that occurs to me is that this Solar Winds update goes out to a huge number of organizations, with a tremendous diversity of capabilities. Why was FireEye the first one to notice? Was the Solar Winds code exempted from monitoring, because it is monitoring? How big is this blind spot?
It would be interesting to know how many "softer" targets the attacker went after and were completely undetected.
It's worth noting that FireEye didn't find the backdoor until after it had been exploited. Nobody can vet modern software. The complexity is too high, let alone accounting for the ridiculous update "velocity" that's coming out of most commercial software today.
Just getting software "manufacturers" to itemize and document the normal communication mechanisms used by their software, so that threat hunters aren't reverse engineering communications protocols, would go a long way. If SolarWinds had provided a list of domains their software needed to communicate with that would have gone a long way to stopping this kind of attack. (I can't be the only person who demands vendors provide this info, and who puts third-party software behind MiTM proxies and hard-assed ACLs.)
Assuming the binary is reproducibly buildable, different internal teams can try rebuilding the source and checking that the signature matches what's in the public log, and that each entry in the log has a corresponding commit in the source repo.
As another potentially interesting data point, SWI still appears to have a P/E close to 120 even now. Given that traditional value investors might consider something closer to 20 to be reasonable for an established business and the huge ratios of many big tech stocks only make sense if you think they're going to continue the dramatic growth some of them have enjoyed for a while, there could still be a long way for stocks in SWI to fall even if they do eventually stabilise.
Not any more.
Perception is why. Especially for certain clients. Let’s pretend that I work for the French department of the interior and some time early next year I go to install SolarWinds. You think the boss is gonna OK that, knowing it’ll be in the paper the next day? No chance.
They’re screwed for a while, only hope they have is staying afloat long enough for our short memories to forget this.
May be a stricter password policy and git scan?
The reason I looked was because I never saw anything stating what OS are directly impacted, all they talked about was how bad it was.
I now understand why Microsoft is pushing so many articles about this issue (outside of the fact it looks like it is a big problem for lots of companies/gov/people).
It's incredibly prevalent, but the only way I can imagine doing that is by capturing every key at the top level... that I can't imagine any reason for doing.
I think that this is the only effective McAfee anti-virus: