11 ms·
On Cybersecurity and Being Targeted
- cmdrfred 10y agoJust wanted to say I love requests. Thanks for it.
- micaksica 10y agoGood on Kenneth for being quick on the draw. I love 'requests'. If you're a developer of a popular open-source project, this should serve as a warning to make sure you have multi-factor authentication on, yes, but it's even better to learn from this and come up with incident response plans with your core maintainer base. Ask among yourselves: 1. Do we have the ability to detect an overt breach like this one? 2. Do we have the ability to detect a covert breach (e.g. are our builds reproducible, auditable? Are our binaries signed? Do we know who our committers are?) 3. Do we have a consistent way to message users of the project of the compromise? 4. Do we have a way to deprecate/mark as tainted compromised versions of our module/package/application? GitHub offers some technology to help in this regard. Sign your release tags, at a minimum [1]; sign your commits with developer keys if you're paranoid. [2] As FOSS becomes more used in the enterprise, I suspect these attacks will become less of a rarity. [1] https://news.ycombinator.com/item?id=11494997 https://news.ycombinator.com/item?id=11494997 [2] https://help.github.com/articles/signing-commits-using-gpg/ https://help.github.com/articles/signing-commits-using-gpg/
- dsacco 10y agoI applaud the fast response, especially contacting a security engineer to be removed from the GitHub organization. One particular bit stuck out to me. >>In this instance, though, the attack vector was DNS. My account at the not-so-incredibly-common DNSimple.com did not use a highly secure password. I didn’t think it was necessary, as in my mind, the only reason that the security of an account like that would be at risk would be if I was the explicit target of an attack. Once again, I thought to myself “That’s something that only happens to other people”. Kenneth used a randomly generated password and two-factor authentication on his GitHub account, which is great! But on DNSimple he made the decision to forego better security because it seemed unlikely to be a target. It is not enough to use some strong passwords for the things you think are sensitive. Every weak password is a weak link in your total identity chain. The best way to use a password manager is to never give yourself authority to make passwords unless they are randomly generated. Even if the site or account in question appears innocuous or insignificant, even if it does not allow you to make a password of your manager's default strength, commit yourself to going through this process 100% of the time. Yes, it's a usability pain to constantly use a browser extension to log in. But that pain is nothing compared to the stress of a compromise or targeted attack. Until password management or authentication are substantially overhauled on the web, the most optimal solution for protecting yourself is constant, militant vigilance with passwords. I don't know any of my passwords at all, and what's more, I even have randomly generated answers to security questions. Also, where possible, use two-factor authentication. You can use SMS, Authy, Google Authenticator, a Yubikey, whatever. Just turn the damn thing on and use it if it's available to you.
- patio11 10y agoA long time ago I used "rings" of passwords, where the least secure sites shared one, medium secure sites shared another, and most secure sites shared a third. This has some disadvantages, one because I was not always good at predicting which sites would end up security critical. (I probably signed up for 10 random web forums in 2009 and nothing at the time made news.ycombinator.com the obviously-important-to-me one.) These days, though, password managers. Use them 100% of the time. Turn 2FA on everywhere; mandate it administratively (ideally in can't-be-ignored settings) for company systems.
- andersonmvd 10y ago>> You can use SMS Well, it's not recommended: >> Due to the risk that SMS messages may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out of band verification is to be made using a SMS message on a public mobile telephone network, the verifier SHALL verify that the pre-registered telephone number being used is actually associated with a mobile network and not with a VoIP (or other software-based) service. It then sends the SMS message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change. OOB using SMS is deprecated, and may no longer be allowed in future releases of this guidance. Source: NIST (https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html)
- bigiain 10y agohttp://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-... The telco industry tells the banking industry not to consider SMS secure...
- mtgx 10y agoSo they are finally admitting that SS7 is a huge security problem to the point they have to recommend everyone not to use it for 2FA anymore....but they are not going to try and fix SS7.
- colemickens 10y agoDoes anyone know the Twitter handle in question? I'm curious to read about that incident. (edit: Oops, I guess I didn't realize the bold were hyperlinks in the article. Thanks for the pointer.)
- coderholic 10y agoYes, it's @n. This is linked from the article: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd#.elq4omaz5 https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- iancarroll 10y agoLikely @n: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- gregcmartin 10y agoThanks for sharing your story Kenneth. Unfortunately it will be a common one... Maintainers of open source projects will be increasingly target by sophisticated hacking teams, sometimes government funded. They will often win but the best thing you can do for yourself and your users is to practice good security hygiene and this story is a perfect example why. Strong random passwords everywhere (no repeated passwords) and 2-factor auth should be the minimum. Thankfully there are plenty of free apps out there that help you manage this process. Nobody can have perfect security but you can easily raise the bar high enough to force an attacker to move elsewhere. Also the Op's password was most likely taken from the recently leaked LinkedIn breach (educated guess).
- vtange 10y agoKenneth should repeat N's big takeaway: • Avoid using custom DNS emails (e.g. yourname@yourdomain.com) for any login purposes. It basically opens you up for these kind of attacks (where a hacker breaks into your domain name account and forwards your custom email to his own). Read N's story at https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd#.ler9o3cmg https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- mplewis 10y agoBut I don't want to use @gmail.com because that ties me down to the vendor. What am I supposed to use then?
- greenleafjacob 10y agoBuild your own security mechanisms (alerting, etc.)
- c22 10y agoYou could use @[IP address]? No guarantees this will pass whatever-service's arbitrary validation filters though.
- beagle3 10y agoOr that you can maintain that IP address if it was directly assigned to you by IANA/RIPE. (And in some cases, even if it WAS assigned to you). @[IP address] is a really bad idea.
- c22 10y agoYes, as it turns out using the internet requires reliance on third parties. Is the IP address of your mailserver as easy to compromise as your domain name? I don't know, it depends on your ISP, but it almost certainly requires a targeted attack. Using email to "secure" access to accounts is already "a really bad idea", so what can one do?
- jkaptur 10y agoIt's odd not to examine the "contacted a friend at GitHub" part. On the one hand, it's all too common to see this as the only escalation path at a modern tech company. On the other hand, at companies without strong internal controls, it raises the question of how to authenticate yourself to the friend at the company - especially in what the author describes as a stressful 10 minutes. We know from postmortems that the error-handling code tends to be among the least-tested parts of a codebase, which leads to cascading failure. I wonder if an even wilier attacker could have leveraged the analogous failure here.
- deleted 10y ago[deleted]
- micaksica 10y ago> It's odd not to examine the "contacted a friend at GitHub" part. Authentication aside: what does somebody do to talk to GitHub if you don't have a friend at GitHub that's willing to chat with you? Would Kenneth have been given the Source IP address of the attacker if he didn't know someone there?
- hueving 10y ago>what does somebody do to talk to GitHub if you don't have a friend at GitHub that's willing to chat with you? Write a blog post on Medium with the perfect click-bait title to make it go viral. Hope a github engineer reads it and gets back to you.
- beberlei 10y agoGithub has a support system and from my experience they reply quite fast.
- bigiain 10y agoThe usual way - social engineering. Spoof an inside line's callerID and say "Hi, it's Dave. What's the root password?" ;-)
- 10y ago
- tedmiston 10y agoWould using 2FA on the DNS provider have prevented this? It's unclear to me how exactly the attacker got into DNSsimple.
- Buge 10y agoPassword reuse with some other site that had it's database stolen.
- rcthompson 10y agoIs there a comprehensive list somewhere of which websites/services support 2FA and where to go to enable it on each one?
- kobayashi 10y agoYes :) https://twofactorauth.org https://twofactorauth.org
- rcthompson 10y agoThanks, that's just what I was looking for!
- xapata 10y agoHow could such a list possibly stay current short of having a web crawler and natural language processor? Or did you not mean an exhaustive list of all websites?
- pZsCd5iSrQtKIlv 10y agoRead this: https://en.wikipedia.org/wiki/Literal_and_figurative_language https://en.wikipedia.org/wiki/Literal_and_figurative_languag...
- deleted 10y ago[deleted]
- xapata 10y agoSeems I misread the question as asking for a complete list of websites that allow 2FA and websites that do not, the latter requiring an exhaustive listing of all sites on the internet. > figurative language I read the Wikipedia article. It indicates our friend rcthompson expected his question to be interpreted literally, not figuratively. He did not use a simile, nor metaphor, nor any of the other techniques Wikipedia lists. Perhaps you're suggesting that "comprehensive" should be interpreted as "many" or "a large variety" when the proper meaning is implausible. In that case, what use is the word "comprehensive"?
- imikay 10y agoYes, you should enable two-factor authentication for all your import accounts. My iCloud account was compromised two months ago, after that I turned on two-factor auth for all my important accounts.
- denfromufa 10y agoIs it possible to enforce two-factor authentication for all developers with merge rights on github? Also is it possible to check if someone has 2-factor authentication?
- snowwolf 10y agoIn an organisation on github you can see all members who don't have 2FA (indicated by a red !) - https://github.com/orgs/<org-name>/people https://github.com/orgs/<org-name>/people No way to mandate 2FA yet though.
- dredmorbius 10y agoLooking at the two best guesses: a reasonable assumption, if the Certifi bundle was in fact the target of this attack, is that some consumer of that bundle is that true target of this attack. (Incidentally: I'm not familiar with what the Certifi bundle is, and some quick DDGing didn't turn it up.) As a recent convo I'd had here on HN turned up, key management is a crucial element of PKI, which includes not only SSH and PGP, but the CA-based measures: SSL and TLS. Your web link is only as secure as the least-paranoid developer's MX registrations in your entire development toolchain.
- hoodoof 10y agoI'm still trying to wrap my head around DigitalOcean emailing me the root password to my new instances.
- voltagex_ 10y agoIf you specify a keypair to be used, they won't do that.
- noja 10y agoIf DigitalOcean and your mail server both talk TLS, what's the problem?
- bigiain 10y agoSome random old bit of Cisco gear sitting anywhere in between with it's default configuration set to strip out STARTTLS commands... http://www.cisco.com/c/en/us/about/security-center/intelligence/asa-esmtp-starttls.html http://www.cisco.com/c/en/us/about/security-center/intellige... "When Cisco ASA is configured for ESMTP inspection, the ASA is not able to examine the TLS session because it is encrypted. Therefore the ASA will prevent the establishment of the STARTTLS session and allow the SMTP endpoints to determine whether the SMTP session should continue in clear text (that is, with no privacy)." (I once billed a client just over $30k to investigate/diagnose/resolve that problem - there was a piece of Cisco gear on the edge of their network that nobody ever admitted to even knowing existed which was stripping out the STARTTLS instruction between a webapp running inside their own datacenter and their own 3rd party mail service - and everybody was pointing their fingers at _me_ for the mail not coming through encrypted... Twitch. Twitch. Twitch...)
- caf 10y agoIt'd be nice if you could flip a setting on GitHub so that password-reset emails are encrypted with a GPG key. They already have an interface for uploading GPG keys.
- ghiculescu 10y agoKind of related, does anyone know if it's possible to mandate two factor auth across a github organisation? I know you can see if it's enabled on your users list but that's a bit arduous. Seems like any one user not having 2fa enabled would be the weakest link other wise.
- omginternets 10y agoOh boy another plug for 2FA. I won't deny the obvious security advantages it confers, but that well has been poisoned a long time ago. Call me paranoid, but I have a hard time seeing the push for 2FA as anything other than a plot to collect valuable user data. As with most any good lie, it's mostly true -- 2FA does improve security -- but what happens when a company goes bankrupt and sells off it's assets? Moreover, I can't help but to question the actual necessity of this security feature. The OP's mess could have been avoided if he'd ... you know ... systematically chosen secure passwords. >Turn on two-factor authentication. Right now. I'll pass, thanks. P.S.: thanks for Requests!
- snowwolf 10y ago> The OP's mess could have been avoided if he'd ... you know ... systematically chosen secure passwords. In this exact scenario that is true but in general, not necessarily. He could of had a very secure password on his dns provider but through some other method that account could still have been compromised (social engineering, sql injection, poor brute force rate limiting, some other attack vector). And then once the dns account is compromised a password reset on github is trivial if there isn't 2FA on the github account - or any other account linked to that email account.
- omginternets 10y agoI can make the same argument for 2FA: social engineering can defeat it, or I can turn to some other attack vector. This isn't to say that 2FA doesn't add security. The point is rather twofold: 1. with a little extra attention, I can secure my system without 2FA and achieve comparable security 2. it's absolutely scandalous that the proverbial well has been poisoned and we are, by virtue of the fact that extra attention is required and that most people won't put in the work, in a less secure state. Again, this is due to the irresponsible data-policy of the overwhelming majority of service providers. So again: 2FA is a valid security layer, but I'll pass. :/
- snowwolf 10y ago> with a little extra attention, I can secure my system without 2FA and achieve comparable security How? Lets play devils advocate here and pretend your email is compromised (account takeover or redirect). What have you done on any of the services you use that has given you comparable security to enabling 2FA on them that now prevents the attacker from resetting your password?
- a_lifters_life 10y agoThanks for sharing!
- jokoon 10y agoDon't insurance companies require you to make any kind of internet security audit ? I mean if this doesn't happen, and if government don't take steps to improve the situation in the next 10 or 15 years, won't things get worse enough that politicians notice?
- w8rbt 10y agoSome domain registrars/DNS management services support multi-factor authentication. If yours does not, you should migrate to one that does. DNS is the foundation upon which everything else is built. And, it's been my experience that DNS and email attacks are very common. If an attacker can compromise DNS and email, then they can compromise all the higher-level services that send password resets by email (twitter, github, facebook, whatever).
- Buetol 10y agoI would be nice if the popular packages would have to be audited by the community before being pushed, would make it harder to do attacks with with such a large possible target (all the tech companies).
- forgotpwtomain 10y agoWait a minute, why does requests come with a cert bundle?
- cdnsteve 10y agoGithub authors - Sign your commits and tags with a PGP signature. https://help.github.com/articles/signing-commits-using-gpg/ https://help.github.com/articles/signing-commits-using-gpg/ It doesn't look like the authors/contributors of requests are using Github signed commits either.