10 ms·
Fox-IT hit by cyber attack
- the-dude 9y agoFox-IT is THE leading security firm in The Netherlands.
- jacquesm 9y agoBy volume, not by reputation.
- the-dude 9y agoWould you care to comment on who is leading by reputation in your opinion?
- thinkMOAR 9y agoBecause dutch news outlets always contact them for quotes, because they only know one security company. I'm pretty sure they are not the best. I tend to find it disappointing to see a security company use google analytics on their site and leak their visitor information to a big data third party.
- YouKnowBetter 9y agoWould you care to comment on who you'd consider better?
- thinkMOAR 9y agoThat is a very hard question. The simple answer is _that one_ security company that manages to compromise you and point out all issues within your company and or code for you to fix/address, that's the best one (for you). (if we can leave the financial part out of it, because security advice or audits aren't cheap either.) But it is not that simple. I don't consider that very likely, that you actually find that 'right' company. (and putting faith in a third party to audit your code/company, brings other risks too). And chances are that some issues will be overlooked but not by that 'weird' guy/girl in the attic that has all the time of the world to security probe you 'for free'. And there will always be a part you can't audit properly, your employees, which often is the origin of a hack, disgruntled employees. Or even worse, a disgruntled employee of the security company that just audited you. And keep in mind, with enough power, you can get anything offline or in a non acceptable state (half working, data compromise etc). So security companies can only help you a certain length, nonetheless it can be very helpful to have a person from outside look at things with 'fresh eyes' and see things you have overlooked for so long because you are right in the middle of it all.
- d215 9y agohttps://radicallyopensecurity.com/ https://radicallyopensecurity.com/ are pretty great. Don't know if they're actually better than fox-it. The latter I only know by reputation.
- mcv 9y agoI have no idea if they're the best, but they're pretty important. They also handle lots of internet security for the government. Them getting in trouble is a big deal.
- gpvos 9y agoAh yes, the Dutch government, which is so good at digital security choices cough Diginotar cough.
- smhg 9y agoThe term security expert (or similar) always gives me this uncomfortable feeling. Even if they don't literally call themselves this, definitely (in the case of Fox-IT) their appearance in the media often portrays them like this to the general public. Without getting into semantics, the general public is often left with experts' advice which makes them feel incompetent and/or scared. I guess you could blame journalism, but I don't know if you can expect them to be the whole bridge between both (that's another philosophical discussion anyway). My beef with these 'security experts from Fox-IT say...'-pieces is they don't provide proper context. Something like technology is complex, security is complex, it is hard or impossible to know everything, to know future risks,... you get the picture. I really like it when people acknowledge they don't know everything and in this case specifically because the opposite, I think, has a very negative effect on the general public.
- frik 9y agoAs Fox aka (Twenty-First Century Fox, Inc.) got acquired by Disney yesterday and is in the HN news. This news (Fox-IT) is about a completely different company from another continent! "Disney to Acquire Twenty-First Century Fox" (thewaltdisneycompany.com) 533 points by mxfh 23 hours ago https://news.ycombinator.com/item?id=15921692 https://news.ycombinator.com/item?id=15921692 Fox-IT is unrelated to Fox, so it's not the internal IT department of Fox. Fox-IT seems to be a company from Netherland. @downvoters: what's your problem? I wasted 5min reading the news, until I found out that it's a minor known company, and not related to "Fox". And then I inform others on HN, but then I get downvotes, yeah right - toxic
- yesenadam 9y ago"Don't be snarky. ... Please don't comment about the voting on comments. It never does any good, and it makes boring reading."
- donkeyd 9y agoYou get downvotes because of a probable combination of: - You comment this on a comment that already describes exactly what Fox-IT is. - You imply that anything that happens on another continent than yours is time "wasted". - Which in turn implies that all HN readers should be from the same continent that you are from. - There are many other companies with a name that contains Fox (pdf reader, apparel), this stuff happens. - You ask downvoters what their problem is. Which, from my experience is a very good way to get more downvotes. - The name of the country is the Netherlands, not Netherland.
- mcv 9y ago> The name of the country is the Netherlands, not Netherland. I disagree. I'm Dutch[0], and I find it stupid that English speakers always pluralise our country. We've been a unified country for quite some time now. Netherland is fine. [0] Yeah, "Dutch" is another one of those weird things that English inflicts on us. Why?
- nate_meurer 9y ago
- RandomTrees 9y agoThe core of the problem, a lot of paragraphs down: > we have strong evidence that supports our hypothesis that the adversary gained access to our [DNS provider's] credentials through the compromise of a third party provider > A factor which possibly helped the attacker was that the password had not been changed since 2013 > We chose our DNS provider 18 years ago when 2FA was neither a consideration nor a possibility
- c12 9y agoSlightly off topic but 2FA was both possible and a consideration 18 years ago, just not for the majority of people.
- chinathrow 9y agoCorrect. Banks in Europe hat various 2FA methods in place, even in the early days of online banking around year 2000.
- kybernetikos 9y agoI was using a simple form of 2FA with my retail bank in Switzerland back in the early 2000s.
- gpvos 9y agoDid any DNS providers implement it at that time?
- astura 9y agoYeah, that stuck out to me too, I know SecurID has been around since at least the early 2000s.
- pc86 9y ago18 years ago was 1999.
- 9y ago
- g0ran 9y ago> It’s become a widely accepted mantra that experiencing a cyber breach is a question of ‘when’ and not ‘if’. An excuse right off the bat and quite poor one, especially since it is a security company.
- 88 9y agoAn excuse it might be, but the claim becomes more prophetic by the day.
- Quarrelsome 9y agoBe fair. The burden on the defender is harsh as fuck. You're only as strong as your weakest link and attacks/probing is very cheap
- wepple 9y agoDo you think there is a single organization out there which will never be breached? I personally don’t think it’s possible. Or are you more taking aim at it being a defeatist position? I do t fully understand. I’ve never seen a decent, well-resourced red team not win.
- LeonM 9y agoThis is the exact reason I moved all my DNS to a new provider, as the old one does not allow 2FA. It sucks that you have to rely on an external supplier for such a critical part of your infrastructure. In my experience, most DNS suppliers mostly care about marketing, not so much about security.
- deleted 9y ago[deleted]
- mehrdadn 9y agoI thought this was about the company that makes the PDF reader. If there's a way to disambiguate the title that would be nice.
- BinaryIdiot 9y agoYeah, I had no idea there was another company by virtually the same name. A little disambiguation would be nice.
- feikname 9y agoI disagree with the notion that they're ambiguous at all. Foxit and Fox-IT have quite a noticeable difference in their names, IMO. (although they do have the same letters, so I get your point)
- cwilkes 9y agoWould a screen reader pronounce it as “fox dash it” or “fox it” for both? In my mind I read “fox it” without the dash and thought it was the PDF company. Which was really weird trying to wrap my head around how they could discover an issue like this so quickly.
- mehrdadn 9y ago> I disagree with the notion that they're ambiguous at all. I mean, it clearly confused me and a lot of other people as well, so I'm confused what this means. It's like reading Vm-Ware instead of VMWare. People would generally think they're referring to the same company unless they've heard of both.
- philamonster 9y ago>Sept 19 2017, 02:21 The actual MitM against our ClientPortal starts. At this point, the fraudulent SSL certificate for ClientPortal was in place and the IP DNS record for clientportal.fox-it.com was changed to point to a VPS provider abroad. >Sept 19 2017, 07:25 We determined that our name servers for the fox-it.com domain had been redirected and that this change was not authorized. We changed the DNS settings back to our own name servers and changed the password to the account at our domain registrar. This change will have taken time to have full effect, due to caching and the distributed nature of the domain name system. 5 hour, 4 minute response time. I would be okay with that _if_ I could get over what was overlooked.
- tkoski-hs 9y agoHow could one have detected this kind of attack even faster? Periodically calling the endpoint and validating the certificate used is the right one?
- breakingcups 9y agoAnother way could be to monitor the number of unique IP addresses connecting? That will get harder with IPV6, where you'll probably want to do it on subnet level. Also, automated DNS monitoring could work too.
- heredoc 9y agoyou can monitor certificate transparency for new certificates of your domain see https://sslmate.com/certspotter/ https://sslmate.com/certspotter/ or do it on your own.
- technion 9y agoNote that certificate transparency monitoring isn't instant. I've seen certs take a day or more to show up. Which is still highly valuable, in the scheme of things. But wouldn't improve on the timescales they've described. (I run ctadvisor.lolware.net)
- detaro 9y agoDo you have statistics about how fast different CAs are/how it is distributed? Are some CAs always "lagging", or do many of them have occasional late outliers, ...?
- technion 9y agoThat would be a great thing to analyse, but I don't currently have stats. Note, Google crawler will also submit anything it sees, so if your CA lags by a week but your new site is crawled in the next hour, you'll end up logged.
- tialaramex 9y ago
- rdl 9y agoWeird. While they're on Cloudflare Registrar now, it appears they used to be on Network Solutions. NetSol is pretty bad in a lot of ways, but you can make it less bad with some configuration competence. I would have assumed an IT security company would have done that.
- SaturateDK 9y agoI really liked the write up of this incident, but not the > It’s become a widely accepted mantra that experiencing a cyber breach is a question of ‘when’ and not ‘if’. Part however.
- wepple 9y agoI’m curious; what’s wrong with that? Do you disagree, have an example of a large org who has never been compromised?
- Double_Pulsar 9y agoMost large organizations have been compromised by the NSA already, and with the leaking of tools by the shadowbrokers... We could say that we will keep seeing more and more hacks.
- heredoc 9y agohttps://crt.sh/?q=%fox-it.com https://crt.sh/?q=%fox-it.com shows that certificates issued on September 19th are not revoked yet.
- technion 9y agoCTMp network sensors The first six Google hits for this phrase, relate to Fox-IT being hit. Can anyone share some details on these sensors, given they are described as being critical to the response?
- stephengillie 9y agoSome of the results I find for CTMP are Continuous Time Markov Processes. Here is a slide deck with poor kerning[0]. From an interesting slide: Numerical solution of implicitly encoded CTMCs If R is stored as a sparse matrix of columns, a Jacobi or GaussSeidel iteration has the cost of a vector-matrix multiplication, O(n(R)) If R is stored using implicit techniques (Kronecker algebra or decision diagrams), memory is greatly reduced but runtime can increase. E.g., using Shuffle to compute the effect of v, (pi)^(old) . (operator)(L<k<1) R(k,v1), is slower than Sparse multiplication if the R(k,v) matrices are very sparse. This research paper describes tracking cattle with a wireless sensor network[1]. --- Or this could be Cisco Technology Migration Program[2]. They could have some sort of network probe to identify "upgrade-ready" products, which could be leveraged for other purposes. --- [0] http://www.cs.ucr.edu/~cshelton/talks/ctmp-tut.pdf http://www.cs.ucr.edu/~cshelton/talks/ctmp-tut.pdf [1] https://www.researchgate.net/publication/271419298_Cattle_monitoring_system_using_wireless_sensor_network_in_order_to_prevent_cattle_rustling https://www.researchgate.net/publication/271419298_Cattle_mo... [2] https://www.cisco.com/web/partners/pr11/incentive/emea/tmp.html https://www.cisco.com/web/partners/pr11/incentive/emea/tmp.h...
- t0pr0 9y agoDude... CTMP means Cyber Threat Management System and it's a producy developed by Fox-IT as monitoring solution.
- jlgaddis 9y agoI'm going from (a not very good) memory but I wanna say it's something like "<something> traffic monitoring probe". Basically, they do full packet captures of all network traffic and retain it for a certain period of time so that it can be reviewed later (such as when something like this happens).
- amelius 9y ago> Ensure that all system access passwords are reviewed regularly and changed, even those which are used rarely. Surprised they don't use one-time passwords, or 2FA exclusively.
- icebraining 9y ago2FA still uses passwords (usually), so it stills makes sense to review and change them.
- bawana 9y agoso who was the DNS hosting provider? one of these? https://www.keycdn.com/blog/best-free-dns-hosting-providers/ https://www.keycdn.com/blog/best-free-dns-hosting-providers/ DNS is REALLY a weak link. Another one is the border gateway protocol. I recently read about all GOOGLE, FB, Apple,etc traffic being redirected through a single Russian address for a few minutes. So how does a third party get access to the creds to allow messing with your DNS hosting account? Social engineering? Or are there holes we need to know about?
- be2k0mdnn 9y agoFor all forms of certified ethical hacking and formidable penetration into social media accounts, mobile phone cloning and spyware, espionage services, web server and database penetration or take down, university database upgrade or modification - geniushack08(protonmail)com