6 ms·

Isn't the claim made in the article as sensational -- that the investigators replayed what the attackers did -- just kinda good practice? It'd just make sense

Isn't the claim made in the article as sensational -- that the investigators replayed what the attackers did -- just kinda good practice? It'd just make sense to me that, during an investigation, one would replay what the attackers did to get a good understanding of the results. This just seems like responsible investigation. (The flipside would instead be claiming that X was compromised, and not being able to honestly answer questions as to whether one retraced the attacker's steps to provide assurance.)

toomuchtodo 8y ago
You would expect a serious firm to have auditing and logging that would provide the necessary forensics without having to rerun an exploit.
- uhhhhhhh 8y ago
  They were able to identify and re-run the attack, so auditing and logging are likely present enough to capture what they attackers did, which in most breaches needs to be analyzed to see what they were able to accomplish. This doesn't shout amateur hour to me directly, it seems more kicking a dead horse while its down, but that doesn't mean it isn't amateur hour or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I'm not trying to defend them, just stating this sounds somewhat misleading and sensationalized.
  - toomuchtodo 8y ago
    > or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I haven't seen any proof that Equifax operates in any other way. I am not attempting to be rude, only stating fact.
    - g051051 8y ago
      Unless you work for them, you haven't seen any proof of anything, outside of the tiny amount of information revealed since the breach.
      - toomuchtodo 8y ago
        I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. I don’t need to be inside their org to see that. Do you work for Equifax?
        g051051 8y ago
        > I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. Can you share that proof?
        toomuchtodo 8y ago
        > Can you share that proof? https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... > If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies. > Here are the facts, according to Equifax. The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too. Sensitive personal and financial data of half of American adults, as well as UK and Canadian citizens. For 90 days. If that isn't proof, I don't know what is.
        g051051 8y ago
        That's proof of a security breach, not proof of "a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public".
        deleted 8y ago
- closeparen 8y ago
  You would keep a copy of every query result set? The storage requirements alone would be insane. Seems perfectly reasonable to load that day’s snapshot/rewind the WAL and rerun the query.
  - deleted 8y ago
    [deleted]
  - toomuchtodo 8y ago
    > You would keep a copy of every query result set? I am familiar with systems that do, and do not believe it to be an unreasonable ask depending on GRC [1] requirements. Storage is cheap, compression effective. [1] https://en.wikipedia.org/wiki/Governance,_risk_management,_and_compliance https://en.wikipedia.org/wiki/Governance,_risk_management,_a...
    - hderms 8y ago
      Have you ever honestly worked on a system that logged the results of every query run?
      - mberger 8y ago
        Yes. In E-Health you have to be able say who and what was queried for. There's also https://en.wikipedia.org/wiki/Reliable_messaging https://en.wikipedia.org/wiki/Reliable_messaging We store every message and every response so you can tell what query was run and when.
        dogma1138 8y ago
        You are confusing two concepts under HIPAA you are explicitly disallowed to log any EHR information. Record systems must be able to represent the exact EHR presented to a query e.g. to check if there was a human error like some one missreading the record. This is achieved by keeping record versions and a record history this isn’t achieved by having system logs and audit trails of queries returned. Essentially your EHR system would work like git you’ll be able to query the same commit as the original query but it doesn’t mean that your database audit trail would record any parts of the electronic health record that is simply not allowed.
- jimrandomh 8y ago
  The headline doesn't say they reran the exploit, it says they reran the queries. Big difference. Auditing and logging will generally record what queries were run, but definitely won't record the results of those queries, so this is as expected.
- gepeto42 8y ago
  And yet, it does not mean you would not re-run queries to confirm even if you did. I have encountered very few (not saying it's good, just that's how it is) companies with detailed database query+results logging that was stored for long enough, in any usable way...
slynch 8y ago
Yes. Responding to this and some of the comments below, this has been a standard practice for some time. There was a defcon talk about this years ago. https://www.defcon.org/images/defcon-20/dc-20-presentations/Novak-London/DEFCON-20-Novak-London-SQLReInjector.pdf https://www.defcon.org/images/defcon-20/dc-20-presentations/... How do you record what was accessed by a query? Record the results of every query run somewhere? Imagine the resulting data volume explosion you would endure. Instead, you maintain transaction logs or database snapshots so you can approximate database state, and you record the queries that are run. thats a more efficient means, and lets you handle DR, compliance, and investigative needs together.
zenexer 8y ago
Yes, it's a good practice, even if you believe you have the necessary technology in place to fully log what was exfiltrated. That being said, it's good to hear that they're actually doing so.

toomuchtodo 8y ago

You would expect a serious firm to have auditing and logging that would provide the necessary forensics without having to rerun an exploit.

uhhhhhhh 8y ago
They were able to identify and re-run the attack, so auditing and logging are likely present enough to capture what they attackers did, which in most breaches needs to be analyzed to see what they were able to accomplish. This doesn't shout amateur hour to me directly, it seems more kicking a dead horse while its down, but that doesn't mean it isn't amateur hour or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I'm not trying to defend them, just stating this sounds somewhat misleading and sensationalized.
- toomuchtodo 8y ago
  > or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I haven't seen any proof that Equifax operates in any other way. I am not attempting to be rude, only stating fact.
  - g051051 8y ago
    Unless you work for them, you haven't seen any proof of anything, outside of the tiny amount of information revealed since the breach.
    - toomuchtodo 8y ago
      I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. I don’t need to be inside their org to see that. Do you work for Equifax?
      - g051051 8y ago
        > I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. Can you share that proof?
        toomuchtodo 8y ago
        > Can you share that proof? https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... > If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies. > Here are the facts, according to Equifax. The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too. Sensitive personal and financial data of half of American adults, as well as UK and Canadian citizens. For 90 days. If that isn't proof, I don't know what is.
        g051051 8y ago
        That's proof of a security breach, not proof of "a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public".
        deleted 8y ago
closeparen 8y ago
You would keep a copy of every query result set? The storage requirements alone would be insane. Seems perfectly reasonable to load that day’s snapshot/rewind the WAL and rerun the query.
- deleted 8y ago
  [deleted]
- toomuchtodo 8y ago
  > You would keep a copy of every query result set? I am familiar with systems that do, and do not believe it to be an unreasonable ask depending on GRC [1] requirements. Storage is cheap, compression effective. [1] https://en.wikipedia.org/wiki/Governance,_risk_management,_and_compliance https://en.wikipedia.org/wiki/Governance,_risk_management,_a...
  - hderms 8y ago
    Have you ever honestly worked on a system that logged the results of every query run?
    - mberger 8y ago
      Yes. In E-Health you have to be able say who and what was queried for. There's also https://en.wikipedia.org/wiki/Reliable_messaging https://en.wikipedia.org/wiki/Reliable_messaging We store every message and every response so you can tell what query was run and when.
      - dogma1138 8y ago
        You are confusing two concepts under HIPAA you are explicitly disallowed to log any EHR information. Record systems must be able to represent the exact EHR presented to a query e.g. to check if there was a human error like some one missreading the record. This is achieved by keeping record versions and a record history this isn’t achieved by having system logs and audit trails of queries returned. Essentially your EHR system would work like git you’ll be able to query the same commit as the original query but it doesn’t mean that your database audit trail would record any parts of the electronic health record that is simply not allowed.
jimrandomh 8y ago
The headline doesn't say they reran the exploit, it says they reran the queries. Big difference. Auditing and logging will generally record what queries were run, but definitely won't record the results of those queries, so this is as expected.
gepeto42 8y ago
And yet, it does not mean you would not re-run queries to confirm even if you did. I have encountered very few (not saying it's good, just that's how it is) companies with detailed database query+results logging that was stored for long enough, in any usable way...

slynch 8y ago

Yes. Responding to this and some of the comments below, this has been a standard practice for some time. There was a defcon talk about this years ago. https://www.defcon.org/images/defcon-20/dc-20-presentations/Novak-London/DEFCON-20-Novak-London-SQLReInjector.pdf https://www.defcon.org/images/defcon-20/dc-20-presentations/... How do you record what was accessed by a query? Record the results of every query run somewhere? Imagine the resulting data volume explosion you would endure. Instead, you maintain transaction logs or database snapshots so you can approximate database state, and you record the queries that are run. thats a more efficient means, and lets you handle DR, compliance, and investigative needs together.

zenexer 8y ago

Yes, it's a good practice, even if you believe you have the necessary technology in place to fully log what was exfiltrated. That being said, it's good to hear that they're actually doing so.