4 ms·
Why aren't these attacks constrained by normal corporate firewalls? How does a random server on a navy ship start contacting baddie.china.com without raising re
by Narkov 8y ago
Why aren't these attacks constrained by normal corporate firewalls? How does a random server on a navy ship start contacting baddie.china.com without raising red flags?
- DarkWiiPlayer 8y agoWho's saying the firewall isn't compromised too? ;)
- Narkov 8y agoRight so all the stars need to align for it to go unnoticed - compromised server, firewall and other alerting/monitoring tools. I would have thought one single unexpected packet in these high security environments would raise significant alarm bells and any anomaly would be found very quickly.
- RL_Quine 8y agoI've worked on systems deployed in the financial sector in high risk environments. This sort of monitoring doesn't happen in the real world.
- Narkov 8y agoIntrusion Detection Systems are basic network security 101 type stuff. I'd be surprised if anything that was really "high risk" didn't use an IDS.
- detaro 8y agoThere's a big difference between "using an IDS" and "a few unintended/unexpected packets are noticed and properly followed up on".
- deleted 8y ago[deleted]
- Recurecur 8y agoIntrusion detection involves connections coming from the outside. These attacks originate inside the network, from the compromised equipment. Except on extremely controlled networks, this would be very hard to detect. It gets even worse when you consider that the Chinese had/have a distributed network of compromised machines. Imagine using a Google edge server as a dead drop...
- andrewflnr 8y agoAn IDS is perfectly capable of flagging outgoing or internal traffic.
- calgoo 8y agoWe had something similar where anything outside "normal" generated a ticket. It was disabled after 1 week because the support teams where getting more then 5000+ tickets each day. And this was after filtering etc.... Now this does not make it impossible, just very complex. In a more "controlled" environment such as a naval ship, i could see this actually working better, especially if the system is supposed to talk to very few external systems.
- contingencies 8y agoIt does. I've deployed systems that would not only notify staff when novel packets were observed but immediately isolate anomalous hardware through a combination of powerdown and network fabric reconfiguration.
- jki275 8y agoThe amount of false positives a system like that would generate would rapidly render such a system entirely unusable.
- contingencies 8y agoNot in a secure environment... where you are supposed to control the hardware, the software, and the network absolutely.
- jki275 8y agoThe only way to create such an environment is to totally disconnect it from the outside world -- I'm talking even power source, phones, internet, all of it has to be disconnected or else I can exfil data all day long and nobody would ever know.
- contingencies 8y agoYes, but eventually you have to get something done. Security engineering is about tolerable failure modes. - Dan Geer (2014)
- uuuups 8y agoHe was the "first employee and architect @ Kraken (2011-2015)". That might explain why Kraken spews out 502s all the time.
- contingencies 8y agoDear snarky anonymous coward, as stated I left in 2015. I think you will find referenced issues occurred subsequent to that date under very different technical leadership.
- Spooky23 8y agoOnly if you’re lucky. Priority is checking boxes and meeting audit requirements. If you’re running an IDS on a big 100 Gb datacenter network, you’re literally processing millions of events. Very few places would notice such a thing unless they were investigating something related, and the ones with the capability are going to be for static workloads as getting anything done will be slow and painful.
- TheSpiceIsLife 8y agoI suppose the hardware on the navy ship is communicating with a server that is also compromised, and so on and so forth.
- RL_Quine 8y agoEffectively nothing can be constrained by a whitelisting firewall if you have a sufficiently bored actor. You can smuggle data through a variety of benign looking protocols, things that wouldn't matter in the least generally. Your average server contacts hundreds of different public NTP servers, binary repositories, domain name servers every day. If the keys to the kingdom are a 32 byte ECDSA private key, you've lost if you think you can protect this from reaching the outside world. A method that wouldn't show up on any firewall in the world is simply to delay or drop certain SYN packets. Even if you only intended to transmit a bit at a time through this, any unauthenticated host on the internet could use this without raising any suspicion or even printing log lines in most environments. As soon are you're making an assumption that you're trying to prevent what's inside from getting out things become substantially closer to impossible than anybody would like.
- Narkov 8y agoFirewalls in high security environments aren't just port/protocol based. You lock everything down - source ip/port and destination ip/port. You should know where it is coming from and where it is going to. Navy ships don't upload via Dropbox.
- RL_Quine 8y agoIn the parent I described a system which would be able to communicate through those restrictions to another compromised host (remember we're assuming everything is compromised for the sake of this article, which actually seems like a good assumption now).
- FooHentai 8y agoNetworks where security is taken seriously implement data diodes, and this attack vector is mitigated.
- HillaryBriss 8y ago> remember we're assuming everything is compromised I think Bloomberg (and all related) web servers displaying the article are compromised and they're leaving out critical facts the point the finger elsewhere.
- pjc50 8y agoPresumably it contacts somewhere ubiquitous like AWS or Cloudflare.