4 ms·

Detecting data exfiltration has always seemed like an impossible problem to me. The implication is that "infiltration" has already occurred, and now the attacke

Detecting data exfiltration has always seemed like an impossible problem to me. The implication is that "infiltration" has already occurred, and now the attacker just has to read/send the sensitive data somewhere. But if they have enough control to tell some system to dump its contents somewhere, how could they not have enough control to obfuscate the data itself? It seems like these systems could only work by either using some heuristic like data volume to decide when something is being "exfiltrated", which isn't nearly as useful, or by whitelisting allowed communications, which seems absurd. What am I missing?

txcwpalpha 8y ago
Ideally, the systems that prevent "infiltration" are separate from the systems that detect (and even prevent) "exfiltration". Just because you breached the firewall, that doesn't mean you can delete all the logs of network traffic passing through it. It's of course much more difficult than that in practice, but that's the general idea.
viraptor 8y ago
> But if they have enough control to tell some system to dump its contents somewhere This doesn't have to mean that they have full, unrestricted access. Access to data may mean that they could get raw records via some internal API. That API may still have logging, access control, DoS protection, etc. Just like you can detect and prevent an external person from scraping your website in most cases, you can detect some internal service requesting way more than an average hourly number of records. Or with a better audit - specific verifiable entity (signed employee requests, external request id markers, etc.) requesting more than they should. That assumes you have well designed system with multiple tiers and assume no trust. It's not possible if every service connects to the same database with yolo-root-access.
- nickodell 8y ago
  I get the impression that they did connect with yolo root access. >Although the ACIS application required access to only three databases within the Equifax environment to perform its business function, the ACIS application was not segmented off from other, unrelated databases. As a result, the attackers used the application credentials to gain access to 48 unrelated databases outside of the ACIS environment.
sjeanpierre 8y ago
Heuristics like data volume are a good starting point, but also known good traffic flow is important to know. In a "secure" environment you'd route all traffic through a know choke-point that is network controlled. In AWS this would be using the routing layer of the VPC to force traffic to something like a Squid proxy before allowing it out. On that proxy outbound traffic destination host or IPs would be compared to a list of known destination, and rejected if not match is found. These methods are not 100%, but they do help add another layer to the security process.
passive 8y ago
Whitelisting allowed outgoing targets isn't absurd at all. It should be standard practice for anyone running a system remotely like Equifax's. It's not the only type of protection, but if your business is basically a lump of data, you want to know exactly who you're communicating with.
- staticassertion 8y ago
  Which just means you need to proxy your exfil with a host that has external traffic, such as anyone's laptop, or an edge server. Of course, now this means you just need to detect that sort of proxying, which may be easier. Detecting exfil sucks and is hard.
  - passive 8y ago
    Sure, but that's at least an additional piece of security, requiring additional work to bypass. I totally agree that 100% exfil detection is near impossible. But if you were going to try to get close to it, this is one of the world's databases where you really would want to. Their entire model is about collecting a shit ton of information and providing very heavily controlled access to it. Very well paid people should have spent a lot of time examining how to balance the need to pull in data from many sources, while providing only monetized ways to actually retrieve said data. They're like an old-timey pirate captain, who spends most of her time roaming all over the place in the hopes of being able to plunder someone else's treasure, then hiding said treasure in a safe place. Except they really didn't take the hiding the treasure part very seriously. ;)
    - staticassertion 8y ago
      > Sure, but that's at least an additional piece of security, requiring additional work to bypass. I would not consider the ability to proxy traffic much of a new capability for attackers. You can do it trivially with a single SSH command. Even a script kiddy with automated tooling should be able to handle this. Agree that detecting exfil when you have sensitive data is very important though. Just that it takes a lot of work to protect against, and a ton of work to detect.
stdplaceholder 8y ago
Equifax cannot detect exfiltration of your data because distributing your data is their line of business. Your personal details pouring out of their servers at high speeds is what always happens there, 24 hours a day.
- passive 8y ago
  If my business is distributing data, the number one thing I would monitor for is that I'm getting paid for the data I distribute. Data that gets distributed for free is nearly the worst thing my software can do, so I should be investing a ton in preventing it.
mulmen 8y ago
This isn't a technology problem. This is an accountability/incentive problem. If you cannot store data securely then you should not profit from that data. Business models that insecurely store consumer data should not be viable.
brentjanderson 8y ago
There are two approaches to detecting exfiltration that I consider state of the art: * Network traffic capture for deferred analysis * Egress analysis (including decrypting SSL/HTTPS) The first approach is, IMO, more realistic. Although you can't prevent the exfiltration, you can detect it lazily after it's happened, including where it went, what was sent, etc. Although I'm sure several companies support this, [Eastwind Networks](https://www.eastwindnetworks.com/ https://www.eastwindnetworks.com/) does a great job for Cloud and on-prem workloads. The second option, while more thorough, requires big boxes to run, doesn't scale well, is hard to install on clients (the only way I know to "break" HTTPS is to install a custom CA on all clients and MITM all public traffic, which would break for sites using HSTS and HTTP Public Key Pinning). It's only vaguely feasible, and is fraught with issues.
- hermitdev 8y ago
  My company utlizes Corvill appliances and network taps on the switches to monitor activity. We mostly use it for metrics, but no reason it couldn't monitor exfil. Onky problem is it only has enough storage for about 3-4 days of network traffic.

txcwpalpha 8y ago

Ideally, the systems that prevent "infiltration" are separate from the systems that detect (and even prevent) "exfiltration". Just because you breached the firewall, that doesn't mean you can delete all the logs of network traffic passing through it. It's of course much more difficult than that in practice, but that's the general idea.

viraptor 8y ago

> But if they have enough control to tell some system to dump its contents somewhere This doesn't have to mean that they have full, unrestricted access. Access to data may mean that they could get raw records via some internal API. That API may still have logging, access control, DoS protection, etc. Just like you can detect and prevent an external person from scraping your website in most cases, you can detect some internal service requesting way more than an average hourly number of records. Or with a better audit - specific verifiable entity (signed employee requests, external request id markers, etc.) requesting more than they should. That assumes you have well designed system with multiple tiers and assume no trust. It's not possible if every service connects to the same database with yolo-root-access.

nickodell 8y ago
I get the impression that they did connect with yolo root access. >Although the ACIS application required access to only three databases within the Equifax environment to perform its business function, the ACIS application was not segmented off from other, unrelated databases. As a result, the attackers used the application credentials to gain access to 48 unrelated databases outside of the ACIS environment.

sjeanpierre 8y ago

Heuristics like data volume are a good starting point, but also known good traffic flow is important to know. In a "secure" environment you'd route all traffic through a know choke-point that is network controlled. In AWS this would be using the routing layer of the VPC to force traffic to something like a Squid proxy before allowing it out. On that proxy outbound traffic destination host or IPs would be compared to a list of known destination, and rejected if not match is found. These methods are not 100%, but they do help add another layer to the security process.

passive 8y ago

Whitelisting allowed outgoing targets isn't absurd at all. It should be standard practice for anyone running a system remotely like Equifax's. It's not the only type of protection, but if your business is basically a lump of data, you want to know exactly who you're communicating with.

staticassertion 8y ago
Which just means you need to proxy your exfil with a host that has external traffic, such as anyone's laptop, or an edge server. Of course, now this means you just need to detect that sort of proxying, which may be easier. Detecting exfil sucks and is hard.
- passive 8y ago
  Sure, but that's at least an additional piece of security, requiring additional work to bypass. I totally agree that 100% exfil detection is near impossible. But if you were going to try to get close to it, this is one of the world's databases where you really would want to. Their entire model is about collecting a shit ton of information and providing very heavily controlled access to it. Very well paid people should have spent a lot of time examining how to balance the need to pull in data from many sources, while providing only monetized ways to actually retrieve said data. They're like an old-timey pirate captain, who spends most of her time roaming all over the place in the hopes of being able to plunder someone else's treasure, then hiding said treasure in a safe place. Except they really didn't take the hiding the treasure part very seriously. ;)
  - staticassertion 8y ago
    > Sure, but that's at least an additional piece of security, requiring additional work to bypass. I would not consider the ability to proxy traffic much of a new capability for attackers. You can do it trivially with a single SSH command. Even a script kiddy with automated tooling should be able to handle this. Agree that detecting exfil when you have sensitive data is very important though. Just that it takes a lot of work to protect against, and a ton of work to detect.

stdplaceholder 8y ago

Equifax cannot detect exfiltration of your data because distributing your data is their line of business. Your personal details pouring out of their servers at high speeds is what always happens there, 24 hours a day.

passive 8y ago
If my business is distributing data, the number one thing I would monitor for is that I'm getting paid for the data I distribute. Data that gets distributed for free is nearly the worst thing my software can do, so I should be investing a ton in preventing it.

mulmen 8y ago

This isn't a technology problem. This is an accountability/incentive problem. If you cannot store data securely then you should not profit from that data. Business models that insecurely store consumer data should not be viable.

brentjanderson 8y ago

There are two approaches to detecting exfiltration that I consider state of the art: * Network traffic capture for deferred analysis * Egress analysis (including decrypting SSL/HTTPS) The first approach is, IMO, more realistic. Although you can't prevent the exfiltration, you can detect it lazily after it's happened, including where it went, what was sent, etc. Although I'm sure several companies support this, [Eastwind Networks](https://www.eastwindnetworks.com/ https://www.eastwindnetworks.com/) does a great job for Cloud and on-prem workloads. The second option, while more thorough, requires big boxes to run, doesn't scale well, is hard to install on clients (the only way I know to "break" HTTPS is to install a custom CA on all clients and MITM all public traffic, which would break for sites using HSTS and HTTP Public Key Pinning). It's only vaguely feasible, and is fraught with issues.

hermitdev 8y ago
My company utlizes Corvill appliances and network taps on the switches to monitor activity. We mostly use it for metrics, but no reason it couldn't monitor exfil. Onky problem is it only has enough storage for about 3-4 days of network traffic.