9 ms·

Why CISA Issued Our First Emergency Directive

211 points by ca98am79 8y ago

Operyl 8y ago
Seems reasonable enough, steps that should have already been taken (and may have been already for certain sectors of the government). Pretty level headed “directive,” I definitely welcome it.
w8rbt 8y ago
Nine out of ten times, it's bad passwords.
- Operyl 8y ago
  Or shared credentials, etc.
  - Iwan-Zotow 8y ago
    or Putin
- Thorrez 8y ago
  Not phishing?
tptacek 8y ago
Fun detail: their first-ever "emergency directive", owing to a rash of DNS hijacking attacks, and not one mention of DNSSEC, despite the fact that the US Government requires agencies to use it. And they do! Pull a list of random .GOV or .MIL domains and check if they have DNSSEC --- most will! And it did fuck-all to stop this attack.
- magila 8y ago
  This attack vector is not something DNSSEC was ever intended to defend against, so why would it be mentioned? Once the registrar account associated with a domain is pwned the attacker can do pretty much anything they want with it, including obtain fraudulent certificates.
  - tptacek 8y ago
    As Colm MacCárthaigh noted on Twitter, not only does DNSSEC not defend against the most likely and damaging DNS attacks (hijacking between clients and servers, and hijacking at the registrar), it actually makes things worse: an attacker who has achieved the vantage point these attackers have can use DNSSEC to semipermanently poison records by using it to sign high-TTL records. It's not my claim that DNSSEC is what enabled this attack in the first place. But there's no way I'm going to leave the irony of USG agencies laboriously configuring their security-theater DNSSEC protocol while not being able to defend their registrar accounts or get basic MFA deployed.
    - Abekkus 8y ago
      Hijacked high-ttl records for signed zones aren't more dangerous than hijacked, high-ttl records for unsigned zones. Why do you claim that they are? They are both invalidated through the same mechanisms. It would be nice if there were reasonable limits on TTLs, but I'm not getting invited to those meetings.
  - jessaustin 8y ago
    Effort spent on DNSSEC might have been better spent on e.g. CT.
    - tptacek 8y ago
      CT: extensively remarked on in this advisory.
      - jessaustin 8y ago
        Yeah I read it; I was highlighting this for parent.
        tptacek 8y ago
        Sorry, was emphasizing, not correcting.
- microcolonel 8y ago
  To be fair, most people by now are aware that DNSSEC is not just a PITA to set up, but also basically useless; not to mention it was not designed to do anything about attacks of this type.
  - tptacek 8y ago
    That's the problem: it was designed to deal with the IETF namedroppers favorite attack (server-server cache poisoning, a la Eugene Kashpureff) and not any part of the real-world threat model for DNS. In fact, at this point, DNSSEC has very little to do with securing the DNS (as it is used by the rest of the Internet) at all; rather, it's a self-justifying self-rationalizing mechanism for building random new things nobody uses on top of the DNS. So it won't protect your DNS records, but it will try its hardest to make sure the security of your SSH sessions somehow depend on the security of those records.
    - microcolonel 8y ago
      An actual good solution wouldn't really be that complex to implement. You basically just need to sign a record or set of complimentary records (for example, all of your NS records), and make it reasonably simple to select and return those signatures from a recursive resolver, and then build a certificate hierarchy the exact shape of the DNS itself. You install the public key for the super seekret ICANN cert, and the client either trusts the recursive resolver or caches the tld certs and recursively resolves those, or some combination of the two. Beyond that, it's all a clerical matter of being better or worse at verifying identity at the level of the registrar and the NIC. Maybe a third party could start implementing something like this (maybe just a directory of domains validated in the way we do that for TLS), and it could be grafted to a NIC's infrastructure (maybe I'll talk to CIRA about it), and then maybe ICANN would pay attention after that. I'd be up for it, if a handful of other people would try as well.
  - loeg 8y ago
    There are an awful lot of people who are unaware that DNSSEC is basically useless, unfortunately.
- Operyl 8y ago
  Always a pleasure reading your rants on DNSSEC. How the hell was DNSSEC supposed to stop an attack against leaked credentials?
  - tptacek 8y ago
    It wasn't; that's not the point. The point is that it's expensive security theater that fails comprehensively in the face of real-world DNS attacks.
    - Operyl 8y ago
      It failed on this case, so it must equally fail in every? I don’t buy that ..
      - eropple 8y ago
        No. The assertion is that it does fail to provide a benefit in practical, real-world cases, but defends against a fairly niche attack. There's a reason that 'tptacek called it "security theater". Its implementors could better spend that time on actual security measures for things that are much more likely to happen...like defense in depth for credential leaking.
      - rocqua 8y ago
        It protects against targeted DNS poisoning, but that is already covered by TLS.
        ancarda 8y ago
        How is that protected by TLS? Wouldn't you need a good A/AAAA record to make a connection to a TLS server? Or do you perhaps mean DNS over (TLS|HTTPS)? I never saw that as a complete replacement for DNSSEC; it provides transport security, yes, but how do we know we aren't talking to a malicious resolver? Maybe that's not as much of a threat if people aren't using DNS servers from their ISP -- which sometimes inject ads or otherwise tamper with traffic.
- walrus01 8y ago
  DNSSEC is not going to do anything if you have the username/password account for your domain registrar account hijacked, and somebody logs in and changes the authoritative nameservers for your domain. This whole notice really boils down to "seriously, people, if you lose control of your domain registrar account, all bets are off"
jessaustin 8y ago
There isn't enough detail here. Which agencies gave an unknown (still unknown even now!) actor or actors access to all information that the public passed to them over the internet? What harms has the public suffered as a result?
- 616c 8y ago
  This impacted work for people I know and we have all asked around informally and no one has info in the beltway so those in the know seem to be tight lipped about it. That said I was unaware of the Talos publication last week so I will read that but I assume this same surface level fluff.
  - jessaustin 8y ago
    Thanks for that. I'm now more worried not less. b^)
AlphaWeaver 8y ago
>We know an active attacker is targeting government organizations. >Using techniques that aren’t especially innovative, we know they can intercept and manipulate legitimate traffic, make services unavailable or cause delay, harvest information like credentials or emails, or cause a range of other malicious activities. >We know that this type of attack isn’t something many organizations monitor for or have tight controls around. Interesting that they've specifically identified a case of this ongoing in a coordinated manner. Makes sense why it'd be an "emergency directive" in this case.
blunte 8y ago
Considering the top two cybersecurity roles in the US government have been vacant since mid 2018, it's fortunate that there are still some people focused on area.
- Godel_unicode 8y ago
  The "Cyber Czar" position was cancelled in 2018 when Rob Joyce went back to NSA.
  - blunte 8y ago
    The position was not cancelled. Tom Bossert had the position and resigned, and Rob Joyce assumed an acting position role from April 10, 2018 to May 31, 2018 (after which he returned to the NSA). The position simply has not been filled properly, like hundreds of other positions in government that have traditionally been filled in the past 4 decades.
    - Godel_unicode 8y ago
      The position was cancelled by executive order. Politics are one thing, but the facts in this case are materially different from what you state here.
- vxNsr 8y ago
  My understanding is Trump is having so much trouble getting confirmations through congress, he's basically stopped trying except for essentials and the gov has never taken tech related stuff as essential.
  - deleted 8y ago
    [deleted]
  - Whatevers 8y ago
    What do you base this understanding on?
  - 8y ago
westurner 8y ago
There are a number of efforts to secure DNS (and SSL/TLS which generally depends upon DNS; and upon which DNS-over-HTTPS depends) and the identity proof systems which are used for record-change authentication and authorization. Domain registrars can and SHOULD implement multi-factor authentication. https://en.wikipedia.org/wiki/Multi-factor_authentication https://en.wikipedia.org/wiki/Multi-factor_authentication Are there domain registrars that support FIDO/U2F or the new W3C WebAuthn spec? https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn Credentials and blockchains (and biometrics): https://gist.github.com/westurner/4345987bb29fca700f52163c339a270f https://gist.github.com/westurner/4345987bb29fca700f52163c33... DNSSEC: https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex... ACME / LetsEncrypt certs expire after 3 months (*) and require various proofs of domain ownership: https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment https://en.wikipedia.org/wiki/Automated_Certificate_Manageme... Certificate Transparency: https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency Certs on the Blockchain: "Can we merge Certificate Transparency with blockchain?" https://news.ycombinator.com/item?id=18961724 https://news.ycombinator.com/item?id=18961724 Namecoin (decentralized blockchain DNS): https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin DNSCrypt: https://en.wikipedia.org/wiki/DNSCrypt https://en.wikipedia.org/wiki/DNSCrypt DNS over HTTPS: https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS DNS over TLS: https://en.wikipedia.org/wiki/DNS_over_TLS https://en.wikipedia.org/wiki/DNS_over_TLS DNS: https://en.wikipedia.org/wiki/Domain_Name_System https://en.wikipedia.org/wiki/Domain_Name_System
planktonite 8y ago
All of this nonsense and chaos for what? So that people have a slightly easier time remembering the address of a website? DNS is a stupid and naive concept that was born in a time when the social and security consequences of an internet were not understood well. Why do we continue to use this shitty system? JS is the same: it sucks. It causes all kinds of problems and for basically nothing in return. The web is fucking broken and it frustrates me.
zeeshan121 8y ago
https://www.kouponkabla.com/blue-buffalo-coupons-now-get-60-off-2019/ https://www.kouponkabla.com/blue-buffalo-coupons-now-get-60-...
ccnafr 8y ago
tl, dr: Because Iranian hackers were hijacking DNS records for government sites.
- ciupicri 8y ago
  Where is Iran mentioned?
  - eganist 8y ago
    It's buried in links, but the FireEye research referenced by US CERT discusses it. https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS... And https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html https://www.fireeye.com/blog/threat-research/2019/01/global-... --- Link chain that I followed: 1) op — https://cyber.dhs.gov/blog/#why-cisa-issued-our-first-emergency-directive https://cyber.dhs.gov/blog/#why-cisa-issued-our-first-emerge... 2) first link in op, "emergency directive" — https://cyber.dhs.gov/ed/19-01 https://cyber.dhs.gov/ed/19-01 3) footnote #1 in the emergency directive — https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS... 4) FireEye research referenced on the US CERT page — https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html https://www.fireeye.com/blog/threat-research/2019/01/global-...
  - deleted 8y ago
    [deleted]
ehnto 8y ago
I am probably just cynical but the title reads like a medium tech blogger is about to tell me why he started using React in the cloud.

211 points by ca98am79 8y ago

Seems reasonable enough, steps that should have already been taken (and may have been already for certain sectors of the government). Pretty level headed “directive,” I definitely welcome it.

w8rbt 8y ago

Nine out of ten times, it's bad passwords.

Operyl 8y ago
Or shared credentials, etc.
- Iwan-Zotow 8y ago
  or Putin
Thorrez 8y ago
Not phishing?

tptacek 8y ago

Fun detail: their first-ever "emergency directive", owing to a rash of DNS hijacking attacks, and not one mention of DNSSEC, despite the fact that the US Government requires agencies to use it. And they do! Pull a list of random .GOV or .MIL domains and check if they have DNSSEC --- most will! And it did fuck-all to stop this attack.

magila 8y ago
This attack vector is not something DNSSEC was ever intended to defend against, so why would it be mentioned? Once the registrar account associated with a domain is pwned the attacker can do pretty much anything they want with it, including obtain fraudulent certificates.
- tptacek 8y ago
  As Colm MacCárthaigh noted on Twitter, not only does DNSSEC not defend against the most likely and damaging DNS attacks (hijacking between clients and servers, and hijacking at the registrar), it actually makes things worse: an attacker who has achieved the vantage point these attackers have can use DNSSEC to semipermanently poison records by using it to sign high-TTL records. It's not my claim that DNSSEC is what enabled this attack in the first place. But there's no way I'm going to leave the irony of USG agencies laboriously configuring their security-theater DNSSEC protocol while not being able to defend their registrar accounts or get basic MFA deployed.
  - Abekkus 8y ago
    Hijacked high-ttl records for signed zones aren't more dangerous than hijacked, high-ttl records for unsigned zones. Why do you claim that they are? They are both invalidated through the same mechanisms. It would be nice if there were reasonable limits on TTLs, but I'm not getting invited to those meetings.
- jessaustin 8y ago
  Effort spent on DNSSEC might have been better spent on e.g. CT.
  - tptacek 8y ago
    CT: extensively remarked on in this advisory.
    - jessaustin 8y ago
      Yeah I read it; I was highlighting this for parent.
      - tptacek 8y ago
        Sorry, was emphasizing, not correcting.
microcolonel 8y ago
To be fair, most people by now are aware that DNSSEC is not just a PITA to set up, but also basically useless; not to mention it was not designed to do anything about attacks of this type.
- tptacek 8y ago
  That's the problem: it was designed to deal with the IETF namedroppers favorite attack (server-server cache poisoning, a la Eugene Kashpureff) and not any part of the real-world threat model for DNS. In fact, at this point, DNSSEC has very little to do with securing the DNS (as it is used by the rest of the Internet) at all; rather, it's a self-justifying self-rationalizing mechanism for building random new things nobody uses on top of the DNS. So it won't protect your DNS records, but it will try its hardest to make sure the security of your SSH sessions somehow depend on the security of those records.
  - microcolonel 8y ago
    An actual good solution wouldn't really be that complex to implement. You basically just need to sign a record or set of complimentary records (for example, all of your NS records), and make it reasonably simple to select and return those signatures from a recursive resolver, and then build a certificate hierarchy the exact shape of the DNS itself. You install the public key for the super seekret ICANN cert, and the client either trusts the recursive resolver or caches the tld certs and recursively resolves those, or some combination of the two. Beyond that, it's all a clerical matter of being better or worse at verifying identity at the level of the registrar and the NIC. Maybe a third party could start implementing something like this (maybe just a directory of domains validated in the way we do that for TLS), and it could be grafted to a NIC's infrastructure (maybe I'll talk to CIRA about it), and then maybe ICANN would pay attention after that. I'd be up for it, if a handful of other people would try as well.
- loeg 8y ago
  There are an awful lot of people who are unaware that DNSSEC is basically useless, unfortunately.
Operyl 8y ago
Always a pleasure reading your rants on DNSSEC. How the hell was DNSSEC supposed to stop an attack against leaked credentials?
- tptacek 8y ago
  It wasn't; that's not the point. The point is that it's expensive security theater that fails comprehensively in the face of real-world DNS attacks.
  - Operyl 8y ago
    It failed on this case, so it must equally fail in every? I don’t buy that ..
    - eropple 8y ago
      No. The assertion is that it does fail to provide a benefit in practical, real-world cases, but defends against a fairly niche attack. There's a reason that 'tptacek called it "security theater". Its implementors could better spend that time on actual security measures for things that are much more likely to happen...like defense in depth for credential leaking.
    - rocqua 8y ago
      It protects against targeted DNS poisoning, but that is already covered by TLS.
      - ancarda 8y ago
        How is that protected by TLS? Wouldn't you need a good A/AAAA record to make a connection to a TLS server? Or do you perhaps mean DNS over (TLS|HTTPS)? I never saw that as a complete replacement for DNSSEC; it provides transport security, yes, but how do we know we aren't talking to a malicious resolver? Maybe that's not as much of a threat if people aren't using DNS servers from their ISP -- which sometimes inject ads or otherwise tamper with traffic.
walrus01 8y ago
DNSSEC is not going to do anything if you have the username/password account for your domain registrar account hijacked, and somebody logs in and changes the authoritative nameservers for your domain. This whole notice really boils down to "seriously, people, if you lose control of your domain registrar account, all bets are off"

jessaustin 8y ago

There isn't enough detail here. Which agencies gave an unknown (still unknown even now!) actor or actors access to all information that the public passed to them over the internet? What harms has the public suffered as a result?

616c 8y ago
This impacted work for people I know and we have all asked around informally and no one has info in the beltway so those in the know seem to be tight lipped about it. That said I was unaware of the Talos publication last week so I will read that but I assume this same surface level fluff.
- jessaustin 8y ago
  Thanks for that. I'm now more worried not less. b^)

AlphaWeaver 8y ago

>We know an active attacker is targeting government organizations. >Using techniques that aren’t especially innovative, we know they can intercept and manipulate legitimate traffic, make services unavailable or cause delay, harvest information like credentials or emails, or cause a range of other malicious activities. >We know that this type of attack isn’t something many organizations monitor for or have tight controls around. Interesting that they've specifically identified a case of this ongoing in a coordinated manner. Makes sense why it'd be an "emergency directive" in this case.

blunte 8y ago

Considering the top two cybersecurity roles in the US government have been vacant since mid 2018, it's fortunate that there are still some people focused on area.

Godel_unicode 8y ago
The "Cyber Czar" position was cancelled in 2018 when Rob Joyce went back to NSA.
- blunte 8y ago
  The position was not cancelled. Tom Bossert had the position and resigned, and Rob Joyce assumed an acting position role from April 10, 2018 to May 31, 2018 (after which he returned to the NSA). The position simply has not been filled properly, like hundreds of other positions in government that have traditionally been filled in the past 4 decades.
  - Godel_unicode 8y ago
    The position was cancelled by executive order. Politics are one thing, but the facts in this case are materially different from what you state here.
vxNsr 8y ago
My understanding is Trump is having so much trouble getting confirmations through congress, he's basically stopped trying except for essentials and the gov has never taken tech related stuff as essential.
- deleted 8y ago
  [deleted]
- Whatevers 8y ago
  What do you base this understanding on?
- 8y ago

westurner 8y ago

There are a number of efforts to secure DNS (and SSL/TLS which generally depends upon DNS; and upon which DNS-over-HTTPS depends) and the identity proof systems which are used for record-change authentication and authorization. Domain registrars can and SHOULD implement multi-factor authentication. https://en.wikipedia.org/wiki/Multi-factor_authentication https://en.wikipedia.org/wiki/Multi-factor_authentication Are there domain registrars that support FIDO/U2F or the new W3C WebAuthn spec? https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn Credentials and blockchains (and biometrics): https://gist.github.com/westurner/4345987bb29fca700f52163c339a270f https://gist.github.com/westurner/4345987bb29fca700f52163c33... DNSSEC: https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex... ACME / LetsEncrypt certs expire after 3 months (*) and require various proofs of domain ownership: https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment https://en.wikipedia.org/wiki/Automated_Certificate_Manageme... Certificate Transparency: https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency Certs on the Blockchain: "Can we merge Certificate Transparency with blockchain?" https://news.ycombinator.com/item?id=18961724 https://news.ycombinator.com/item?id=18961724 Namecoin (decentralized blockchain DNS): https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin DNSCrypt: https://en.wikipedia.org/wiki/DNSCrypt https://en.wikipedia.org/wiki/DNSCrypt DNS over HTTPS: https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS DNS over TLS: https://en.wikipedia.org/wiki/DNS_over_TLS https://en.wikipedia.org/wiki/DNS_over_TLS DNS: https://en.wikipedia.org/wiki/Domain_Name_System https://en.wikipedia.org/wiki/Domain_Name_System

planktonite 8y ago

All of this nonsense and chaos for what? So that people have a slightly easier time remembering the address of a website? DNS is a stupid and naive concept that was born in a time when the social and security consequences of an internet were not understood well. Why do we continue to use this shitty system? JS is the same: it sucks. It causes all kinds of problems and for basically nothing in return. The web is fucking broken and it frustrates me.

zeeshan121 8y ago

https://www.kouponkabla.com/blue-buffalo-coupons-now-get-60-off-2019/ https://www.kouponkabla.com/blue-buffalo-coupons-now-get-60-...

ccnafr 8y ago

tl, dr: Because Iranian hackers were hijacking DNS records for government sites.

ciupicri 8y ago
Where is Iran mentioned?
- eganist 8y ago
  It's buried in links, but the FireEye research referenced by US CERT discusses it. https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS... And https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html https://www.fireeye.com/blog/threat-research/2019/01/global-... --- Link chain that I followed: 1) op — https://cyber.dhs.gov/blog/#why-cisa-issued-our-first-emergency-directive https://cyber.dhs.gov/blog/#why-cisa-issued-our-first-emerge... 2) first link in op, "emergency directive" — https://cyber.dhs.gov/ed/19-01 https://cyber.dhs.gov/ed/19-01 3) footnote #1 in the emergency directive — https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS... 4) FireEye research referenced on the US CERT page — https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html https://www.fireeye.com/blog/threat-research/2019/01/global-...
- deleted 8y ago
  [deleted]

ehnto 8y ago

I am probably just cynical but the title reads like a medium tech blogger is about to tell me why he started using React in the cloud.