27 ms·

From what I read the hack was not sophisticated at all. If they had decent endpoint protection this would not have happened. Maybe they disabled defender after

From what I read the hack was not sophisticated at all. If they had decent endpoint protection this would not have happened. Maybe they disabled defender after the initial access and privesc because defender blocks Get-Keystrokes and other things in empire,even with significant modification. Anyway, I don't care about the hacktivism and propaganda (don't really get it -- tbh,rich people bad/corrupt?) But would very much be interested in any post-incident analysis of what happend. But here's what stands out to me: they're talking about using empire and hvnc. Empire is by design detectable,you could use the techniques in empire in your own malware though. Most rats and bots (take trickbot) let you sniff key strokes, run commands,etc... So I guess they used psexec or winrm to access the hosts(no vlan segmentation or firewall on endpoints!?). I ask all this because the specific MO is significantly different than what is seen with criminal actors and crimeware(like Carbank which She mentions). And to me, it does corroborate the story that this was likely an independent hacker motivated by hacktivism as opposed to a bigger conspiracy to burn some group and plant false records in the leak (which could still less likely be the case) Very exciting,righteous hack. I think overall, the bank cheaped out on IT and paid big time for it.

georgeglue1 7y ago
>> (don't really get it -- tbh,rich people bad/corrupt?) it's not so much that wealth is bad, but tax evasion and money laundering (from organized crime, corruption, etc.) is bad.
joshypants 7y ago
The future of the species is literally imperiled right now because we've allowed rich people to hoard wealth, so that's a reason to care.
- badrabbit 7y ago
  Really? I thought governments had a lot more, like trillions more. I thought the quality of life for humanity has never been better than now? Do you mean climate change? If so how does rich people's greed fit in the picture. I don't think they should hoard cash, there should be a limit on that but net worth usually includea stock value, wealth in form of stocks is far from hoarding. I think cash wealth limits and a legal limit on pay gap would help but I still don't see the rich do anything they haven't done throughout history. If anything, democraric processes and institutions are failing the people.
  - zilian 7y ago
    You must be rich to talk like that. Rich people generally emit a f#ckton of co2 and worse, they do not use their wealth to try to mitigate it, thereby condemning their own children.
    - tossAfterUsing 7y ago
      oh, so it's all the global poor who are coordinating their efforts to reduce emissions of companies they don't own or operate? thanks for clearing that up!
      - BoorishBears 7y ago
        The global poor don't get to choose. When the choice is firewood or not being able to cook and stay warm, you use firewood. When the choice is find some way to stay entertained without taking quarterly vacations on CO2 generating flights to expensive getaways or keep polluting somehow no one bats an eyelid.
        badrabbit 7y ago
        There aren't enough rich people to compete with commercial airliner's emissions. Cruise ships are HUGE emittors(they even get around emissions control laws) for example but the western middle class is their user not the rich or poor.
        BoorishBears 7y ago
        You realize the first-world middle class taking cruises is as much a part of the rich as billionaires right? A yearly salary of something like 32k puts you in the global 1% of earners. I won't be so strict about the definition of the rich, but families having money for cruises are definitely part of the demographic I'm speaking to. And I mean, vacations is are just the tip of the iceberg, those people so poor they have to use firewood go survive, aren't the reason we have so many commercial airliners shuttling around goods so we can have the latest throwaway item we desire in 48hrs or less.
nyolfen 7y ago
> privacy for the weak, transparency for the powerful
arminiusreturns 7y ago
Here's the thing. While most people on HN tend to be in the global top performers when it comes to IT, the vast majority of businesses are simply ripe, low hanging fruit just waiting to be breached, and almost every time it is because of a failure of management to understand the importance of those things. Way too many 60 year old men who barely know how to use a computer are at the top of orgs, and are stuck in the janitorial cost sink fallacy of IT. I also put a lot of this on the heads of IT directors or senior sysadmins, who are failing to convey the importance of the matter to those C-levels in terms they understand. I have learned this the hard way, having started up an MSP at one point and done a lot of contracting to help orgs unfuck their infra, I have seen it all first hand, from 5-30 person lawfirms to fortune 500 oil companies to unicorn startups. I have been the senior sysadmin who failed to convey things in a way the got through C-level thick skulls, and most of my career trajectory has been angled towards keeping up with the sysadmin transition to devops while learning how to fill that gap so I don't repeat those mistakes. I've failed multiple times, but each one is a lesson I learn from and try to apply to the next place, and sometimes C-levels literally just don't care and can't be reached, and nothing happens till a major breach or lawsuit costs lots of money. To me, this is the importance of the CTO/CIO roles. The problem is, again, the vast majority of America isn't SV. I would say ~%80 of companies I saw didn't even have those roles, and if they had someone in that role but without the title (like IT director), they often didn't have a seat on the board or any real influence with the C's. I have also seen those roles taken by people who should be in other positions but enjoy the "C" title too much, to the detriment of the org. Sorry, this got kind of ranty, but it's an issue I obsess over in trying to find better solutions for. Basically I'm learning how to hack management instead of computers these days.
- matheusmoreira 7y ago
  > I also put a lot of this on the heads of IT directors or senior sysadmins, who are failing to convey the importance of the matter to those C-levels in terms they understand. Why? Understanding the risks involved before making a decision is the responsibility of executives. If they calculate that the risks are minimal and crackers prove them wrong by causing damage to the tune of millions, they have only themselves to blame. How many times have people explained the need for things to be done properly, only for proper infrastructure to be written off as too costly and unnecessary? The fact is they are taking a calculated risk: they get to spend less on information security by assuming nothing bad will happen. Claiming that it's the fault of system administrators is just yet another power move: scapegoating in order to avoid responsibility. They make the decisions and should face the consequences.

georgeglue1 7y ago

>> (don't really get it -- tbh,rich people bad/corrupt?) it's not so much that wealth is bad, but tax evasion and money laundering (from organized crime, corruption, etc.) is bad.

joshypants 7y ago

The future of the species is literally imperiled right now because we've allowed rich people to hoard wealth, so that's a reason to care.

badrabbit 7y ago
Really? I thought governments had a lot more, like trillions more. I thought the quality of life for humanity has never been better than now? Do you mean climate change? If so how does rich people's greed fit in the picture. I don't think they should hoard cash, there should be a limit on that but net worth usually includea stock value, wealth in form of stocks is far from hoarding. I think cash wealth limits and a legal limit on pay gap would help but I still don't see the rich do anything they haven't done throughout history. If anything, democraric processes and institutions are failing the people.
- zilian 7y ago
  You must be rich to talk like that. Rich people generally emit a f#ckton of co2 and worse, they do not use their wealth to try to mitigate it, thereby condemning their own children.
  - tossAfterUsing 7y ago
    oh, so it's all the global poor who are coordinating their efforts to reduce emissions of companies they don't own or operate? thanks for clearing that up!
    - BoorishBears 7y ago
      The global poor don't get to choose. When the choice is firewood or not being able to cook and stay warm, you use firewood. When the choice is find some way to stay entertained without taking quarterly vacations on CO2 generating flights to expensive getaways or keep polluting somehow no one bats an eyelid.
      - badrabbit 7y ago
        There aren't enough rich people to compete with commercial airliner's emissions. Cruise ships are HUGE emittors(they even get around emissions control laws) for example but the western middle class is their user not the rich or poor.
        BoorishBears 7y ago
        You realize the first-world middle class taking cruises is as much a part of the rich as billionaires right? A yearly salary of something like 32k puts you in the global 1% of earners. I won't be so strict about the definition of the rich, but families having money for cruises are definitely part of the demographic I'm speaking to. And I mean, vacations is are just the tip of the iceberg, those people so poor they have to use firewood go survive, aren't the reason we have so many commercial airliners shuttling around goods so we can have the latest throwaway item we desire in 48hrs or less.

nyolfen 7y ago

> privacy for the weak, transparency for the powerful

arminiusreturns 7y ago

Here's the thing. While most people on HN tend to be in the global top performers when it comes to IT, the vast majority of businesses are simply ripe, low hanging fruit just waiting to be breached, and almost every time it is because of a failure of management to understand the importance of those things. Way too many 60 year old men who barely know how to use a computer are at the top of orgs, and are stuck in the janitorial cost sink fallacy of IT. I also put a lot of this on the heads of IT directors or senior sysadmins, who are failing to convey the importance of the matter to those C-levels in terms they understand. I have learned this the hard way, having started up an MSP at one point and done a lot of contracting to help orgs unfuck their infra, I have seen it all first hand, from 5-30 person lawfirms to fortune 500 oil companies to unicorn startups. I have been the senior sysadmin who failed to convey things in a way the got through C-level thick skulls, and most of my career trajectory has been angled towards keeping up with the sysadmin transition to devops while learning how to fill that gap so I don't repeat those mistakes. I've failed multiple times, but each one is a lesson I learn from and try to apply to the next place, and sometimes C-levels literally just don't care and can't be reached, and nothing happens till a major breach or lawsuit costs lots of money. To me, this is the importance of the CTO/CIO roles. The problem is, again, the vast majority of America isn't SV. I would say ~%80 of companies I saw didn't even have those roles, and if they had someone in that role but without the title (like IT director), they often didn't have a seat on the board or any real influence with the C's. I have also seen those roles taken by people who should be in other positions but enjoy the "C" title too much, to the detriment of the org. Sorry, this got kind of ranty, but it's an issue I obsess over in trying to find better solutions for. Basically I'm learning how to hack management instead of computers these days.

matheusmoreira 7y ago
> I also put a lot of this on the heads of IT directors or senior sysadmins, who are failing to convey the importance of the matter to those C-levels in terms they understand. Why? Understanding the risks involved before making a decision is the responsibility of executives. If they calculate that the risks are minimal and crackers prove them wrong by causing damage to the tune of millions, they have only themselves to blame. How many times have people explained the need for things to be done properly, only for proper infrastructure to be written off as too costly and unnecessary? The fact is they are taking a calculated risk: they get to spend less on information security by assuming nothing bad will happen. Claiming that it's the fault of system administrators is just yet another power move: scapegoating in order to avoid responsibility. They make the decisions and should face the consequences.