6 ms·

I've resisted discussing this but I think it's late enough after the event to chime in. First off, disclaimer: We sell HBGary's products in the UK, I know Greg

by iuguy 16y ago

I've resisted discussing this but I think it's late enough after the event to chime in. First off, disclaimer: We sell HBGary's products in the UK, I know Greg and Penny personally, as well as Jussi (who runs rootkit.com but as far as I'm aware does not work for HBGary). I'm not claiming to speak for anyone or company, just for myself on a purely personal level. After looking into this, what happened is that HBGary invested in 15% of HBGary Federal, a company set up to do work HBGary didn't want to do. Now presumably (from TFA) they were looking at selling this off. I don't know Aaron, but it sounds to me like he's a bit of a character at least (I'll leave it to others to resort to namecalling) and completely misunderstood what Anonymous are and how they work - FWIW we investigated Anonymous' years ago for some clients who'd been DDOSed and concluded that the simple solution is (to paraphrase Greg's irc comment) not to poke the wasps nest. Penny, Greg and HBGary in general are in a bit of a tough situation now because of Aaron's actions and appear to have no ability to impose anything on HBGary Federal. This should serve as a warning to others that if you're going to use the name elsewhere, you better have a way of enforcing unforseen issues that may arise. The sad thing about all of this is that Penny and Greg are really great guys, and HBGary is a good company with some insanely great technology. I'm sure they'll pull through, but I imagine there will be collateral damage for them resulting from this for some time to come.

moe 16y ago
HBGary is a good company with some insanely great technology Insane would be to trust security-related products or advice from a company that can't even secure its own mailserver.
- iuguy 16y ago
  We don't know if the security of the mailserver was at stake here. A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). The rootkit.com mail server has nothing to do with HBGary AFAIK. To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. I could understand your reference if they were a company that wrote mail server software and were compromised through their mail server, but your point is a bit of an apple to oranges comparison. The thing is, people get owned all the time. Even security companies. Heck, we get targeted attacks on us fairly routinely, and when something comes in we have (I think, and unlike most we have actually been able to test it's effectiveness) reasonably good methods for detecting bad stuff coming in and going out, but I'd never say that one day our emails won't end up spread across the Internet, and I wouldn't be so bold as to suggest that someone that has had systems compromised didn't do a proper job just because they were compromised. The attacker only needs one way in. The defender has to protect against everything. That's not a level playing field.
  - gcb 16y ago
    > To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. naive question here. Why don't they market themselves as a memory analysis or debug toolsmiths or something else, instead of security firm?
    - iuguy 16y ago
      Mainly because the DDNA looks for indicators of potentially malicious activity, but I have used one of the tools before on exploit dev for a demo.
  - stcredzero 16y ago
    A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). If their aim was the highest level of security, then such lateral movement should not have been possible.
    - iuguy 16y ago
      > If their aim was the highest level of security Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. If their source code was stolen, then yes you could say that the level of protection was inappropriate because if the source code is the highest value asset they have, it probably shouldn't be accessible from the Internet. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet.
      - 16y ago

by iuguy 16y ago

moe 16y ago

HBGary is a good company with some insanely great technology Insane would be to trust security-related products or advice from a company that can't even secure its own mailserver.

iuguy 16y ago
We don't know if the security of the mailserver was at stake here. A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). The rootkit.com mail server has nothing to do with HBGary AFAIK. To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. I could understand your reference if they were a company that wrote mail server software and were compromised through their mail server, but your point is a bit of an apple to oranges comparison. The thing is, people get owned all the time. Even security companies. Heck, we get targeted attacks on us fairly routinely, and when something comes in we have (I think, and unlike most we have actually been able to test it's effectiveness) reasonably good methods for detecting bad stuff coming in and going out, but I'd never say that one day our emails won't end up spread across the Internet, and I wouldn't be so bold as to suggest that someone that has had systems compromised didn't do a proper job just because they were compromised. The attacker only needs one way in. The defender has to protect against everything. That's not a level playing field.
- gcb 16y ago
  > To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. naive question here. Why don't they market themselves as a memory analysis or debug toolsmiths or something else, instead of security firm?
  - iuguy 16y ago
    Mainly because the DDNA looks for indicators of potentially malicious activity, but I have used one of the tools before on exploit dev for a demo.
- stcredzero 16y ago
  A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). If their aim was the highest level of security, then such lateral movement should not have been possible.
  - iuguy 16y ago
    > If their aim was the highest level of security Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. If their source code was stolen, then yes you could say that the level of protection was inappropriate because if the source code is the highest value asset they have, it probably shouldn't be accessible from the Internet. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet.
    - 16y ago