5 ms·

We don't know if the security of the mailserver was at stake here. A web app was compromised through SQL injection, then lateral movement was used to get to the

by iuguy 16y ago

We don't know if the security of the mailserver was at stake here. A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). The rootkit.com mail server has nothing to do with HBGary AFAIK. To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. I could understand your reference if they were a company that wrote mail server software and were compromised through their mail server, but your point is a bit of an apple to oranges comparison. The thing is, people get owned all the time. Even security companies. Heck, we get targeted attacks on us fairly routinely, and when something comes in we have (I think, and unlike most we have actually been able to test it's effectiveness) reasonably good methods for detecting bad stuff coming in and going out, but I'd never say that one day our emails won't end up spread across the Internet, and I wouldn't be so bold as to suggest that someone that has had systems compromised didn't do a proper job just because they were compromised. The attacker only needs one way in. The defender has to protect against everything. That's not a level playing field.

gcb 16y ago
> To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. naive question here. Why don't they market themselves as a memory analysis or debug toolsmiths or something else, instead of security firm?
- iuguy 16y ago
  Mainly because the DDNA looks for indicators of potentially malicious activity, but I have used one of the tools before on exploit dev for a demo.
stcredzero 16y ago
A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). If their aim was the highest level of security, then such lateral movement should not have been possible.
- iuguy 16y ago
  > If their aim was the highest level of security Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. If their source code was stolen, then yes you could say that the level of protection was inappropriate because if the source code is the highest value asset they have, it probably shouldn't be accessible from the Internet. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet.
  - stcredzero 16y ago
    Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Putting words in my mouth. No one said anything about perfect security. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. And they did not do this. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. What you're saying is that they saved what was likely a small amount of money in exchange for a large amount of security. (All of the corporate emails.) I wouldn't want security work from a company as short sighted as that. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet. I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised.
    - 16y ago

by iuguy 16y ago

gcb 16y ago

> To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus. naive question here. Why don't they market themselves as a memory analysis or debug toolsmiths or something else, instead of security firm?

iuguy 16y ago
Mainly because the DDNA looks for indicators of potentially malicious activity, but I have used one of the tools before on exploit dev for a demo.

stcredzero 16y ago

A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box). If their aim was the highest level of security, then such lateral movement should not have been possible.

iuguy 16y ago
> If their aim was the highest level of security Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. If their source code was stolen, then yes you could say that the level of protection was inappropriate because if the source code is the highest value asset they have, it probably shouldn't be accessible from the Internet. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet.
- stcredzero 16y ago
  Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Putting words in my mouth. No one said anything about perfect security. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. And they did not do this. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. What you're saying is that they saved what was likely a small amount of money in exchange for a large amount of security. (All of the corporate emails.) I wouldn't want security work from a company as short sighted as that. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet. I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised.
  - 16y ago