9 ms·

NSA Cyber Unfetter Project

110 points by boredgamer2 6y ago

dogma1138 6y ago
GitHub docs lead to http://unfetter.io/ http://unfetter.io/ which leads to a GoDaddy landing page...
bibinou 6y ago
(2018) https://github.com/unfetter-discover/unfetter/commits/master https://github.com/unfetter-discover/unfetter/commits/master
- dmix 6y ago
  Looks like there’s been no work on it since 2018 either.
  - acqq 6y ago
    There's also this: http://www.iad.gov/iad/library/ http://www.iad.gov/iad/library/ "The IAD.gov library is no longer being updated as of October 1, 2018. NSA Cybersecurity (formerly "information assurance") information from October 1, 2018 onward will be available at http://www.nsa.gov/what-we-do/cybersecurity." http://www.nsa.gov/what-we-do/cybersecurity."
mey 6y ago
https://github.com/unfetter-discover/unfetter/issues/1613 https://github.com/unfetter-discover/unfetter/issues/1613 Looks like the project may be abandoned? Time for a fork?
deleted 6y ago
[deleted]
seemslegit 6y ago
OK seriously we need to have a talk about this whole 'posture' thing.
- rblatz 6y ago
  Can you elaborate? My understanding is your security posture determines how well you mitigate, identify, contain, and repel attacks.
  - seemslegit 6y ago
    In the same way your sales posture determines how well you identify, qualify and convert leads and your product posture determines how well you design, execute and market-fit your products - yet somehow we never felt the need to add 'posture' to these. The end result is another obfuscation layer of corporate-speak on something that should be pretty concise and bullshit-free.
motohagiography 6y ago
Good of them to release this, and I have a dog in the race about getting people to think higher-level about security, but ATT&CK, STRIDE and other frameworks tend to be solipsistic, self propagating bullshit. I would also argue that quantitative security risk models serve mainly as a corporate laundering system to obfuscate risk, do not have any meaningful predictive power, and that security compliance has become a make-work field for the unskilled, whose role is to be both an easy mark and a scapegoat for reckless corporate behaviour. Hopefully it will mature to where designers and engineers themselves build in mitigations, the way some of them have with environmental and safety risks, but as a business, I think security is due for some scrutiny.
- everdrive 6y ago
  >ATT&CK, STRIDE and other frameworks tend to be solipsistic, self propagating bullshit. Not disagreeing with you, but I was was wondering if you could expand on this. In some circles, ATT&CK is seen as the gold standard. Do you believe this is misguided?
  - verandaguy 6y ago
    As someone just getting into the higher-level space of IDSes and large-scale monitoring/analysis, I'd love to hear more about that as well.
  - motohagiography 6y ago
    Sure, it's punchy, but I hope this illustrates it: The basic problem with them is that they are bottom-up models of threat scenarios that originate with artifacts of technology implementations, which conflate vulnerabilities with attacks, and use news hits as threat actors/agents to justify their importance. It's %90 an exposition vehicle for displaying how esoterically knowledgeable the practitioners are about hacker trivia and jargon, and from a business perspective, it's just kids playing in the sandbox that produce the compliance artifacts you want to get your project approved. Geeks get to geek, and project managers get their amber status risk, and when Equifax/OPM/LifeLabs happens, everyone says it wasn't foreseeable because they were "compliant." The frameworks externalize risk into models that are divorced from reality, which hides it, and that's why institutions buy into them. I'd say they're the collateralized debt obligations of engineering. Real world threat scenarios are the counter cases to your business model. It's the top down, "if the C/I/A of this thing we care about is compromised, do we survive?" People who ask questions like "how do I prevent spoofing in this tech stack?" without first asking "what if these STD test records and results end up on the dark web, and what are we doing to prevent that?" are culpable. It's when one of the key factors that makes your business viable - goes wrong. The threat actors create the likelihood via their means and opportunity (independent of patch levels), and their motive is literally driven by the consequences of an attack. Worrying about APT group x is meaningless when it is more plausible and serious that a grad student is going to publish a paper demolishing your elliptic curve implementation at a conference and get you laughed out of your industry. Vulnerabilities and attacks are random, but the risks and controls are not. Threat scenarios are what happens when a business factor fails hard. In these ways, the bottom-up focus of modern security frameworks and scoring systems serve more to enable poor quality decision making and the project and product management level anti-patterns that hide risk. That's literally their value. They let cynical people bring crap to market. The reason they do this is because security people are stuck in the cycle of thinking they still need to explain themselves and convince others they are knowledgeable, and that there is a problem they solve. Everybody already knows, and compliance people have become just marks who hold the bag of bundled risk they think isn't theirs because they explained it all with their framework.
jgelsey 6y ago
What's with all the typos on the web site? e.g. "Unfetter Discover: Analyze seucrity gaps and explore adversary tradecraft" or "Unfetter Disocover". If the goal is to foster adoption these tells scream "disorganized and unprofessional".
- dontbenebby 6y ago
  Especially when the NSA still has a lot of trust building to do.
badrabbit 6y ago
Been down this road before, much harder than it looks. MITRE techniques can be deceptive in that you think you can detect on a technique but that is true only for the specific attack scenario. Example: you can detect anomalous scheduled task creation, but is it because you are looking for specific command lines? If so, why can't attackers just use .NET ? You can detect cred dumping because procdump.exe or wce.exe is seen,but what you are not looking for process handles to lsass. It can lead to a false sense of security if you're not careful. From a threat hunting and detection perspective, I am so glad they are sharing this tool. It becomes very tedious very fast when you take things like this and apply them against the highly nuanced context of your environment.

110 points by boredgamer2 6y ago

GitHub docs lead to http://unfetter.io/ http://unfetter.io/ which leads to a GoDaddy landing page...

(2018) https://github.com/unfetter-discover/unfetter/commits/master https://github.com/unfetter-discover/unfetter/commits/master

dmix 6y ago
Looks like there’s been no work on it since 2018 either.
- acqq 6y ago
  There's also this: http://www.iad.gov/iad/library/ http://www.iad.gov/iad/library/ "The IAD.gov library is no longer being updated as of October 1, 2018. NSA Cybersecurity (formerly "information assurance") information from October 1, 2018 onward will be available at http://www.nsa.gov/what-we-do/cybersecurity." http://www.nsa.gov/what-we-do/cybersecurity."

mey 6y ago

https://github.com/unfetter-discover/unfetter/issues/1613 https://github.com/unfetter-discover/unfetter/issues/1613 Looks like the project may be abandoned? Time for a fork?

deleted 6y ago

[deleted]

seemslegit 6y ago

OK seriously we need to have a talk about this whole 'posture' thing.

rblatz 6y ago
Can you elaborate? My understanding is your security posture determines how well you mitigate, identify, contain, and repel attacks.
- seemslegit 6y ago
  In the same way your sales posture determines how well you identify, qualify and convert leads and your product posture determines how well you design, execute and market-fit your products - yet somehow we never felt the need to add 'posture' to these. The end result is another obfuscation layer of corporate-speak on something that should be pretty concise and bullshit-free.

motohagiography 6y ago

Good of them to release this, and I have a dog in the race about getting people to think higher-level about security, but ATT&CK, STRIDE and other frameworks tend to be solipsistic, self propagating bullshit. I would also argue that quantitative security risk models serve mainly as a corporate laundering system to obfuscate risk, do not have any meaningful predictive power, and that security compliance has become a make-work field for the unskilled, whose role is to be both an easy mark and a scapegoat for reckless corporate behaviour. Hopefully it will mature to where designers and engineers themselves build in mitigations, the way some of them have with environmental and safety risks, but as a business, I think security is due for some scrutiny.

everdrive 6y ago
>ATT&CK, STRIDE and other frameworks tend to be solipsistic, self propagating bullshit. Not disagreeing with you, but I was was wondering if you could expand on this. In some circles, ATT&CK is seen as the gold standard. Do you believe this is misguided?
- verandaguy 6y ago
  As someone just getting into the higher-level space of IDSes and large-scale monitoring/analysis, I'd love to hear more about that as well.
- motohagiography 6y ago
  Sure, it's punchy, but I hope this illustrates it: The basic problem with them is that they are bottom-up models of threat scenarios that originate with artifacts of technology implementations, which conflate vulnerabilities with attacks, and use news hits as threat actors/agents to justify their importance. It's %90 an exposition vehicle for displaying how esoterically knowledgeable the practitioners are about hacker trivia and jargon, and from a business perspective, it's just kids playing in the sandbox that produce the compliance artifacts you want to get your project approved. Geeks get to geek, and project managers get their amber status risk, and when Equifax/OPM/LifeLabs happens, everyone says it wasn't foreseeable because they were "compliant." The frameworks externalize risk into models that are divorced from reality, which hides it, and that's why institutions buy into them. I'd say they're the collateralized debt obligations of engineering. Real world threat scenarios are the counter cases to your business model. It's the top down, "if the C/I/A of this thing we care about is compromised, do we survive?" People who ask questions like "how do I prevent spoofing in this tech stack?" without first asking "what if these STD test records and results end up on the dark web, and what are we doing to prevent that?" are culpable. It's when one of the key factors that makes your business viable - goes wrong. The threat actors create the likelihood via their means and opportunity (independent of patch levels), and their motive is literally driven by the consequences of an attack. Worrying about APT group x is meaningless when it is more plausible and serious that a grad student is going to publish a paper demolishing your elliptic curve implementation at a conference and get you laughed out of your industry. Vulnerabilities and attacks are random, but the risks and controls are not. Threat scenarios are what happens when a business factor fails hard. In these ways, the bottom-up focus of modern security frameworks and scoring systems serve more to enable poor quality decision making and the project and product management level anti-patterns that hide risk. That's literally their value. They let cynical people bring crap to market. The reason they do this is because security people are stuck in the cycle of thinking they still need to explain themselves and convince others they are knowledgeable, and that there is a problem they solve. Everybody already knows, and compliance people have become just marks who hold the bag of bundled risk they think isn't theirs because they explained it all with their framework.

jgelsey 6y ago

What's with all the typos on the web site? e.g. "Unfetter Discover: Analyze seucrity gaps and explore adversary tradecraft" or "Unfetter Disocover". If the goal is to foster adoption these tells scream "disorganized and unprofessional".

dontbenebby 6y ago
Especially when the NSA still has a lot of trust building to do.

badrabbit 6y ago

Been down this road before, much harder than it looks. MITRE techniques can be deceptive in that you think you can detect on a technique but that is true only for the specific attack scenario. Example: you can detect anomalous scheduled task creation, but is it because you are looking for specific command lines? If so, why can't attackers just use .NET ? You can detect cred dumping because procdump.exe or wce.exe is seen,but what you are not looking for process handles to lsass. It can lead to a false sense of security if you're not careful. From a threat hunting and detection perspective, I am so glad they are sharing this tool. It becomes very tedious very fast when you take things like this and apply them against the highly nuanced context of your environment.