3 ms·

Sure, any public facing system is theoretically vulnerable given infinite monkeys. What I don't understand is why this data wasn't airgapped. I've spoken with e

by hnzix 6y ago

Sure, any public facing system is theoretically vulnerable given infinite monkeys. What I don't understand is why this data wasn't airgapped. I've spoken with enough colleagues in defence to know that plenty of facilities do this as standard, even for tooling source code, let alone a trove of juicy intel data. And FTA "Segmenting one’s network", even my shoddy underfunded local health dept has implemented that one. The CIA didn't even do the basics here.

beejiu 6y ago
It wasn't public facing, it was taken from an internal network it seems. https://www.businessinsider.com/cia-vault-7-leak-woefully-lax-security-protocol-report-2020-6?r=US&IR=T https://www.businessinsider.com/cia-vault-7-leak-woefully-la...
Veserv 6y ago
That is missing the point. It is not that infinite monkeys could break in, it is that the NECESSARY level of security can not be met even assuming the best known practical system. Therefore, they MUST NOT use/create such a system since they can not achieve the MINIMUM requirement. There is no point in improving systems from ridiculously inadequate to very inadequate since the system still does not work and you MUST NOT use systems that DO NOT WORK in critical capacities. Like, imagine a world where the Army made tanks out of tissue paper. You could say, "Look at these clowns. Don't they know regular paper provides better defense than tissue paper.". While true, it does not really matter since if the best armor available is paper, every strategy should probably avoid depending on tanks. My point is about looking at OBJECTIVE requirements and evaluating solutions against them. At a basic level this boils down to two questions: 1. What is the NECESSARY level of security? 2. Can anybody achieve the NECESSARY level of security? If the answer to 2 is no, then the system MUST NOT be used/created.
- ForHackernews 6y ago
  I mean, you can still be a hard target or a soft target. I guess this doesn't apply to unique assets like the CIA, but for your regular old e-commerce firm, you can have defences that wouldn't stand up to a sustained, targeted attack by state actors, but still make regular hackers go steal somebody else's DB of customer details.
  - Veserv 6y ago
    Soft/Hard only considers one side of the equation, the level of security provided. It ignores the other side which is what is needed or expected. Without doing that you can not tell if you are dealing with soft/hard or tissue/paper. A more meaningful distinction is profitable/unprofitable and, if you really must rely on other people being tastier fish in the barrel, ROI. For example, if company A costs $10K to hit for a return of $100K, but company B costs $100K to hit for a return of $100M, the only reason someone would hit A knowing this information is if they did not have enough capital to hit B. I agree that not everybody needs to be able to withstand an attack by state actors. It is up to the involved and affected parties to choose the level of security needed. However, the highest level of actual security I have heard from people is ~$1M and I would be hard pressed to find any appreciable system in a moderately-sized business where the negative consequences would be as low as ~$1M. Frankly, $1M is chump change in the commercial world. If that is all it takes to compromise nearly any system or organization in the world, then a sizable fraction of the people reading this comment and around 46,800,000 people worldwide have the personal resources to compromise any system in the world. That is terrifying.
    - ForHackernews 6y ago
      Are you sure there are negative consequences of ~$1M? You're talking a lot about profitable/unprofitable, but you haven't linked to any sources that back up your numbers. Maybe the marketplace just doesn't value security? Customers seem happy to give away all their data to Google/Facebook for free. Equifax got completely and thoroughly owned but it hasn't seemed to cost them anything. Zoom is a security nightmare but keeps getting more popular. Companies aren't going to value security until the lack of it starts to sting their stock price.

by hnzix 6y ago

beejiu 6y ago

It wasn't public facing, it was taken from an internal network it seems. https://www.businessinsider.com/cia-vault-7-leak-woefully-lax-security-protocol-report-2020-6?r=US&IR=T https://www.businessinsider.com/cia-vault-7-leak-woefully-la...

Veserv 6y ago

That is missing the point. It is not that infinite monkeys could break in, it is that the NECESSARY level of security can not be met even assuming the best known practical system. Therefore, they MUST NOT use/create such a system since they can not achieve the MINIMUM requirement. There is no point in improving systems from ridiculously inadequate to very inadequate since the system still does not work and you MUST NOT use systems that DO NOT WORK in critical capacities. Like, imagine a world where the Army made tanks out of tissue paper. You could say, "Look at these clowns. Don't they know regular paper provides better defense than tissue paper.". While true, it does not really matter since if the best armor available is paper, every strategy should probably avoid depending on tanks. My point is about looking at OBJECTIVE requirements and evaluating solutions against them. At a basic level this boils down to two questions: 1. What is the NECESSARY level of security? 2. Can anybody achieve the NECESSARY level of security? If the answer to 2 is no, then the system MUST NOT be used/created.

ForHackernews 6y ago
I mean, you can still be a hard target or a soft target. I guess this doesn't apply to unique assets like the CIA, but for your regular old e-commerce firm, you can have defences that wouldn't stand up to a sustained, targeted attack by state actors, but still make regular hackers go steal somebody else's DB of customer details.
- Veserv 6y ago
  Soft/Hard only considers one side of the equation, the level of security provided. It ignores the other side which is what is needed or expected. Without doing that you can not tell if you are dealing with soft/hard or tissue/paper. A more meaningful distinction is profitable/unprofitable and, if you really must rely on other people being tastier fish in the barrel, ROI. For example, if company A costs $10K to hit for a return of $100K, but company B costs $100K to hit for a return of $100M, the only reason someone would hit A knowing this information is if they did not have enough capital to hit B. I agree that not everybody needs to be able to withstand an attack by state actors. It is up to the involved and affected parties to choose the level of security needed. However, the highest level of actual security I have heard from people is ~$1M and I would be hard pressed to find any appreciable system in a moderately-sized business where the negative consequences would be as low as ~$1M. Frankly, $1M is chump change in the commercial world. If that is all it takes to compromise nearly any system or organization in the world, then a sizable fraction of the people reading this comment and around 46,800,000 people worldwide have the personal resources to compromise any system in the world. That is terrifying.
  - ForHackernews 6y ago
    Are you sure there are negative consequences of ~$1M? You're talking a lot about profitable/unprofitable, but you haven't linked to any sources that back up your numbers. Maybe the marketplace just doesn't value security? Customers seem happy to give away all their data to Google/Facebook for free. Equifax got completely and thoroughly owned but it hasn't seemed to cost them anything. Zoom is a security nightmare but keeps getting more popular. Companies aren't going to value security until the lack of it starts to sting their stock price.