9 ms·
Maersk, Me and NotPetya
- unixhero 6y agoGreat article and good bottom line advice.
- secfirstmd 6y agoVery impressive write-up.
- betaby 6y agoNot sure if advises are actionable. Especially in the light that decisions ultimately are made by 'tops' and consulting companies.
- fock 6y agowell the PAW is nothing than admins at least putting their browsing into a VM (which costs round about 0€...). And seriously I never thought that doing else was a thing. But hey, apparently I am too far removed from sysadmins...
- detaro 6y agoBy that logic, nothing is actionable because someone else might prevent it happening. It being derived from the Maersk incident is probably among the better arguments for pushing it against that sort of resistance, since that is something business higher-ups have have heard of and are scared by.
- rafaelm 6y agoI can fully recommend reading the book "Sandworm" by Andy Greenberg. It explains NotPetya and all of the sorrounding investigation.
- retortio 6y agoIn the same genre, I recommend "Countdown to Zero Day" which looks at Stuxnet and Flame and the events surrounding their creation, deployment and aftermath.
- secfirstmd 6y agoI'm a big fan of Countdown to Zero Day. I've recommended it to a lot of non-techie friends as it's a great blend of pacey thriller with just enough information to help a non-techie understand some basic elements of a sophisticated malware campaign.
- bitexploder 6y agoJust an aside, I have met Kim a few times at various conferences. She is an interesting person, in a good way. She came to the book as an infosec neophyte. We talked about her process as something of a technologist outsider and how she decided what to focus on. Ultimately, she decided the storytelling was far more important than the technical details, though she felt those were incredibly important as well.
- armSixtyFour 6y agoFantastic book! I only wish there were more in depth books like this. I've read Countdown to zero day as well almost immediately afterwards and was similarly engaged.
- trollied 6y agoThere's also a really good Darknet Diaries podcast episode on NotPetya: https://darknetdiaries.com/episode/54/ https://darknetdiaries.com/episode/54/ It's a brilliant podcast - there's some very interesting stories and interviews, my favourite recent one being The Courthouse: https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/
- eggsome 6y agoDarknet Diaries is moderately engaging - but overly dramatic. They also dumb things down a bit (I assume to attract a wider audience?). I still find myself listening occasionally, so it's hard to criticize too much.
- HenryBemis 6y agoIn a geographical note, if you can get a chance to work/contract in Denmark, absolutely do so! I have been working in Copenhagen in 2014-2015 and I only have great memories of the country and the capital.
- x86_64Ubuntu 6y agoWhat about the language? I've heard that the best way to learn Danish is to be born to Danish parents.
- bmn__ 6y agoKamelåså https://youtu.be/ykj3Kpm3O0g https://youtu.be/ykj3Kpm3O0g
- terom 6y agoAs someone with very limited Microsoft/Windows background, I would be curious to somehow better understand how these lessons would apply to the Linux world. What are the Linux equivalents of pass-the-hash, TAM/PAM/PAWs etc?
- tialaramex 6y agoI'm guessing you know what a password hash is and roughly how password hashing works? Microsoft's systems don't like to send your plaintext password over the network. Rather than either get rid of passwords or at least secure that so it isn't a problem any more, they do the hashing on your machine and send the hash to wherever it needs to be authenticated. This behaviour enables Pass-the-hash. Since we can authenticate with the hash, not the password, we don't even need to know the password. If we break into one system that knows the password hash for JimSmith in order to authenticate JimSmith then we can tell other systems we're JimSmith and present that password hash and they'll accept it. So malware that gets enough rights on a machine with a bunch of people's password hashes effectively gets the ability to log in as them on other machines, on which maybe it can ascend to equivalent rights and get more hashes, which it can use again, recursively. Pass-the-hash isn't a thing on Linux itself, it's a consequence of crypto-illiterate design in Windows. Arguably that design pre-dates modern Windows, ie it isn't the fault of the people who built versions of Windows you use today. On the other hand though rather than just outlaw this behaviour entirely they've chosen to try to mitigate the worst effects and whose fault is that?
- zaat 6y ago> On the other hand though rather than just outlaw this behaviour entirely they've chosen to try to mitigate the worst effects and whose fault is that? That's the fault of reality. Disable this today and big chunks of the world will just stop working. That's why they try to push to disable their stupid design mistakes of the past instead of just disabling them cold turkey. Testing whether disabling a weak auth option won't hurt anything significant within your typical medium to large organization with 20 to 30 years of IT history is a timely operation and major pain. Any mistake can be extremely costly - think about few hundred expensive employees, doctors, heavy equipment operators, whatever - sitting without their working tools for hours or days because of a stupid security checkbox.
- Iwillgetby 6y agodevops should be done from 2 systems. Dev (local administrator access ok, production access not ok) Ops (local admin access not ok, production access ok)
- threentaway 6y agoNobody should directly have access to production, it should be controlled via CD flows which are gated on approvals from other team members or metrics.
- Iwillgetby 6y agoI am with you on this.
- mrweasel 6y agoI can see that being somewhat impractical in real life, but you’re not wrong. In the ideal setup NotPetya would have been less of an issue for Mærsk should only have allowed whitelisted software to run on computers controlling critical infrastructure. It’s just a solution very few choose to deploy.
- brazzy 6y agoHow would that have helped? The finance software that started the breach was legitimately needed and would have been whitelisted.
- deleted 6y ago[deleted]
- mrweasel 6y agoOne of two things: Either the malware modifies the finance software, and is executed as part of the finance software, but the checksum for the software is now different and can't run. Or: The executable malware code is separate and only triggered by the finance software, which will fail to execute it, because the malware isn't a whitelisted application. At any rate, the malware would never be able to escape beyond the finance software computers. This means that yes you could have some issues with invoicing, new orders and so on, but you most likely didn't have to shutdown ports, because the computers there aren't allowed to run the finance software.
- zaat 6y agoAll and all very interesting, however, some of strongly stated opinions in the article lack justifications and that's pity. I don't mean that the author is wrong, just that he is stating his opinions strongly as facts, for an instance regarding ADFS vs SSO with Hash Sync, the statement that the latter is much better is stated as an obvious fact, without much of explanation of justification. Since not everyone would agree, for instance some security teams I have the pleasure of working with/against, more facts and reasons and less assertions could have done better.
- Veserv 6y agoWhy would any of the proposals provide any meaningful protection against this threat model? Maersk claims NotPetya cost them $250M to $300M [1]. Assuming a criminal organization could demonstrate to Maersk that they could do an attack with similar effects they should be able to extort Maersk for a similar amount of money. If we discount due to unknown information, ROI, etc. I think it is reasonable to say that an extortion demand for $100M, assuming a credible demonstration that the criminal organization could pull off such an attack, would be an economically sound demand and likely to be paid. A criminal organization, considering their own ROI, would probably be willing to invest $30M for a $100M return. For $30M an organization could hire 30 full-time security specialists for 3 years at SV wages to identify an attack with similar effects. Does anybody here think that their new system could resist such an attack even assuming they adopted all recommendations proposed? Does anybody here think that there is any deployed system in the world that could resist such an attack? Does anybody here think that even adopting and correctly practicing all practically deployed recommendations of the security industry that a system could resist such an attack? All of my research points to no on all of those fronts. And, assuming the answer is no, then adopting all of the recommendations provides no meaningful protection to Maersk or any other company in a similar position since it would still be extremely profitable to attack them. Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack. If the answer to any of those is yes, could you provide an example and evidence that supports that claim? I would sorely like to find a credible deployed case. [1] https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...
- brazzy 6y agoThis is ridiculous. You're basically saying that having any security at all is pointless because someone will always still be able to break into your system in some way. Nothing could be further from the truth. Only ignorant amateurs believe that security is an all-or-nothing game. By making your system more difficult to break into, you: * increase the effort and thus cost for the attacker, thereby reducing the number of opponents that can successfully attack you * reduce the damage they can do before the attack is discovered and stopped * make yourself a less attractive target compared to others > Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack. That is simply not an option. You'd increase operating costs far more than the damage caused by this attack, and at the same time lose capabilities that customers have come to expect. Most of the cost of this attack came from having to operate without connected systems.
- virgulino 6y agoRelated talk at Black Hat 2019: "Implementing the Lessons Learned From a Major Cyber Attack", by the Chief Information Security Officer of Maersk: https://www.youtube.com/watch?v=wQ8HIjkEe9o https://www.youtube.com/watch?v=wQ8HIjkEe9o
- hyperman1 6y agoIts an interesting article, and I agree with a lot of it, but I never manage to run windows desktop without local admin. Some examples: Thanks to corona, tons of people started using usb headphones. The bloody thing needs local admin for almost weekly firmware updates. No idea why, but if you dont do them, a windows update for the driver will break them soon. VPN! If you dare to log on with alternate credentials, it ends your connection. Hence any admin on a remote machine can only happen by a local admin. Banking software pushes an update and immediately refuses to do any payment until you upgrade. The (nice) people who should package that upgrade are swamped and need months, at least if you manage to get a budget to let them package it. After that, an infosec review might take more weeks. Printer drivers. No admin? No printing! Bonus points if vendor decides to publish the driver in the app store, which is blocked by group policy for everyone including admins. ctr alt del needs local admin to kill a task. As a bonus, infosec is the biggest hurdle: If they take weeks to approve any kind of admin access,and keep asling bureaucratic questions, only big problems that burn for weeks are worth solving. We have expensive software being unused because no one wants to do the battle to get access to fix it. I would love to drop some privileges, if only I trust I could claim them back when shit hits the fan.