3 ms·

This demonstrates two major points that many people not familiar with security may not understand: The first is that anyone -- really, anyone -- can get hacked

This demonstrates two major points that many people not familiar with security may not understand: The first is that anyone -- really, anyone -- can get hacked. I often joke with our CIO that security would be a lot easier if he just powered down our production infrastructure. Security is a game played in layers (often called "defense in depth"), but at the end of the day, it's almost impossible to prevent a breach with any high degree of certainty. The second is that bad actors (of wildly varying skill) are very active on the Internet. The threat of hackers used to be curious teenagers trying to learn more about computer systems; it didn't take long for that to devolve into criminal activity and "hacktivism." Now, the intelligence services of major nations regularly attack public and private organizations across the Internet. It's the job of contemporary security teams to defend against any and all threats -- but many (if not all) private organizations are ill equipped to defend against a well-organized intelligence agency in an attack such as this. I didn't see any what the attack vector used against FireEye might have been, but those same attackers are now very well "armed" with FireEye's red team arsenal. It's going to be an interesting future for security teams as we learn what and whom these adversaries will attack next.

Veserv 6y ago
You missed the third major point that most people do not know which is that these attacks are not just possible, they are easy. Every single one of these articles always mentions "nation-state actors" to imply that only a nation-state with billions of dollars and thousands of people can pull off such a "sophisticated" "novel" attack. That is unequivocal garbage. I have never had a CISO (or any other high-level security executive) of a multi-billion dollar company ever answer the question: "How much would it cost to critically compromise your systems and do an unrecoverable amount of damage?" with a number higher than $1,000,000. $1,000,000 is a rounding error to these companies. $1,000,000 is a rounding error in a rounding error to a sizable nation-state. These systems are not just insecure against nation-state attackers, they are insecure against organizations with the staggering weight of 3-10 people. Or, to use a quote from the recent Project Zero blogpost on the iOS exploit said: "one person, working alone in their bedroom, was able to build a capability which would allow them to seriously compromise iPhone users they'd come into close contact with." That is a far cry from being secure against credible threats to a multi-billion dollar business by any stretch of the imagination. Are systems more secure now than they were in the past? Maybe. A targeted attack against an arbitrary target would generally take a few 10 to 100s of thousands of dollars. This is probably orders of magnitude more than the past of teenagers hacking for giggles. But, there are like 6-8 orders of magnitude between teenagers hacking for giggles and a "nation-state actor" and about 3 orders of magnitude between a random company/organization and a nation-state. The best systems deployed systems are about as close to adequate as a house is to a skyscraper.
- wglb 6y ago
  >Every single one of these articles always mentions "nation-state actors" to imply that only a nation-state with billions of dollars and thousands of people can pull off such a "sophisticated" "novel" attack. While this is true for e.g., Equifax (see https://ciexinc.com/blog/quick-assessment-of-a-companys-security-posture/ https://ciexinc.com/blog/quick-assessment-of-a-companys-secu...), if FireEye (aka Mandiant) says it, I tend to believe it to be quite true. I would expect that hacking them would be far from easy.
  - acdha 6y ago
    One of the big questions I'd have is exactly how these tools were leaked. Red team tools are by nature more exposed since they're using them with their clients, presumably on a large scale, and I would hope that there's a very large difference in the number of people who have access to those tools and the number of people who have access to their production infrastructure, code-signing, or software update mechanism.
  - Veserv 6y ago
    First, FireEye was one of the companies who worked to secure Equifax prior to the breach as mentioned by the CSO of Equifax on page 4 of this FireEye white paper from 2012 [1] that FireEye has since retracted [2][3]. Second, that is kind of a non-sequitur. I did not say that a nation-state did not pull off the attack, my gripe is that they are implying, like every other company that gets breached, that only a nation-state has the resources to pull off such an attack with their wording. These attacks are extremely cheap and easy, that is why we see governments running literally hundreds to thousands of such attacks/programs in parallel as evidenced by the CIA Vault 7 leaks. A single branch of the US government was literally developing hundreds of independent tools/programs that could successfully compromise anything they cared to target. Third, define "easy". I define easy as ~$1,000,000-$10,000,000 since almost any moderately-sized corporation, of which there are millions, could fund such an operation. To put it in perspective, $10,000,000 is only ~1% of FireEye's revenue. I define "only a nation-state" at 1,000x more at ~$1,000,000,000-~$10,000,000,000 since although it is still technically doable for a large multinational or organized crime, it is unlikely to be profitable outside of theoretical large-scale extortion attacks. Do you think a penetration test of 3 engineers working fulltime for a year would fail to materially breach FireEye's corporate systems? Almost every penetration test by a competent company takes a fraction of that effort even against well-funded security teams. And 3 engineers for one year is only 3 engineer-years which at $300k/engineer-year is ~$1,000,000, the bottom end of "easy" and 1,000x less than "only nation-states can pull it off". If engineer-years is too abstract, the Google ProjectZero case I mentioned earlier was a zero-click iOS RCE from zero starting understanding in 0.5 engineer-years. So, doing some sloppy extrapolation, is it easier to find 6 zero-click iOS RCEs or breach FireEye's corporate systems? Let's say we moved up an order of magnitude to 1% of FireEye's revenue at $10,000,000 which is the high end of "easy" and is 2 orders of magnitude less than the bottom end of "only nation-states can pull it off". That would be enough to fund 30 engineers working fulltime for a year or 10 engineers working fulltime for 3 years. Do you think FireEye could prevent a material breach? I have literally never heard of a single person in enterprise security who has ever dared to make such a remark on the record that was not instantly taken down for a fraction of that. I know of no competent engineers in that space who would support making such a statement to anybody who could and would test it. Just think if FireEye announced a $10,000,000 prize at DefCon to breach their systems by the end of the year, do you think they would even last the month? [1] http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-less-secure-than-you-think.pdf http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-le... [2] https://web.archive.org/web/20120610031926/https://www.fireeye.com/CSO_WP_LP.html https://web.archive.org/web/20120610031926/https://www.firee... [3] https://www.fireeye.com/CSO_WP_LP.html https://www.fireeye.com/CSO_WP_LP.html

Veserv 6y ago

You missed the third major point that most people do not know which is that these attacks are not just possible, they are easy. Every single one of these articles always mentions "nation-state actors" to imply that only a nation-state with billions of dollars and thousands of people can pull off such a "sophisticated" "novel" attack. That is unequivocal garbage. I have never had a CISO (or any other high-level security executive) of a multi-billion dollar company ever answer the question: "How much would it cost to critically compromise your systems and do an unrecoverable amount of damage?" with a number higher than $1,000,000. $1,000,000 is a rounding error to these companies. $1,000,000 is a rounding error in a rounding error to a sizable nation-state. These systems are not just insecure against nation-state attackers, they are insecure against organizations with the staggering weight of 3-10 people. Or, to use a quote from the recent Project Zero blogpost on the iOS exploit said: "one person, working alone in their bedroom, was able to build a capability which would allow them to seriously compromise iPhone users they'd come into close contact with." That is a far cry from being secure against credible threats to a multi-billion dollar business by any stretch of the imagination. Are systems more secure now than they were in the past? Maybe. A targeted attack against an arbitrary target would generally take a few 10 to 100s of thousands of dollars. This is probably orders of magnitude more than the past of teenagers hacking for giggles. But, there are like 6-8 orders of magnitude between teenagers hacking for giggles and a "nation-state actor" and about 3 orders of magnitude between a random company/organization and a nation-state. The best systems deployed systems are about as close to adequate as a house is to a skyscraper.

wglb 6y ago
>Every single one of these articles always mentions "nation-state actors" to imply that only a nation-state with billions of dollars and thousands of people can pull off such a "sophisticated" "novel" attack. While this is true for e.g., Equifax (see https://ciexinc.com/blog/quick-assessment-of-a-companys-security-posture/ https://ciexinc.com/blog/quick-assessment-of-a-companys-secu...), if FireEye (aka Mandiant) says it, I tend to believe it to be quite true. I would expect that hacking them would be far from easy.
- acdha 6y ago
  One of the big questions I'd have is exactly how these tools were leaked. Red team tools are by nature more exposed since they're using them with their clients, presumably on a large scale, and I would hope that there's a very large difference in the number of people who have access to those tools and the number of people who have access to their production infrastructure, code-signing, or software update mechanism.
- Veserv 6y ago
  First, FireEye was one of the companies who worked to secure Equifax prior to the breach as mentioned by the CSO of Equifax on page 4 of this FireEye white paper from 2012 [1] that FireEye has since retracted [2][3]. Second, that is kind of a non-sequitur. I did not say that a nation-state did not pull off the attack, my gripe is that they are implying, like every other company that gets breached, that only a nation-state has the resources to pull off such an attack with their wording. These attacks are extremely cheap and easy, that is why we see governments running literally hundreds to thousands of such attacks/programs in parallel as evidenced by the CIA Vault 7 leaks. A single branch of the US government was literally developing hundreds of independent tools/programs that could successfully compromise anything they cared to target. Third, define "easy". I define easy as ~$1,000,000-$10,000,000 since almost any moderately-sized corporation, of which there are millions, could fund such an operation. To put it in perspective, $10,000,000 is only ~1% of FireEye's revenue. I define "only a nation-state" at 1,000x more at ~$1,000,000,000-~$10,000,000,000 since although it is still technically doable for a large multinational or organized crime, it is unlikely to be profitable outside of theoretical large-scale extortion attacks. Do you think a penetration test of 3 engineers working fulltime for a year would fail to materially breach FireEye's corporate systems? Almost every penetration test by a competent company takes a fraction of that effort even against well-funded security teams. And 3 engineers for one year is only 3 engineer-years which at $300k/engineer-year is ~$1,000,000, the bottom end of "easy" and 1,000x less than "only nation-states can pull it off". If engineer-years is too abstract, the Google ProjectZero case I mentioned earlier was a zero-click iOS RCE from zero starting understanding in 0.5 engineer-years. So, doing some sloppy extrapolation, is it easier to find 6 zero-click iOS RCEs or breach FireEye's corporate systems? Let's say we moved up an order of magnitude to 1% of FireEye's revenue at $10,000,000 which is the high end of "easy" and is 2 orders of magnitude less than the bottom end of "only nation-states can pull it off". That would be enough to fund 30 engineers working fulltime for a year or 10 engineers working fulltime for 3 years. Do you think FireEye could prevent a material breach? I have literally never heard of a single person in enterprise security who has ever dared to make such a remark on the record that was not instantly taken down for a fraction of that. I know of no competent engineers in that space who would support making such a statement to anybody who could and would test it. Just think if FireEye announced a $10,000,000 prize at DefCon to breach their systems by the end of the year, do you think they would even last the month? [1] http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-less-secure-than-you-think.pdf http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-le... [2] https://web.archive.org/web/20120610031926/https://www.fireeye.com/CSO_WP_LP.html https://web.archive.org/web/20120610031926/https://www.firee... [3] https://www.fireeye.com/CSO_WP_LP.html https://www.fireeye.com/CSO_WP_LP.html