26 ms·
U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise
- swalsh 6y agoSo, am I reading this right? the Russian government had the ability to impersonate the credentials of ANYONE in the marjoity of the fortune 500, the US Government, the US DOD, and our telecomm infrastructure... and they likely had this access for a while. How is this NOT an act of war?
- wavefunction 6y agoRussia has a policy where they allow "patriotic hackers" to operate freely while turning a blind eye to their actions. The Kremlin even mentioned this in their disavowal.
- dragonwriter 6y agoWhile I disagree with the claim that merely having the capacity is an act of war, doing something that would be an act of war through privateers rather than official state forces doesn’t make it any less an act of war than it otherwise would be.
- dragonwriter 6y agoHaving the capacity isn’t an act of war, in the same way that having the much more significant capacity to obliterate major population centers isn’t. How the capacity is applied may be another story.
- deleted 6y ago[deleted]
- anaganisk 6y agoAnd how many such tools have been employed by CIA? So are all the other countries supposed to wage war against US? Govt's all over the world do shady shit, constantly. Sometimes they get caught, sometimes they dont. Men in power use tensions to stay in power, waging wars against more powerful/equal, wont help men in power neither of the sides.
- tessierashpool 6y agoThe entire Trump administration's been an act of war. They got classified intel, private phone calls with the president, numerous concessions, everything they could have possibly wanted in terms of foreign policy, including an abrupt and chaotic withdrawal from Syria where Russian troops literally took over American bases, and a significant number of GOP congressional representatives visiting Moscow on July 4th together, with no American press there to cover the event or tell us who they met with, what they discussed, or why they went. There's also evidence that Russia infiltrated the Treasury in 2015, unrelated to the election interference afterwards. It's been war for a long time, and we have not been winning.
- robertlagrant 6y agoOn the plus side, no actual wars were started or joined. Like Jimmy Carter.
- justaman 6y agoIt is an act of war. Be suspect of anyone downplaying.
- jessaustin 6y agoThat's what all the SolarWinds people are saying!
- justaman 6y agoI suspect I'm being downvoted by foreign agents.
- jessaustin 6y agoWe can't rule out that possibility, but I also downvoted that comment. HN needs less paranoia. [EDIT:] although, with the more recent comment you have approached tantalizingly close to possible irony. So, I upvoted that.
- rossdavidh 6y agoWell, that is very similar to asking how it is that conventional spying is not an act of war. It isn't, because everyone is going to be doing it anyway, so if you make that an act of war we have war all the time, rather than nations not doing it.
- 8note 6y agoThe US executive branch is favourable to Russian interference. They're invited
- ars 6y ago> How is this NOT an act of war? Because spying is not an act of war. If it was, the entire world would be at war with the entire world.
- aaomidi 6y agoLmao act of war. You going to fight? This is just what countries do to eachother. Welcome to the 21st century.
- jimbokun 6y agoSo it's an act of war. Now what? Does the US escalate to a shooting war with the second biggest nuclear power in the world? So it's not surprising Russia thinks they can act with a lot of impunity without facing catastrophic consequences.
- swalsh 6y agoWe can try sanctions, but we've pretty much maxed out that route after the Crimea annexation. If we do nothing, we're sending the message that these actions are okay.
- nemothekid 6y ago>If we do nothing, we're sending the message that these actions are okay. I think it sends the message that these actions won’t trigger nuclear war. How would you even get public support for war with Russia?
- deleted 6y ago[deleted]
- jessaustin 6y agoMaybe we should "send the message" that we won't install insecure shit on our networks?
- tfehring 6y agoWe aren’t even close to maxing out what could be accomplished with economic sanctions! The US and Russia still have a direct trading relationship!
- UnpossibleJim 6y agoAs I'm forced to speculate, because it is inconvenient for us to call it an act of war. We routinely conduct cyber espionage missions on other countries and "probe" their cyber defenses. If we were to call this an all out act of war, then we would also be found guilty of unprovoked acts of war on many other countries, including allied countries. So, too, would many other countries. This is the new spywork.
- citilife 6y ago> the Russian government You sure about that? "They" have been claiming Russia is the boogie man for years, but it's never been proven. In this case, it does appear like a complex hack. Wouldn't be surprised if it's China, Iran, North Korea, Russia, U.S. Government (yes, hacking itself), etc.
- mrlala 6y agoWho is "they"? And what hasn't been proven, are you referring to Russian interference in 2016?
- nromiun 6y agoAm I missing something? Why is everyone so sure that it is Russia? Are they the only ones with access to computers beside US?
- mistermann 6y agoPsychological conditioning is my theory. If you think about it, has this not been a rather popular news item for many years? If people should not get their perception of world affairs from the news, then from where should they get it?
- DethNinja 6y agoBecause it definitely couldn’t be China or any other country.
- lionkor 6y agoCouldn't be china, they can't access the outside world ;)
- Consultant32452 6y agoBecause Russia has somewhat of an oil monopoly in Europe and the US doesn't like that. We've been being fed Russia war propaganda for at least a decade. If it even feels like a "Russia kind of thing" to the general public that is just the result of intentional conditioning by warmongers. It could have been literally any major world power, including our allies. No evidence has been presented whatsoever as to who the culprit is.
- jessaustin 6y agoHell, it could be a different part of the USA government, like those "sonic embassy attacks" were.
- dillondoyle 6y agoWhat? are you implying that the US government perpetrated attacks on US gov personnel? the amount of insane unfounded crap posted in HN comments is growing and i'm not sure if there is a fix. BTW recent articles say it's microwaves
- georgiecasey 6y ago> How is this NOT an act of war? So you want bombing to start over this? I don't.
- abvdasker 6y agoAnyone calling for war between the the largest nuclear power and second-largest nuclear power is insane or ignorant. To even suggest something like that is obscene given the incomprehensible loss of life it would entail. I think most people who can remember it would agree that it's a good thing the Cold War stayed cold.
- beamatronic 6y agoAre you personally willing to go to war? Are you willing to be a foot soldier? Do you wish to kill? Do you wish to be killed?
- skinkestek 6y agoI do not want to go to war over this, and generally I have friends from a number of countries in the east but make no mistake: if my country asks me to defend its borders or even NATO borders I'll be there[1], even if it is many years since I finished draft and I know have a family. The alternative will probably be worse. Anyways, no sane, decent person should wish a war. [1]: I am a whole lot less interested in defending us around the middle East and in Afghanistan though.
- sorokod 6y agoIf you had an experince of an actual war, you would NOT have asked this question.
- pvg 6y agoHow is this NOT an act of war? Very simply because it's not an act anyone would initiate armed conflict over.
- SpaceRaccoon 6y agoDid you also consider this[0] an act of war? [0] (U.S. Escalates Online Attacks on Russia’s Power Grid) [ https://www.nytimes.com/2019/06/15/us/politics/trump-cyber-russia-grid.html https://www.nytimes.com/2019/06/15/us/politics/trump-cyber-r... ]
- bosswipe 6y agoThat was retaliatory. We're already in a war.
- kerng 6y agoTense is wrong, they have this ability RIGHT NOW to a very high degree of certainty. Just because the tip of the iceberg has been discovered doesn't mean its mitigated. Even Fireeye is probably still compromised. It will take a while to understand the actual scope of this. And in the meantime new attacks are likely happening also.
- jessaustin 6y agoHopefully they'll find out some horrible things that our public servan^Wmasters are doing, and leak it to Wikileaks... where have I heard that before?
- Consultant32452 6y agoWe (the public) have not been provided evidence that this was Russia. Let's not get ahead of ourselves. Some anonymous people claimed it's Russia. That is meaningless.
- bduerst 6y agoIt's from sources vetted by Reuters. Their public-facing anonymity was required for coming forward. https://www.reuters.com/article/uk-usa-cyber-treasury-exclusive/suspected-russian-hackers-spied-on-u-s-treasury-emails-sources-idUKKBN28N0PI https://www.reuters.com/article/uk-usa-cyber-treasury-exclus...
- Consultant32452 6y agoRight, so anonymous sources who provided no evidence to the public. It's meaningless.
- bduerst 6y agoThe sources are not anonymous to Reuters and they were authoritative enough in the matter to publish. It is not meaningless.
- Consultant32452 6y agoDo you remember when a named source, Colin Powell, showed some photoshops of "weapons lab trucks" to the UN leading to us going to war in multiple countries resulting in millions of dead people? That was a named person with claimed evidence. This is even less credible than Powell. It's hard to get less credible than unnamed sources with no evidence.
- syshum 6y agoThis may have been a valid assertion in a time where news media could be trusted I, and many others, no longer have any faith or trust in the news media. Time and time again the news media has been caught spreading lies and disinformation so sorry I am no longer going to "take their word" for it, and trust they have properly vetted their sources Also They do not lead themselves to credibility by having a Matrix style photo with "hooded hacker" trope prominent in the article
- bluedino 6y agoIf it were Iran, Turkey, etc the missiles would already be in the air
- randmeerkat 6y agoIf the U.S. didn’t go to war over Crimea why would they go to war over this?
- xtracto 6y agoBecause Crimea is another country/outside of usa jurisdiction? Whereas this is a direct attack to USA institutions/government.
- randmeerkat 6y agoThis isn’t an attack _yet_. This is potentially a part of the process of developing the capabilities for a later attack. Crimea is the first time a nation state has meaningfully changed its borders that I know of since WW2. As a result I would consider Crimea a much more egregious attack on American values and western interests than a software vulnerability that hasn’t been leveraged to cause actual harm.
- kens 6y ago> Crimea is the first time a nation state has meaningfully changed its borders that I know of since WW2. I took a look out of curiosity, and there have been a lot more border changes in the world than I was expecting. Lots due to decolonization in Africa. The partition of India in 1947 was huge. Lots of European changes, of course. Many small border cleanups. The changes go on for page. See https://en.wikipedia.org/wiki/List_of_national_border_changes_since_World_War_I https://en.wikipedia.org/wiki/List_of_national_border_change... (That page is since WWI, so skip to 1945.)
- yibg 6y agoEveryone country does this to every other country that they can. Not like the US doesn't (or at least try to) pull off stuff like this too. So if it's an act of war then every major power has pretty much at some point declared war on every other major power, even allies.
- Nginx487 6y agoIt is. Hope, after new administration takes office, "hell sanctions" package would be approved, as well as closing Russian embassies and increasing military pressure to its borders. Sanctions already work, and Russian regime does not enjoy a variety of options to oppose it.
- COGlory 6y agoIf it wasn't Russia (and the evidence supporting that it was hasn't been released yet) it would be literally anyone else. North Korea. Iran. Even our allies. Some 400lb dude sitting in his parents basement in New Jersey. And the US is doing this, or attempting to do this, to many other countries. Ultimately, the hack is the practical responsibility of the victim. Don't fall for the Kissinger style war mongering.
- LinuxBender 6y agoDigital war? Sure. We are probably hitting back right now. Traditional war? I hope not. 1) I don't have enough bottle caps saved up. and 2) in all seriousness, most humans would not survive WW3, not even those with bunkers.
- adrr 6y agoBecause hacking isn’t considered an act of war. If they turned off our infrastructure that is an act of war because it would have caused material harm.
- j0ba 6y agoDon't worry, you'll get your war.
- leggomuhgreggo 6y agoAccording to Charles Carmakal, senior vice president and chief technical officer at Mandiant, FireEye’s incident response arm “There will unfortunately be more victims that have to come forward in the coming weeks and months,” he said. While some have attributed the attack to a state-sponsored Russian group known as APT 29, or Cozy Bear, FireEye had not yet seen sufficient evidence to name the actor, he said. A Kremlin official denied that Russia had any involvement. https://www.bloomberg.com/news/articles/2020-12-15/fireeye-stumbled-across-solarwinds-breach-while-probing-own-hack https://www.bloomberg.com/news/articles/2020-12-15/fireeye-s...
- Fjolsvith 6y agoEven potentially affected our election infrastructure: https://www.trendsmap.com/twitter/tweet/1338708743782092800 https://www.trendsmap.com/twitter/tweet/1338708743782092800 Edit: Had a thought - Since the NetFlow Traffic Analyzer tool stores historical network traffic data, I wonder if Dominion traffic was pulled before the breach was closed.
- Fjolsvith 6y agoSignificant after Chris Krebs testified to Congress that Dominion machines were connected to the internet.
- mxskelly 6y agoWhen will people realize that slapping yet another startup's tech stack onto yours isn't going to magically fix anything and in fact just adds complexity and points of failure. I've always done my best to err on the side of "let's try not to add yet another level of complexity" and this strategy has yet to fail me.
- hobs 6y agoSolarWinds isn't another startup, its been around for over 20 years, I have used their software half a decade ago and it did the job just fine. Age doesn't imply its good either, but blaming startups isn't the problem here.
- onetimemanytime 6y ago>>I have used their software half a decade ago and it did the job just fine. Russia agrees.
- falcolas 6y agoWhen the financial costs of exposing yourself to such risks outweigh the time saved. So, never. At least, not in our current software development industry.
- nrmitchi 6y agoSolarWinds is a 21-year-old publicly-traded company. They're not really "yet another startup". I also don't think that the departments of the US Government are all going around all willy-nilly dropping tools from "yet another startup" into their core infrastructure. While your overall point may be valid, it's tough to come to the conclusion that it is applicable here.
- mcguire 6y agoWilly-nilly dropping tools into core infrastructure is largely how government IT works. Corporate IT, too, from what I've seen.
- hackinthebochs 6y agoThe widespread use of unvalidated automatic updates will go down as one of the biggest security blunders of the last decade.
- mdoms 6y agoOn balance, I don't think so.
- rossdavidh 6y agoThat's a pretty high bar, given the security blunders of the last decade.
- deleted 6y ago[deleted]
- tootie 6y agoThere was a fun one a few years ago when someone realized that Maven Central didn't require https so anyone could MITM arbitrary amounts of open source Java code. But I think this problem could be even more pervasive. Think about that giant green lock icon you see on secured sites. And then think about all the apps and devices making requests with no UI and we have no idea what they're all talking to until you have the patience and knowhow to operate wireshark. Off the top of my head, the only real solution is to feed a lot of this arbitrary traffic through trusted brokers which is going to make us even more dependent on Google, Microsoft or whoever else takes up that mantle.
- bink 6y agoUnvalidated by whom? From the info that has been released these updates were properly signed.
- hackinthebochs 6y agoI meant validate the code changes, either by the party that owns the system the software is being installed on, or some neutral third party.
- Havoc 6y agoOuch. Via a security provider. Thats ugly no matter how you look at it
- deleted 6y ago[deleted]
- thesimon 6y agoAdding snake oil usually adds more attack vectors rather than removing them. Look at all the "endpoint protection" and AV exploits surfacing almost every week.
- outworlder 6y agoYes. Security vendors have to add a bunch of snake oil products. If they just did "consulting" and trained the staff against social security attacks, and improved a company's policies, how could managers that authorized the expense justify it? Where's the shiny "product" that "keep us safe"?"Do you mean we have to periodically expend money to keep ourselves safe? I'll go with Vendor B, they have a blockchain-based Machine Learning tool that's going to safeguard us against current and future threats!"
- zentiggr 6y agoThanks now my skin's crawling again from the all too familiar cesspool feeling. Salesmen (external or even worse internal) convincing inexperienced CTOs or VPs that they need <this exact software> regardless of any real world factors... These are the people I would throw out with their own bathwater.
- random5634 6y agoA couple of quick notes: 1) The OPM hack and now this all illustrate - if govt gives itself the big backdoors into everything, it's likely they will give it to russia, criminals, ex-boyfriends stalking ex-girlfriends etc. 2) My own impression of govt IT is largely security theatre in the area I was involved. In particular such massive complexity that agency staff think going around the rules is normal, because it's the only way to actually get work done. And then such glaring weaknesses that no one cares to fix. With google I've had one password for 20 years (my google account) which allows a hardware key for 2FA or google authenticator with what I imagine is sensible monitoring, new device authentication etc (I find this pretty secure). Govt you are forced to write down these insanely long passwords with super complexity that cannot be cut and pasted that change very 30 or 60 days. Because lost passwords are so common in these settings, the password reset process is usually a MASSIVE weakspot. I've seen it just be a phone call to a third party, you give them your username, they give you a new temp password - that's literally it. And the passwords end up everywhere. In lots of documents that float around, emailed around etc etc. And lots of password sharing when you get locked out of a tool and it will take a long time to get a new account setup (months). Pretty soon the procedures manual also gets you root access to everything.
- Jtsummers 6y agoThe insistence on the stupidly long passwords and 30-60 day expiration times created so many weaknesses. People choose obvious patterns for their passwords to get around it. Like `1q2w3e4r!Q@W#E$R`. Then they shift by one each time they have to update, by the time they get across the keyboard they can restart (or twice, in which case you swap the shift to the first half instead of second half). Or, this was fun, my first gov't job the guy had stored passwords on a sticky underneath the keyboard (I changed them all). They also used a shared account for admin stuffs, even though we were all given an admin token (like the smart card or CAC for regular login, but with admin credentials and issued separately). In theory, the DOD CAC system (they've gotten better over the years) eliminates the need for passwords entirely, but somehow most teams never tie their system to it properly.
- deleted 6y ago[deleted]
- DougN7 6y agoIt should be noted that everyone with a recent version of SolarWinds installed is considered exposed - not just the US gov
- thesimon 6y agoSolarWinds hasn't bothered to revoke their certs or remove the package https://twitter.com/KyleHanslovan/status/1338360093767823362 https://twitter.com/KyleHanslovan/status/1338360093767823362 Back in 2019 apparently their FTP server credentials were exposed on GitHub, allowing automated updates being pushed https://twitter.com/vinodsparrow/status/1338431183588188160/photo/1 https://twitter.com/vinodsparrow/status/1338431183588188160/... Edit: If updates failed due to signature not matching, SolarWinds recommended downloading the package and installing it manually, LOL https://twitter.com/KyleHanslovan/status/1338419999665508354/photo/1 https://twitter.com/KyleHanslovan/status/1338419999665508354...
- Nightshaxx 6y agoLOL that last one. Why bother having the checksum at all in this case....
- Merman_Mike 6y agoAm I understanding the last one correctly? 1. Customers complain that they can't install latest version because it's checksum doesn't match what SolarWinds posted 2. The checksum doesn't match because malware has been inserted into the package during build/delivery 3. SolarWinds tells customers to ignore this and install it manually Did no one think to check why the checksum didn't match?
- jessaustin 6y agoOne suspects they've given this advice for a long time... because their shit has been hacked for a long time.
- gitweb 6y agoI don't understand why anyone would pay for SW in the first place. It has been garbage software for a long time. If government clients are paying for this and installing in on their servers, we have bigger worries.
- deleted 6y ago[deleted]
- robocat 6y agoMore details: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... “SolarWinds.Orion.Core.BusinessLayer.dll is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. We are tracking the trojanized version of this SolarWinds Orion plug-in as SUNBURST.” “ Multiple trojanzied updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website. The trojanized update file is a standard Windows Installer Patch file that includes compressed resources associated with the update, including the trojanized SolarWinds.Orion.Core.BusinessLayer.dll component. Once the update is installed, the malicious DLL will be loaded by the legitimate SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe. After a dormant period of up to two weeks, the malware will attempt to resolve a subdomain of avsvmcloud[.]com.” “This actor prefers to maintain a light malware footprint, instead preferring legitimate credentials and remote access for access into a victim’s environment.” “In observed [trojan] traffic these HTTP response bodies attempt to appear like benign XML related to .NET assemblies” “Command data is spread across multiple strings that are disguised as GUID and HEX strings.” Edit: Silly me, that was the first article on hn, see thread: https://news.ycombinator.com/item?id=25413053 https://news.ycombinator.com/item?id=25413053
- jorblumesea 6y agoSo basically, Russians had the highest level of access to every large company and most government agencies in the US? (Including defense, DOD, pentagon) If so, this is on scale with the OPM hack in 2015. This is huge. Smart to use the election timing while authorities were focused elsewhere.
- colinmhayes 6y agoIs there any actual evidence that his was Russia? All I've seen so far is solarWinds unsubstantiated claim.
- jorblumesea 6y agoAttribution is very difficult in this space. According to most articles I've read, senior officials believe it's Russia (and it makes sense given the scope/scale) but smoking guns are hard to find.
- jeffreyrogers 6y agoThe Russia attribution track record is not very good. E.g. that Afghanistan bounty story appears doubtful and many of the earlier allegations of ties between the Trump administration and Russia were not substantiated. Not that Russia is not a threat to the US, but there is a sizable part of the federal bureaucracy that wants to pin things on Russia for various reasons (it's not all anti-Trump either). Edit: Downvoters, feel free to prove me wrong. Here's one source for my claims[0] [0]: https://www.nbcnews.com/politics/national-security/u-s-commander-intel-still-hasn-t-established-russia-paid-n1240020 https://www.nbcnews.com/politics/national-security/u-s-comma...
- thisisdallas 6y agoNo, not at all. It's political theatre the media is playing. Russia has been the big bad wolf since 2016. It's far more likely China than Russia, although it could be a variety of different states/parties.
- 6y ago
- hn_throwaway_99 6y ago> Malicious code added to an Orion software update may have gone undetected by antivirus software and other security tools on host systems thanks in part to guidance from SolarWinds itself. In this support advisory, SolarWinds says its products may not work properly unless their file directories are exempted from antivirus scans and group policy object restrictions. Ouch!
- dj_mc_merlin 6y agoNot uncommon for software that has to do very "shady" stuff, although their other advisories are quite bullcrap.
- octopoc 6y agoIt's not just shady stuff. Recently, on a customer's Windows server, antivirus software randomly decided to permanently delete some our DLLs (!). We weren't doing anything remotely shady; it was a normal ASP.NET Core app.
- mandevil 6y agoAlso, any task that involves reading or writing files will, in the presence of cutomer antivirus software, turn into a random number generator on whether the read/write goes through at all, how long it takes, etc. We are constantly having issues with customer AV because of this.
- derivagral 6y agoStrange to consider that stuff like this is (part) of why browser apps took off in the first place!
- dj_mc_merlin 6y agoYes, the shady was in quotes. It's hard to tell some classes of malware from a security program in general.
- ethanolburner 6y agoJust to add, 15 mins ago Chris Bing from Reuters and other journalists confirmed the U.S. Department of Homeland Security to be the 3rd agency to be impacted [1]. I suspect there will likely be further agencies and of course private companies to come forward in the upcoming weeks/months. [1] https://twitter.com/Bing_Chris/status/1338552048342753288 https://twitter.com/Bing_Chris/status/1338552048342753288
- deleted 6y ago[deleted]
- koolba 6y agoIs this the same SolarWinds that owns Pingdom? https://www.solarwinds.com/pingdom https://www.solarwinds.com/pingdom
- daniellarusso 6y agoYes. Luckily that is an external monitoring tool, but they do allow ‘transactional’ monitoring, so some folks could have login info saved. The two sites I monitored w/ that tool, we used it to determine when a 3rd party account’s login info has expired. So, I would expect my saved credentials to be invalid, but that is just my anecdote. The rest is just simple uptime and response time monitoring of specific URLs, which we publicly expose anyway, so no threat there.
- imchillyb 6y agoRELEVANT XKCD: https://xkcd.com/936/ https://xkcd.com/936/
- lovecg 6y agoThough it should be noted those “4 random word” passwords are strong only if the words are truly random (and the string is less likely to be memorable in this case). A password generator that allows retries means people will hit that button until the string is memorable, reducing the entropy.
- drdeca 6y agoI was curious how much the entropy is reduced. As a simplifying assumption, assume everyone agrees about which of any 2 strings are more memorable. If someone takes m random samples, and of those, takes the one they find most memorable, how much does this reduce the entropy? If there are N possible strings, and so with a uniform distribution there would be, uh, -log_2(1/N) bits of entropy, I think(?) (because, summing over the N terms of -(1/N) * log_2(1/N) , gives a total of log_2(N) ) If one takes the maximum of m samples, what does that look like? The cdf of the uniform distribution over the terms (identified with their order in the list ordered by memorability) would be P[x \le a] = a/N , and with m independent samples , P[max(x_1,x_2,...,x_m) \le a] = (P[x \le a])^m = (a/N)^m = (1/N)^m a^m, and so the pdf would be, around (1/N)^m * m * a^(m-1) (approximating it as continuous because N is large. I am not sure that this is a reasonable approximation.) Then, the sum becomes, uh, again approximating as continuous, integrating from a from 0 to N, (1/N)^m * m * a^(m-1) * (-1) * log_2((1/N)^m * m * a^(m-1)) da , which is integral of (1/N)^m * m * a^(m-1) * (-1) * ( mlog_2(1/N) + log_2(m) + (m-1)log_2(a)) da which is, (mlog_1(1/N) + log_2(m)) + integral of (1/N)^m m(m-1) a^(m-1)*log_2(a) da ... uh..... ok I just threw wolframalpha at it, and I got, -log_2(m/N) + ((m-1)/(m ln(2))) which, subtracting that from the initial -log_2(1/N) , gives log_2(m) - ((m-1)/(m ln(2))), and that "((m-1)/(m ln(2)))" is about like, 1 or 2 or therabouts (it is 0 if m=1 of course). so, if all the perhaps questionable approximations I made didn't mess this all up (and I didn't mess this up in some other way), I think that says that, if you pick the most memorable out of m random strings, by doing so you reduce the entropy by about log_2(m) + 1 bits. That doesn't sound too bad to me, really. Well, I suppose it depends how many bits you have to spare, and how big of an m you pick.
- ineedasername 6y agoCould someone explain what a "supply chain" exploit is?
- vsareto 6y agohttps://attack.mitre.org/techniques/T1195/ https://attack.mitre.org/techniques/T1195/ as an example
- deleted 6y ago[deleted]
- afrcnc 6y agoduplicate: https://news.ycombinator.com/item?id=25413053 https://news.ycombinator.com/item?id=25413053 and a few others more
- dredmorbius 6y agohttps://news.ycombinator.com/item?id=25422930 https://news.ycombinator.com/item?id=25422930
- pmlnr 6y agoSigh. "Engineers are expensive, so don't build, buy!" How about... the middle way? Let your own engineers deploy open source, something you can verify, even audit, if you ever have to. Ah, I forgot. Those usually don't come with fat envelopes from the provider to the people making the decisions.
- noobermin 6y agoFinally, the post I was looking for, sadly voted below calls for Biden to invade Russia. Literally how is this not the take away from this story? It's time to stop putting stock in one big company to do all the work for you.
- dmitrygr 6y agoThis is why all this bullshit about "let's add a backdoor to all encryption just for the government" is just that: bullshit. A year or so after it is added, it will be available to every government on earth this way, and a year after, on your favourite warez site...
- ummonk 6y agoFor a minute I misparsed the title and thought that the US Treeasury and Commerce departments' staff hacked their way around a SolarWinds compromise. That would have been cooler.
- thrower 6y agoHave there been any statements / postmortems released from SolarWinds itself yet?
- just_steve_h 6y agoCompanies that provide faulty software are "magically" exempt from liability – neat trick!
- just_steve_h 6y agoSo far I've seen ZERO EVIDENCE. Reuters and the Washington Post have breathless claims of Russian hackers "according to officials familiar with the matter." Uh huh. Saying "APT29" or "CozyBear" doesn't make the accusation any more credible. If multiple US agencies are trumpeting the same story, you really must ask yourself "Why? Why this? Why now?" It's pretty amusing, in a depressing way, to see how quickly so many otherwise intelligent people can be made to snap to attention and fight the Russian Menace with a few anonymous government claims.
- jen729w 6y agoGiven the scope of this product — basically everyone runs it — any chance that this is some sort of hoax will be mitigated by the “too large to be a hoax” thing. Probably some sort of fallacy whose name I don’t know. See: moon landing. Of course we went to the moon otherwise, what, 50,000 people are keeping a perfect and scandalous secret for half a century?
- jiggawatts 6y agoThe best proof that the United States went to the Moon is that there was extensive Russian spying going on at the time, but Russia never claimed that the US was lying about the Apollo program.
- hn_throwaway_99 6y agoThe best proof that we went to the moon is that we left mirrors there that we use to bounce lasers off of to detect the distance to the moon.
- jiggawatts 6y agoThat's difficult for people with poor science educations to fully grasp. For example, they might think that the moon's surface itself could reflect the laser light, etc... Not to mention that unmanned probes could also have placed reflectors without humans ever being sent to the Moon!
- realmod 6y agoRussia's hacking/software capabilities have always fascinated me. I might be out of the loop, but it very much feels like this "online cold-war" is very one-sided towards Russia, which is ridiculous given US capabilities. Though, this could be attributed to the US simply not getting caught. Nonetheless, everything I've read points to Solarwinds conduct being borderline negligent. For example, they not only told customers to ignore inaccurate checksums but they also failed basic server security.
- wonder_er 6y agoI read Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon a few weeks ago, and really enjoyed it. I'd recommend giving it a read. It gives an accurate-but-uncomfortable overview of how the US government handles cyber security issues.
- Aaronstotle 6y agoI'd highly recommend Sandworm by Andy Greenberg for more information about Russia's hacking capabilities.
- brown9-2 6y agoIn US/western-centric media, you aren't likely to hear a lot of exploits of new malware that the US deployed in Russia or China. The targets of hacking by the US are not countries that publicize when they are infiltrated.
- jdironman 6y agoWe are now in the Code War.
- wonder_er 6y agoSeems like a good time to plug an excellent book: Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon [0] The US Government has spent two decades and hundreds of millions of dollars building tools to undermine the security of systems around the world, and withholding information from "Industry" that would help harden those systems. I have no idea who "did" this, I don't really care. The NSA has been loading this footgun for decades. [0] https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital-ebook/dp/B00KEPLC08/ref=tmm_kin_swatch_0?_encoding=UTF8&qid=&sr= https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital-eb...
- jkaptur 6y agoI really enjoyed The Hacker and the State by Ben Buchanan. It explores why various nations pursue cyber operations the way they do.
- misiti3780 6y agoI can second that that book was great.
- deleted 6y ago[deleted]
- chance_state 6y agoDid you read the book? They work extensively with industry to patch vulnerabilities. There's a whole committee and process for it.
- wonder_er 6y agoI did. Did you? One of the core themes in the latter half of the book was how the government obtains zero-days, and then has a "committee of government and industry experts" that think about responsible disclosures, assuming the government is willing to "concede" the "national security advantage" of not disclosing the vulnerability. Most vulnerabilities don't get disclosed. Most systems go unpatched. Just so the USG can exploit foreign systems. It's very possible this particular vulnerability was found, but it's potential for spying outweighed the concern for patching. We'll never know.
- Dirlewanger 6y agoThese breaches will continue to happen, and happen...and happen until our limp-dick federal government gives a shit and starts to punish companies for their malicious malfeasance regarding IT security.
- andromeduck 6y agoThis is the same congress that moved to largely indemnify Equifax?
- IronRanger 6y agoAnd until we end the H1B visa and only allow Americans or American allies to run the IT systems of companies in America.
- adrr 6y agoSolarwinds doesn’t have h1bs according to public database probably because they work on government contracts. So how does ending h1b stop this attack?
- Aperocky 6y agoPunish won't do anything. You can't punish lack of ability, just like you don't punish someone for scoring a B at school. Everything happens after the fact, and no one knows what the next breach will be. And that will continue until the your average Joe's system no longer has 100 vendors each ordained by high management that basically acts as malware themselves. Someone even started blaming the H1Bs, the mentality is amusing - fix nothing and find blame first and (often) blame it on the wrong thing - I'm glad I don't work for an organization that has the same mentality. Though I can certainly see many of the largest companies and a large percent of people have the exact MO. That also needs to change.
- wslack 6y agoWhat punishment do you want? How would you calculate damages?
- 99_00 6y ago
- dang 6y agoThe major earlier threads on this ongoing story are: https://news.ycombinator.com/item?id=25413053 https://news.ycombinator.com/item?id=25413053 https://news.ycombinator.com/item?id=25409416 https://news.ycombinator.com/item?id=25409416
- trashcan 6y agoThis also came out today: https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ https://mattermost.com/blog/coordinated-disclosure-go-xml-vu... It seems pretty likely that SolarWinds' SAML authentication was bypassed or escalated by this issue with Go's encoding/xml, and then used that to generate and distribute the trojaned SolarWind's updates.
- richardwhiuk 6y agoDoubt it - that bug has been known by Go/Mattermost since August.
- trashcan 6y agoHow would SolarWinds know about it if it wasn't publicly disclosed until today? Also, I realize the SAML -> SolarWinds connection is a bit of speculation on my part, but SAML is mentioned in Microsoft's advisory: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ https://msrc-blog.microsoft.com/2020/12/13/customer-guidance... It sounds like a privilege escalation using the Go/SAML issue.
- trashcan 6y agoAlso, this hack happened in March, so your timeline is irrelevant.
- vngzs 6y agoSince this is a supply chain attack on software downloads, I think it's interesting to consider the implications for the security posture of a cloud-native organization. While cloud-native is commonly recognized as less secure (because the cloud provider could be hacked!), there are a few categories of attacks exclusive to onprem software deployments: 1. You misconfigure the onprem software, making it more insecure than the alternatives. This does not occur with SaaS products. 2. The software delivery system is tampered with, and you download and run malicious code on your systems with high privileges. If you don't run it, this can't happen. Cloud deployments aren't obviously safer, but they have clear advantages unless you are willing to pay top people to work on and secure each onprem deployment full-time. NB: I don't actually believe "the cloud" is fundamentally more or less secure than onprem deployments. Rather, I frequently hear people argue that a website being hacked - or the potential for it - justifies a movement to onprem, and I think this is (usually) false.
- jsty 6y agoWhilst not being a "cloud is someone else's computer" adherent, the notion SaaS products can't be misconfigured into opening up security holes not present / so serious in some on-prem environments doesn't hold water - see the last decade's stories of accidentally open S3 buckets, plaintext secrets pushed to public GitHub repos, and all manner of other "minor misconfigurations"
- acdha 6y agoThis is true but there’s a big difference in how easy it is to audit. You can enable Security Hub and Guard Duty on AWS organization-wide in a few minutes and have a pretty solid baseline for hardening your infrastructure and flagging suspicious activity. Doing the same with on-premise infrastructure takes months and entails significant risk since things weren’t designed around APIs and low-privilege IAM. (GCP is similar but SCC is earlier in the development cycle and their threat detection isn’t well designed.)
- caminocorner 6y ago> While cloud-native is commonly recognized as less secure (because the cloud provider could be hacked!) That's not a common recognition by any means. Cloud providers are more secure and spend more on infosec than any business managing their own tech & data centers. Pretending that the cloud provider being the point of entry is in the same ball park of risk (or greater risk) is a strange talking point in 2020
- icedistilled 6y agoWow the hackers had free rein over basically any company that they wanted. SolarWinds says it has over 300,000 customers including: -more than 425 of the U.S. Fortune 500 -all ten of the top ten US telecommunications companies -all five branches of the U.S. military -all five of the top five U.S. accounting firms -the Pentagon -the State Department -the National Security Agency -the Department of Justice -The White House
- trixie_ 6y agoAs a user of Ignite, we're struggling to find an alternative that matches its feature set. Great business opportunity here.
- meh206 6y agoThe "Russia" allegation sounds like an extremely weak & repetitive claim made by people on a certain political side to divert attention away from their bad press for criminal behavior (to include all of the Chinese compromises that were recently revealed). They're playing a VERY dangerous game, as if they would rather the entire world be destroyed before facing the possibilities of justice (Gitmo, military court tribunals, and everything else that the EO from 9/18 outlined). The bottom line: the MSM has been full of $&@T for quite some time, and this claim in Reuters is most likely more of the same.
- intern4tional 6y agoMicrosoft and Fireeye have both made similar claims and released substantial technical details. Attribution is hard, but those two companies have a solid reputation and do not make BS claims.
- goodluckchuck 6y agoI see where they claim it's a sophisticated / state-sponsored attack, but could you share where they attribute it to Russia in particular? If that's a political assessment made by the media that's one thing, but if these sourced have some sort of technical data that inherently links it to a particular nation... that's something I haven't seen.
- cinquemb 6y agoYeah, I think that every time someone/some org knee jerks "it was russia" without at least acknowledging there could be a variety of well funded actors interested in compromising the US Treasury [or any other target] for a variety of reasons and/or having the incentive to make it look like someone else could have done it, just pours more fuel on the attribution fire.
- andreasley 6y agoI wonder if this unintended transparency actually makes for a safer world. The cold war might have been shorter if both sides would have been able to see that their enemy does not intend to escalate the situation.
- disgrunt 6y agoConsistent with the "Most Secure Election Ever" (tm) claims, Dominion Voting Systems use SolarWinds' Orion platform, too. [0] [0]: https://www.theepochtimes.com/dominion-voting-systems-uses-firm-that-was-hacked_3617507.html https://www.theepochtimes.com/dominion-voting-systems-uses-f...
- disgrunt 6y agoAnd possibly related news? [0] [0]: https://www.theepochtimes.com/crucial-logs-missing-from-antrim-county-dominion-voting-machines-forensics-report_3617768.html https://www.theepochtimes.com/crucial-logs-missing-from-antr...
- Aperocky 6y agoEpoch Times. It's like Fox but turned up to 11. Their origin story read like how we supported the original mujahideen in Afghanistan. We all knew how that turned out.
- disgrunt 6y agoOk, want to login to Dominion Voting Systems' SolarWinds instance? Here you go. So much for "powering it off"... [0] [0]: https://dvsfileshare.dominionvoting.com/Web%20Client/Mobile/MLogin.htm https://dvsfileshare.dominionvoting.com/Web%20Client/Mobile/...
- AnthonyMouse 6y agoIs the story actually false or is this just an ad hominem attack?
- Aperocky 6y agoIt is not an ad hominem attack when accurately describing the well known attribute of the source. The story also turned out to be not necessarily true, from another comment.
- plasma 6y agoSEC filings: SolarWinds says 18,000 customers were impacted by recent hack https://www.zdnet.com/article/sec-filings-solarwinds-says-18000-customers-are-impacted-by-recent-hack/ https://www.zdnet.com/article/sec-filings-solarwinds-says-18...
- mrfusion 6y agoI’m completely out of the loop on what’s going on. Would anyone mind explaining like I’m from November and in high school?
- pfundstein 6y agoTo summarise it roughly: A software company (SolarWinds) whose software (Orion) is used by thousands of companies and government agencies worldwide, was hacked and a backdoor inserted into an update. An update which was subsequently installed by 16000 customers including the US Treasury and Commerce departments. This happened months ago and there is no telling how much data the attackers have exfiltrated from these companies.
- hikerclimb 6y agoNice! Wish they got more companies especially dod and more of our government agencies in the us
- dukeofdoom 6y agoSo was the election hacked too? I'm a little confused how Biden can get 80 million votes, and almost no one watched his acceptance speech today. 40k views on youtube. The 6k vote flipping in Michigan was claimed to be some sort of computer error. But why were the logs deleted? that seems like a hacker thing to do to delete the logs. A judge just released the audit report. https://www.freep.com/story/news/politics/elections/2020/12/14/michigan-company-officials-dispute-report-antrim-county-voting/6538325002/ https://www.freep.com/story/news/politics/elections/2020/12/...
- __m 6y agoNobody really cares about Biden, they just want to get rid of Trump.
- dukeofdoom 6y agoThis is what we're being told, among other things like Trump voters did not vote by mail, at sometimes like 9 to 1 ratio. But we are told to accept these things as True at face value. Likewise, we are to Trust and accept the results on Dominion Machines. When the only audit that was permitted to be performed, uncovered a 68% error rate, and logs deleted. Trust but verify. The verify part has not really been done. We are only told to Trust.
- jessaustin 6y agoI wish you would be as concerned about the hundreds of thousands of poor and minority citizens who are denied their votes every election. https://www.washingtonpost.com/outlook/2020/12/10/voter-suppression-fraud-false-claims-trump/ https://www.washingtonpost.com/outlook/2020/12/10/voter-supp...
- hikerclimb 6y agoI hope this leads to nuclear war
- rixed 6y agoLet's assume this is a case of state sponsored attack. If I was in charge of organising such an attack, I would make sure my employer would be on top of the list of victims. Would not do any actual damage to steal my own information and would tremendously help with attributing the attack to my enemy.
- brundolf 6y ago"SolarWinds says it has over 300,000 customers including: -more than 425 of the U.S. Fortune 500 -all ten of the top ten US telecommunications companies -all five branches of the U.S. military -all five of the top five U.S. accounting firms -the Pentagon -the State Department -the National Security Agency -the Department of Justice -The White House" Purely from a risk management perspective, it's a terrible idea to have a single point of failure for all of the above
- faeyanpiraat 6y agoWhat would the solution be? Use the products of multiple companies for everything tech related? Give AMD processors for the army, and INTEL to the white house? Should telcos use windows, and the pentagon linux? NSA can use excel, and NSA libreoffice? Collecting the generic common components and software used by large chunks of people would yield an endless list. Even then, when an exploit comes out for something, the only benefit is that you can limit the extent of damages, not prevent it. Removing all single points of failure in this scale seems impossible.
- brundolf 6y agoI think what you describe seems entirely reasonable. Though more so for software than hardware; that way a single exploit can't take down our whole government.
- mikewarot 6y agoFor the last 15 years, I keep pushing information about Multi Level Secure Systems every time another incident like this happens. The fact that we haven't been using them since the 1970s everywhere drives me nuts! https://en.wikipedia.org/wiki/Multilevel_security https://en.wikipedia.org/wiki/Multilevel_security Their are Operating Systems in existence which could prevent this and almost every other breach. However, most technical people aren't even aware of the fact that they CAN exist, and actively believe the opposite. Hopefully Genode.org will have something useable for the average programmer like me, in a year or two, and I can use that as an existence proof. Also, there are Data Diodes to help restrict what goes where. https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network I think we'll finally get our act together in 2025 or so, 50 years after the first Multi Level Systems were finished.
- hrgiger 6y agoI wonder scanning their own uploads and validating checksums via cron job would have prevented or at least would give an early alert Shameless disclosure: i was doing something similar (I do not have a plan to maintain long time) but would love to hear better solutions: https://github.com/getsumio/getsum https://github.com/getsumio/getsum
- csense 6y agoI tried the shareware version of Solar Winds back in the '90s. I guess I should be glad I didn't buy the full version. https://en.wikipedia.org/wiki/Solar_Winds https://en.wikipedia.org/wiki/Solar_Winds
- lionkor 6y agowrong link, its https://en.wikipedia.org/wiki/SolarWinds https://en.wikipedia.org/wiki/SolarWinds