4 ms·

It doesn't take much of a "sophisticated hack" if they post their passwords publicly.

deleted 6y ago
[deleted]
hackerpain 6y ago
The news and press defined the "attack sophistication". An attack of this scale definitely needs some amount of sophistication but on a difficulty scale of 1-10 to infiltrate their network, I would rate it a humble 0.5/10.
- ceejayoz 6y ago
  Don't blame the press on this; the "sophisticated hack" wording comes directly from SolarWinds. https://www.solarwinds.com/securityadvisory https://www.solarwinds.com/securityadvisory > We have been advised that this incident was likely the result of a highly sophisticated, targeted, and manual supply chain attack by an outside nation state...
  - hackerpain 6y ago
    > We have been advised Their advisor was smart enough to call it so.
ceejayoz 6y ago
Any "sophisticated hack" is likely to have some mundane details. This might've given an avenue to start exploring; it doesn't seem likely it's what let them sign binaries by itself, and it doesn't change the cleverness of the steganographic techniques described in the FireEye analysis.
- martinald 6y ago
  This isn't really a mundane detail though. The fact they have non secure (not even SFTP or FTP over SSL) FTP access open to their main downloads page with a ridiculously insecure password is pretty startling. I can't even understand why they had FTP running like that.
  - ceejayoz 6y ago
    Having worked with large enterprise vendors, it's really not startling to me. Depressing, perhaps. I'm saying, though, that a hack can be sophisticated even if the initial compromise was something pretty basic like this. As an example, https://about.fb.com/news/2020/11/bug-bounty-program-10th-anniversary/ https://about.fb.com/news/2020/11/bug-bounty-program-10th-an... > Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our Content Delivery Network (CDN), a global network of servers that deliver content to people accessing our platform around the world, where a subset of our CDN URLs could have been accessible after they were set to expire. After fixing this bug, our internal researchers found a rare scenario where a very sophisticated attacker could have escalated to remote code execution. As always, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty – $80,000.
    - hackerpain 6y ago
      I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact. How should I report it in your opinion?
      - ceejayoz 6y ago
        Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc. In the EU, you might be able to report it to a regulator. In Russia, perhaps not.
      - mackenzie-gg 6y ago
        Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty https://www.hackerone.com/product/bounty
acdha 6y ago
If you read the reports, rather than second or third hand coverage, note how the attacker concealed their activities after they got in. That’s what sophisticated refers to - breaches are common but avoiding detection for so long on so many networks is not.
- neffy 6y ago
  That last is actually rather hard to determine. Detected attacks tend to divide into two groups - the scripted continuous probing that's just background noise these days (but if you have access to the logs on any internet connecting device in front of a firewall you will typically see it being probed at least every 10 minutes), and targeted attacks - where the first rule is to be very careful, lay low, and perform careful data exfiltration. Reading the reports on the kinds of the latter that were discovered, and in particular how they were discovered, suggests there is probably much more of that going on than is generally realised.
rst 6y ago
It's not just the initial compromise that's getting "sophisticated hack" headlines in this case -- it's the extraordinary care that the attackers took to evade detection afterwards. Among other things: delaying communication to home base for a couple of weeks after the backdoor was initially installed; use of steganography to make that look like ordinary network traffic afterwards; use of entirely new exploits, not in any common database, to avoid detection triggered by a match. The FireEye report describes all of this in more detail: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive...
- jjk166 6y ago
  While the specific implementations in this case were unique and clever, these tactics aren't particularly uncommon. If you have direct access to SolarWinds' signing credentials and download server, the rest is just a matter of how much time and effort the attacker is willing to put into it.

deleted 6y ago

[deleted]

The news and press defined the "attack sophistication". An attack of this scale definitely needs some amount of sophistication but on a difficulty scale of 1-10 to infiltrate their network, I would rate it a humble 0.5/10.

ceejayoz 6y ago
Don't blame the press on this; the "sophisticated hack" wording comes directly from SolarWinds. https://www.solarwinds.com/securityadvisory https://www.solarwinds.com/securityadvisory > We have been advised that this incident was likely the result of a highly sophisticated, targeted, and manual supply chain attack by an outside nation state...
- hackerpain 6y ago
  > We have been advised Their advisor was smart enough to call it so.

ceejayoz 6y ago

Any "sophisticated hack" is likely to have some mundane details. This might've given an avenue to start exploring; it doesn't seem likely it's what let them sign binaries by itself, and it doesn't change the cleverness of the steganographic techniques described in the FireEye analysis.

martinald 6y ago
This isn't really a mundane detail though. The fact they have non secure (not even SFTP or FTP over SSL) FTP access open to their main downloads page with a ridiculously insecure password is pretty startling. I can't even understand why they had FTP running like that.
- ceejayoz 6y ago
  Having worked with large enterprise vendors, it's really not startling to me. Depressing, perhaps. I'm saying, though, that a hack can be sophisticated even if the initial compromise was something pretty basic like this. As an example, https://about.fb.com/news/2020/11/bug-bounty-program-10th-anniversary/ https://about.fb.com/news/2020/11/bug-bounty-program-10th-an... > Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our Content Delivery Network (CDN), a global network of servers that deliver content to people accessing our platform around the world, where a subset of our CDN URLs could have been accessible after they were set to expire. After fixing this bug, our internal researchers found a rare scenario where a very sophisticated attacker could have escalated to remote code execution. As always, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty – $80,000.
  - hackerpain 6y ago
    I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact. How should I report it in your opinion?
    - ceejayoz 6y ago
      Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc. In the EU, you might be able to report it to a regulator. In Russia, perhaps not.
    - mackenzie-gg 6y ago
      Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty https://www.hackerone.com/product/bounty

acdha 6y ago

If you read the reports, rather than second or third hand coverage, note how the attacker concealed their activities after they got in. That’s what sophisticated refers to - breaches are common but avoiding detection for so long on so many networks is not.

neffy 6y ago
That last is actually rather hard to determine. Detected attacks tend to divide into two groups - the scripted continuous probing that's just background noise these days (but if you have access to the logs on any internet connecting device in front of a firewall you will typically see it being probed at least every 10 minutes), and targeted attacks - where the first rule is to be very careful, lay low, and perform careful data exfiltration. Reading the reports on the kinds of the latter that were discovered, and in particular how they were discovered, suggests there is probably much more of that going on than is generally realised.

rst 6y ago

It's not just the initial compromise that's getting "sophisticated hack" headlines in this case -- it's the extraordinary care that the attackers took to evade detection afterwards. Among other things: delaying communication to home base for a couple of weeks after the backdoor was initially installed; use of steganography to make that look like ordinary network traffic afterwards; use of entirely new exploits, not in any common database, to avoid detection triggered by a match. The FireEye report describes all of this in more detail: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive...

jjk166 6y ago
While the specific implementations in this case were unique and clever, these tactics aren't particularly uncommon. If you have direct access to SolarWinds' signing credentials and download server, the rest is just a matter of how much time and effort the attacker is willing to put into it.