8 ms·

Bigger picture, what's the endgame here? It seems a lot of institutions handling sensitive work are considering air-gapping some or all of their networks at th

by edrxty 6y ago

Bigger picture, what's the endgame here? It seems a lot of institutions handling sensitive work are considering air-gapping some or all of their networks at this point. Maybe that's even what has to happen. Is there a means of fending off these attacks on the political front? If this same level of espionage was happening in person, there would be a kinetic response but it seems everyone is happy to just turn the other cheek. These attacks have a very real impact. Copying others homework is a tried and true way to get a technological edge and in practical terms, it means a lot of research and development money is effectively wasted as it doesn't generate any returns. Mind, I don't think there should be a violent response, but it's odd that even the threat of sanctions isn't made whenever this happens.

dcow 6y ago
I’m curious to hear more about cases of large institutions seriously considering air-gapping. This is the first I’ve got wind of something like that.
- lrem 6y ago
  Yeah, runs contrary to my perception too. Even things that one would reasonably expect to be air-gapped are online these days.
- bob1029 6y ago
  Air-gapped systems really only make sense for the occasional need to access exceptionally sensitive materials. I.e. private keys for root CAs. For most businesses, air-gapping would mean we are back in the 20th century of business with filing cabinets and armies of people pushing paper between 2 rooms.
  - edrxty 6y ago
    It's not actually that bad. There's a lot of defense, security, and highly proprietary development that happens on isolated networks. You have to put significant effort into IT infrastructure but you'll end up with all your stuff hosted internally and most tools support custom package repo mirrors (linux distros, programming languages/build systems, docker). You'll also probably have a second system with internet access at your desk if not nearby for stackoverflow et al. Basically the idea is defense in depth. The valuable stuff (design files, schematics, code, documentation) lives in the air gapped network while communications live inside a VPN and detailed technical discussion is often discouraged.
- jffhn 6y ago
  Air-gapping is common in some industries, and there are also network diodes: https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- thw0rted 6y ago
  Keep in mind, there's actual air-gapping, and there's secure enclaves. This specific attack would have no teeth if your Exchange server / OWA endpoint were only accessible from corporate VPN. You don't have to be one of the top-ten biggest corporations to run a global-scale intranet with off-the-shelf VPN servers, and it still greatly reduces your attack surface.
- koheripbal 6y ago
  For us, that only makes sense for backups. ...maybe private keys?
kqvamxurcagg 6y ago
It’s likely that whatever the Chinese or Russians are doing to the US, the US has bigger and better exploits gathering intelligence within adversary networks. Being too aggressive about these would undermine the US position when they are eventually discovered. The US must have some fantastic assets if they are putting up so little fuss about solarwinds and this attack.
- ganzuul 6y ago
  +1 Insightful. Hardware backdoors most probably.
- pmlnr 6y ago
  > the US has bigger and better exploits No, I honestly don't think so.
- igammarays 6y ago
  Pure unfounded speculation. The Russians and Chinese have a huge advantage over American intelligence agencies just by the simple fact that there are far more English-speaking Russians/Chinese than there are Russian-speaking Americans. Massive information asymmetry. How many native English speakers speak fluent Russian? Less than a few hundred in the entire world (I'm a Russian academic, I know). How many native Russian speakers speak fluent English? Hundreds of thousands of people. That's the reason why the Russian government is able to run massive projects that directly influence American public opinion through social media. America simply doesn't have that volume of talent and infiltration into foreign societies. > The US must have some fantastic assets if they are putting up so little fuss about solarwinds and this attack. Actually they are putting up so little fuss because they are incompetent and castrated since the last administration.
  - anchochilis 6y ago
    This. I hope there will be some kind of proportional response but I'm not gonna hold my breath.
  - novaRom 6y ago
    It's more about impunity. If your previous actions didn't cause any serious reaction, you will continue doing more bad things. Tolerance to bad things is destructive.
AniseAbyss 6y ago
Not true countries accept that they spy on eachother. They all do it its just that America are the "good guys" and its enemies don't do press conferences on how they got hacked. Also we already have copyright and patents so no you can't copypaste an iPhone.
heresie-dabord 6y ago
> endgame If you mean the strategy as the end nears, it should be what it should always have been: trust no single product or supplier, implement multiple layers of defence for what is important. Maintain in-house expertise. If you mean the "Lessons (never) Learned"... Train developers better, build better software through validation and verfication, train management to understand technology and risk. Humans become increasingly incompetent as complexity is scaled. Everyone is doing espionage, no one is going to war because Microsoft has flaws.
shostack 6y ago
Lots of comments on the security arms race, but I'm curious about the geopolitical end game. What will Russia and China do with this information? Technological advancement is a means to an end. What is the end?
hollerith 6y ago
>Copying others homework is a tried and true way to get a technological edge The Soviets were better at spying than the West was, but their being better at copying the West than the West was at copying them didn't seem to help them all that much.

by edrxty 6y ago

dcow 6y ago

I’m curious to hear more about cases of large institutions seriously considering air-gapping. This is the first I’ve got wind of something like that.

lrem 6y ago
Yeah, runs contrary to my perception too. Even things that one would reasonably expect to be air-gapped are online these days.
bob1029 6y ago
Air-gapped systems really only make sense for the occasional need to access exceptionally sensitive materials. I.e. private keys for root CAs. For most businesses, air-gapping would mean we are back in the 20th century of business with filing cabinets and armies of people pushing paper between 2 rooms.
- edrxty 6y ago
  It's not actually that bad. There's a lot of defense, security, and highly proprietary development that happens on isolated networks. You have to put significant effort into IT infrastructure but you'll end up with all your stuff hosted internally and most tools support custom package repo mirrors (linux distros, programming languages/build systems, docker). You'll also probably have a second system with internet access at your desk if not nearby for stackoverflow et al. Basically the idea is defense in depth. The valuable stuff (design files, schematics, code, documentation) lives in the air gapped network while communications live inside a VPN and detailed technical discussion is often discouraged.
jffhn 6y ago
Air-gapping is common in some industries, and there are also network diodes: https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
thw0rted 6y ago
Keep in mind, there's actual air-gapping, and there's secure enclaves. This specific attack would have no teeth if your Exchange server / OWA endpoint were only accessible from corporate VPN. You don't have to be one of the top-ten biggest corporations to run a global-scale intranet with off-the-shelf VPN servers, and it still greatly reduces your attack surface.
koheripbal 6y ago
For us, that only makes sense for backups. ...maybe private keys?

kqvamxurcagg 6y ago

It’s likely that whatever the Chinese or Russians are doing to the US, the US has bigger and better exploits gathering intelligence within adversary networks. Being too aggressive about these would undermine the US position when they are eventually discovered. The US must have some fantastic assets if they are putting up so little fuss about solarwinds and this attack.

ganzuul 6y ago
+1 Insightful. Hardware backdoors most probably.
pmlnr 6y ago
> the US has bigger and better exploits No, I honestly don't think so.
igammarays 6y ago
Pure unfounded speculation. The Russians and Chinese have a huge advantage over American intelligence agencies just by the simple fact that there are far more English-speaking Russians/Chinese than there are Russian-speaking Americans. Massive information asymmetry. How many native English speakers speak fluent Russian? Less than a few hundred in the entire world (I'm a Russian academic, I know). How many native Russian speakers speak fluent English? Hundreds of thousands of people. That's the reason why the Russian government is able to run massive projects that directly influence American public opinion through social media. America simply doesn't have that volume of talent and infiltration into foreign societies. > The US must have some fantastic assets if they are putting up so little fuss about solarwinds and this attack. Actually they are putting up so little fuss because they are incompetent and castrated since the last administration.
- anchochilis 6y ago
  This. I hope there will be some kind of proportional response but I'm not gonna hold my breath.
- novaRom 6y ago
  It's more about impunity. If your previous actions didn't cause any serious reaction, you will continue doing more bad things. Tolerance to bad things is destructive.

AniseAbyss 6y ago

Not true countries accept that they spy on eachother. They all do it its just that America are the "good guys" and its enemies don't do press conferences on how they got hacked. Also we already have copyright and patents so no you can't copypaste an iPhone.

heresie-dabord 6y ago

> endgame If you mean the strategy as the end nears, it should be what it should always have been: trust no single product or supplier, implement multiple layers of defence for what is important. Maintain in-house expertise. If you mean the "Lessons (never) Learned"... Train developers better, build better software through validation and verfication, train management to understand technology and risk. Humans become increasingly incompetent as complexity is scaled. Everyone is doing espionage, no one is going to war because Microsoft has flaws.

shostack 6y ago

Lots of comments on the security arms race, but I'm curious about the geopolitical end game. What will Russia and China do with this information? Technological advancement is a means to an end. What is the end?

hollerith 6y ago

>Copying others homework is a tried and true way to get a technological edge The Soviets were better at spying than the West was, but their being better at copying the West than the West was at copying them didn't seem to help them all that much.