7 ms·

They failed to implement multi-factor authentication on their VPNs. This is one of the most common attack vectors. VPNs by themselves are not enough. Over two t

They failed to implement multi-factor authentication on their VPNs. This is one of the most common attack vectors. VPNs by themselves are not enough. Over two thirds of corporate attacks with VPNs have been through compromised static credentials. There are numerous ways of integrating VPNs with MFA ranging from a RADIUS integration to a SAML one. At Saas Pass the admin can choose and implement up to 15 different methods of MFA to VPNs ranging from FIDO keys to push approval to scanning encrypted barcodes to SMS (not recommended) etc... Disclaimer: Worked on the design of some of the mfa interfaces for the SAML based VPNs and the access control policies.

jl2718 5y ago
Personally I think RADIUS is a terrible idea. If that thing is compromised, or even the network or name service to connect to it, the attacker gets everything. Cert-based auth gives every client the ability to independently authorize every login without any ability to learn or compromise credentials. And there are lots of cert-based MFAs that require nothing more than a few lines in an Apache config, or even handled through the operating system to set up a vpn handshake. One of my biggest contributions at one place I worked was to dismantle their radius auth and replace it with token cert auth. It’s hard to write about that on a resume, because people tend to be more impressed with complexity than simplicity.
- er4hn 5y ago
  "Upgraded legacy, obsolete, AAA service with modern and standards compliant solution" And if it is ever asked about, boy do you have some great stories about upgrading from a system whose protocol name referred to dial in modems and used MD5 to obfuscate passwords.
  - qazxcvbnmlp 5y ago
    Thank you. Not the op but I have trouble coming up with this stuff for my own resume.
g_p 5y ago
One issue in the critical infrastructure space is that many of these MFA solutions are less robust and resilient than no MFA. Anything based on calling out to an external service (Duo, for example) is likely to be less resilient [1] than the static, no-external-dependencies system they use for plain password Auth. Clearly moving towards complex systems like RADIUS and SAML introduce even more moving parts that sit with interconnects between trusted and untrusted, internal and external components. That becomes a point of failure in the eyes of infrastructure companies. The challenge here seems to be getting the IT world to understand the focus on availability in critical infrastructure - historically, the focus has been on availability first, integrity second, confidentiality third. You could argue this shouldn't apply to VPN interfaces in to manage systems, but given the external dependencies of these systems, they feel far less likely to remain available than the kind of solutions the sector expects. On a separate note though, critical infrastructure need to re-think their budgets to pay for their increased availability needs, given most of the commercial solutions are third party hosted "as a service" offerings. [1] https://status.duo.com/history?page=2 https://status.duo.com/history?page=2
- goodoldneon 5y ago
  Unavailability of Duo’s MFA product is extremely rare. But when it does happen, IT admins can switch to “bypass” mode to only require the 1st factor. So even though Duo doesn’t have 100% uptime, you’re no worse than no MFA
  - g_p 5y ago
    Scrolling through their incident feed, it seems to be a bit more frequent than "extremely rare". Remember that critical industry is a sector where patching software is viewed as risky, because changing anything when it works is seen as unnecessary, and would often have weeks or months of pre-deployment testing. They work on a different time-base to the IT world. The ability to do a "bypass" is nice in theory, but the need for this option will resonate with the "old guard", who will be able to use this external dependency to keep it out. Personally I prefer smartcard-based solutions for MFA, since you can do all verification offline without requiring any third party to inject themselves into the chain. I found a good example of a vulnerability this year in Duo that just shows their validation logic is complex enough that one user was able to pass 2FA as another user [1]. That's probably your second worst case scenario, with the worst being an outsider being able to pass 2FA. A well-implemented smartcard scheme shouldn't fail in this way, as you're distributing validation logic to each device, rather than centralising it and relying on a "trusted outsider" to give a "yes or no". [1] https://sensepost.com/blog/2021/duo-two-factor-authentication-bypass/ https://sensepost.com/blog/2021/duo-two-factor-authenticatio...
antattack 5y ago
They also failed to deactivate account that was no longer in use and/or have a policy for disabling stale accounts.
karmicthreat 5y ago
It gets to be difficult to constantly come back to management for money at a small company. The MFA/Identity services want 3-12$/user. EDR wants 4-12$/user. Phishing training, same. VPN (fortinet in my case) same. The 57$/User of MS E5 is starting to look like a steal.
kevin_b_er 5y ago
And disused account, which probably means an employee who left.
- gabereiser 5y ago
  This. Have a solid offboarding checklist that includes VPN credentials or any access to systems that employee might have. At this point I don’t have any sympathy for the hacked when it’s as simple as this.
  - agsamek 5y ago
    The offboarding checklist is not enough. You should have regular cleanup procedures which synchronize accesses with the main source of truth as well. There are too many exceptions and just human errors for a time constrained checklist execution to be enough. Checklist is a 90% solution which might help here. Or it might have been the case where the checklist failed.
  - rorykoehler 5y ago
    It’s nearly always as simple as this. I got flamed on here for suggesting that Twitter just needs to follow NIST or similar standards to avoid the hack they had last year instead of hitting expert security researchers.
  - ed25519FUUU 5y ago
    Invalidating credentials should be a one-stop-shop action. There shouldn’t be “invalidate their email, invalidate their VPN, invalidate their corporate login...”
    - gabereiser 5y ago
      Exactly. If everything is based on SAML SSO this is easy. If you manage multiple user databases for access control it’s a bit harder.
  - mac-chaffee 5y ago
    This is a requirement for ISO 27002. Just had to implement an offboarding checklist recently.
deleted 5y ago
[deleted]
samstave 5y ago
I'd like to subscribe to your newsletter. -- Seriously though - in your comment, you described the landscape of knowledge whereby it is EASY for any given corp to mis-step without a 'you' on staff or contract. Now, as the NSA has released in the past best practices around security and such (like how to lockdown a linux box for example) Wouldn;t it be prudent for the .gov to be able to present a salient security posture recommendation in such a format as you present above? Meaning - WHY THE FUCK DONT WE HAVE A SECURITY.GOV WEBSITE THAT STATES EXACTLY HOW TO SECURE YOUR [THING] and CLICK HERE FOR EXPERTISE ON HOW TO SO??? We are in the Digital Nuke age. We should act as such. You get the idea...
- deleted 5y ago
  [deleted]
- Strs2FillMyDrms 5y ago
  While my dentist was performing a procedure on my teeth he received a call from a former student now teacher at the university. The issue? A group of old professors chose to stop teaching a particular procedure. Reason? Market prices of that procedure had began to be driven down by competing professionals. She sounded so disappointed, as she should. Never underestimate the power of greed against the well being of everyone else.
  - breakfastduck 5y ago
    Appreciate your point but it's quite possibly the most 'USA' comment I've ever read. Lets stop assuming these things happen elsewhere to the same greed fueled extent.
    - 1vuio0pswjnm7 5y ago
      Dentists outside the USA do this, too. I once had a dentist outside the US even admit this to me. She seemed embarassed by her former classmates from dental school who were operating this way.
    - mardifoufs 5y ago
fukmbas 5y ago
SaaS VPN is the dumbest thing I've ever heard of
hsbauauvhabzb 5y ago
MFA doesn’t solve targeted phishing and that’s something people keep forgetting. Sprays are just the best ROI, but if everything had MFA it would quickly create a phishing as a service business model.
- gruez 5y ago
  >MFA doesn’t solve targeted phishing and that’s something people keep forgetting. any VPNs support u2f?
  - vladvasiliu 5y ago
    While not U2F but pretty close for the issue at hand (preventing phishing), any VPN that supports radius as a backend can use Windows NPS which can be integrated with Azure AD MFA to send a notification to the phone. You may still want to train the users not to accept any random request on the app, though. But this works (fairly) well and is cheap (no hardware token to buy). https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension https://docs.microsoft.com/en-us/azure/active-directory/auth...
    - tialaramex 5y ago
      Phone confirmation doesn't evade phishing. The user doesn't think the request they just got on the app is "random" because they think they're doing the right thing. The whole idea of phishing is to trick the human user.
  - mdeeks 5y ago
    Tailscale should (indirectly) with 3rd party Google/Okta/Etc auth.
  - galuano1 5y ago
    Cisco VPN does.
- foxpurple 5y ago
  If you use the physical tokens it does solve that because the tokens won’t authenticate on the scammer site.

jl2718 5y ago

Personally I think RADIUS is a terrible idea. If that thing is compromised, or even the network or name service to connect to it, the attacker gets everything. Cert-based auth gives every client the ability to independently authorize every login without any ability to learn or compromise credentials. And there are lots of cert-based MFAs that require nothing more than a few lines in an Apache config, or even handled through the operating system to set up a vpn handshake. One of my biggest contributions at one place I worked was to dismantle their radius auth and replace it with token cert auth. It’s hard to write about that on a resume, because people tend to be more impressed with complexity than simplicity.

er4hn 5y ago
"Upgraded legacy, obsolete, AAA service with modern and standards compliant solution" And if it is ever asked about, boy do you have some great stories about upgrading from a system whose protocol name referred to dial in modems and used MD5 to obfuscate passwords.
- qazxcvbnmlp 5y ago
  Thank you. Not the op but I have trouble coming up with this stuff for my own resume.

g_p 5y ago

One issue in the critical infrastructure space is that many of these MFA solutions are less robust and resilient than no MFA. Anything based on calling out to an external service (Duo, for example) is likely to be less resilient [1] than the static, no-external-dependencies system they use for plain password Auth. Clearly moving towards complex systems like RADIUS and SAML introduce even more moving parts that sit with interconnects between trusted and untrusted, internal and external components. That becomes a point of failure in the eyes of infrastructure companies. The challenge here seems to be getting the IT world to understand the focus on availability in critical infrastructure - historically, the focus has been on availability first, integrity second, confidentiality third. You could argue this shouldn't apply to VPN interfaces in to manage systems, but given the external dependencies of these systems, they feel far less likely to remain available than the kind of solutions the sector expects. On a separate note though, critical infrastructure need to re-think their budgets to pay for their increased availability needs, given most of the commercial solutions are third party hosted "as a service" offerings. [1] https://status.duo.com/history?page=2 https://status.duo.com/history?page=2

goodoldneon 5y ago
Unavailability of Duo’s MFA product is extremely rare. But when it does happen, IT admins can switch to “bypass” mode to only require the 1st factor. So even though Duo doesn’t have 100% uptime, you’re no worse than no MFA
- g_p 5y ago
  Scrolling through their incident feed, it seems to be a bit more frequent than "extremely rare". Remember that critical industry is a sector where patching software is viewed as risky, because changing anything when it works is seen as unnecessary, and would often have weeks or months of pre-deployment testing. They work on a different time-base to the IT world. The ability to do a "bypass" is nice in theory, but the need for this option will resonate with the "old guard", who will be able to use this external dependency to keep it out. Personally I prefer smartcard-based solutions for MFA, since you can do all verification offline without requiring any third party to inject themselves into the chain. I found a good example of a vulnerability this year in Duo that just shows their validation logic is complex enough that one user was able to pass 2FA as another user [1]. That's probably your second worst case scenario, with the worst being an outsider being able to pass 2FA. A well-implemented smartcard scheme shouldn't fail in this way, as you're distributing validation logic to each device, rather than centralising it and relying on a "trusted outsider" to give a "yes or no". [1] https://sensepost.com/blog/2021/duo-two-factor-authentication-bypass/ https://sensepost.com/blog/2021/duo-two-factor-authenticatio...

antattack 5y ago

They also failed to deactivate account that was no longer in use and/or have a policy for disabling stale accounts.

karmicthreat 5y ago

It gets to be difficult to constantly come back to management for money at a small company. The MFA/Identity services want 3-12$/user. EDR wants 4-12$/user. Phishing training, same. VPN (fortinet in my case) same. The 57$/User of MS E5 is starting to look like a steal.

kevin_b_er 5y ago

And disused account, which probably means an employee who left.

gabereiser 5y ago
This. Have a solid offboarding checklist that includes VPN credentials or any access to systems that employee might have. At this point I don’t have any sympathy for the hacked when it’s as simple as this.
- agsamek 5y ago
  The offboarding checklist is not enough. You should have regular cleanup procedures which synchronize accesses with the main source of truth as well. There are too many exceptions and just human errors for a time constrained checklist execution to be enough. Checklist is a 90% solution which might help here. Or it might have been the case where the checklist failed.
- rorykoehler 5y ago
  It’s nearly always as simple as this. I got flamed on here for suggesting that Twitter just needs to follow NIST or similar standards to avoid the hack they had last year instead of hitting expert security researchers.
- ed25519FUUU 5y ago
  Invalidating credentials should be a one-stop-shop action. There shouldn’t be “invalidate their email, invalidate their VPN, invalidate their corporate login...”
  - gabereiser 5y ago
    Exactly. If everything is based on SAML SSO this is easy. If you manage multiple user databases for access control it’s a bit harder.
- mac-chaffee 5y ago
  This is a requirement for ISO 27002. Just had to implement an offboarding checklist recently.

deleted 5y ago

[deleted]

samstave 5y ago

I'd like to subscribe to your newsletter. -- Seriously though - in your comment, you described the landscape of knowledge whereby it is EASY for any given corp to mis-step without a 'you' on staff or contract. Now, as the NSA has released in the past best practices around security and such (like how to lockdown a linux box for example) Wouldn;t it be prudent for the .gov to be able to present a salient security posture recommendation in such a format as you present above? Meaning - WHY THE FUCK DONT WE HAVE A SECURITY.GOV WEBSITE THAT STATES EXACTLY HOW TO SECURE YOUR [THING] and CLICK HERE FOR EXPERTISE ON HOW TO SO??? We are in the Digital Nuke age. We should act as such. You get the idea...

deleted 5y ago
[deleted]
Strs2FillMyDrms 5y ago
While my dentist was performing a procedure on my teeth he received a call from a former student now teacher at the university. The issue? A group of old professors chose to stop teaching a particular procedure. Reason? Market prices of that procedure had began to be driven down by competing professionals. She sounded so disappointed, as she should. Never underestimate the power of greed against the well being of everyone else.
- breakfastduck 5y ago
  Appreciate your point but it's quite possibly the most 'USA' comment I've ever read. Lets stop assuming these things happen elsewhere to the same greed fueled extent.
  - 1vuio0pswjnm7 5y ago
    Dentists outside the USA do this, too. I once had a dentist outside the US even admit this to me. She seemed embarassed by her former classmates from dental school who were operating this way.
  - mardifoufs 5y ago

fukmbas 5y ago

SaaS VPN is the dumbest thing I've ever heard of

hsbauauvhabzb 5y ago

MFA doesn’t solve targeted phishing and that’s something people keep forgetting. Sprays are just the best ROI, but if everything had MFA it would quickly create a phishing as a service business model.

gruez 5y ago
>MFA doesn’t solve targeted phishing and that’s something people keep forgetting. any VPNs support u2f?
- vladvasiliu 5y ago
  While not U2F but pretty close for the issue at hand (preventing phishing), any VPN that supports radius as a backend can use Windows NPS which can be integrated with Azure AD MFA to send a notification to the phone. You may still want to train the users not to accept any random request on the app, though. But this works (fairly) well and is cheap (no hardware token to buy). https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension https://docs.microsoft.com/en-us/azure/active-directory/auth...
  - tialaramex 5y ago
    Phone confirmation doesn't evade phishing. The user doesn't think the request they just got on the app is "random" because they think they're doing the right thing. The whole idea of phishing is to trick the human user.
- mdeeks 5y ago
  Tailscale should (indirectly) with 3rd party Google/Okta/Etc auth.
- galuano1 5y ago
  Cisco VPN does.
foxpurple 5y ago
If you use the physical tokens it does solve that because the tokens won’t authenticate on the scammer site.