3 ms·

Can anyone comment on what the value of this attack is to the attackers?

by zepto 5y ago

aynyc 5y ago
One of the companies I know use it for HR, payroll and account receivables. If you hack into that, you can get a lot of information.
- zepto 5y ago
  How would that information be useful?
  - aynyc 5y ago
    Everything from identify theft, to phishing to industrial espionage.
plaidfuji 5y ago
Arbitrary code execution in an on-premise server? You can basically stage an attack on any other internal resources (core infrastructure, databases, endpoints) that are visible from there, with the benefit of already being behind at least one layer of firewall/security.
- zepto 5y ago
  > Arbitrary code execution in an on-premise server? That doesn’t explain what the benefit of the attack is. It just explains that it’s an effective attack.
  - CRConrad 5y ago
    How is anybody supposed to be able to answer that question, then? It obviously depends on what other services are running on that server, and what your cracked account has access to. Access the janitor's account on the facilities Jira, which is all that runs on an old Pentium II in the broom cupboard and you get one set of benefits; access the CFO's on the Big Money Server and you get something else entirely. How on Earth did you manage not to realise this by yourself?
tgsovlerkhgsel 5y ago
At the very basic, almost any attack can be monetized through resources (crypto mining, DDoS-as-a-service, selling access to the machines to other criminals) or extortion (ransomware, threatening to expose data), at scale and without the attackers really having to care too much what they hit. If they devote more time per target, they can also go after specific data, e.g. for espionage or insider trading. One compromised server can also serve as a foothold ("oh, you have a service account with all permissions on that server? nice!") which then allows all of the above to be launched against a bigger part of the infrastructure.

Can anyone comment on what the value of this attack is to the attackers?

by zepto 5y ago

Can anyone comment on what the value of this attack is to the attackers?

One of the companies I know use it for HR, payroll and account receivables. If you hack into that, you can get a lot of information.

zepto 5y ago
How would that information be useful?
- aynyc 5y ago
  Everything from identify theft, to phishing to industrial espionage.

plaidfuji 5y ago

Arbitrary code execution in an on-premise server? You can basically stage an attack on any other internal resources (core infrastructure, databases, endpoints) that are visible from there, with the benefit of already being behind at least one layer of firewall/security.

zepto 5y ago
> Arbitrary code execution in an on-premise server? That doesn’t explain what the benefit of the attack is. It just explains that it’s an effective attack.
- CRConrad 5y ago
  How is anybody supposed to be able to answer that question, then? It obviously depends on what other services are running on that server, and what your cracked account has access to. Access the janitor's account on the facilities Jira, which is all that runs on an old Pentium II in the broom cupboard and you get one set of benefits; access the CFO's on the Big Money Server and you get something else entirely. How on Earth did you manage not to realise this by yourself?

tgsovlerkhgsel 5y ago

At the very basic, almost any attack can be monetized through resources (crypto mining, DDoS-as-a-service, selling access to the machines to other criminals) or extortion (ransomware, threatening to expose data), at scale and without the attackers really having to care too much what they hit. If they devote more time per target, they can also go after specific data, e.g. for espionage or insider trading. One compromised server can also serve as a foothold ("oh, you have a service account with all permissions on that server? nice!") which then allows all of the above to be launched against a bigger part of the infrastructure.