5 ms·

Interesting point. Speculation that rootkitting all of your employees made the problem worse: https://twitter.com/BillDemirkapi/status/1506117152461496323 http

Interesting point. Speculation that rootkitting all of your employees made the problem worse: https://twitter.com/BillDemirkapi/status/1506117152461496323 https://twitter.com/BillDemirkapi/status/1506117152461496323

pm90 5y ago
Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times I argued with IT that MITMing SSL was not ok (there are some tools.. crowdstrike maybe? That do this). They made their bed, now they gotta sleep in it.
- unethical_ban 5y ago
  It's always interesting to hear people think they have rights on corporate networks. It is a complex issue with entry of nuance I'm too tired to thumb type. I know there are lines that shouldn't be crossed. But it is so naive to think companies shouldn't have an eye on their data. Do you think banks shouldn't have cameras in their lobbies? Or that tellers can walk in and out of the vault with black bags and no one ask what's inside?
  - morbia 5y ago
    I don't think the OP's point was about rights as an individual on a corporate network, more about trying to backdoor your staff's equipment and the consequences of that. To use your camera analogy, you better have a good lock on the security room holding the tapes.
- bitwize 5y ago
  MITMing SSL is also Zscaler's MO, and guess what my job is preparing to mandate. Organizational endpoint security seems to be much more about incident response than incident prevention. That is, it's more focused on providing a nice audit trail that can be used to find and fire/arrest the perp once a breach occurs than it is at preventing breaches from happening. It probably fills a due-diligence tickbox somewhere, allowing the company to say "if a breach occurs (the probability of which is always nonzero) then we have measures in place to find out how, where, and by whom and mitigate the damage" to shareholders and important customers.
  - unixhero 5y ago
    It is not an audit tickbox. It is barriers on the right side of the bowtie, and in the RECOVER dimension of NIST. Here you go: https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie.png?w=1024 https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie....
- unixhero 5y ago
  I work in corporate security. It's a great gig! MITMing SSL is something I refuse to implement, and argue against in every forum I attend.
_wldu 5y ago
Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise. Software diversity is good. Remotely controlled mono-cultures are bad. IT management and security compliance people need to understand this. I liken the mindset of (only we will use the remote control software to do good things) to Encryption back doors (only law enforcement will use them to catch criminals). Computer scientists call these 'Exceptional Access Systems' and it has been shown (many times) that it is impossible to ensure they will not be abused and used against you. Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications: https://dspace.mit.edu/handle/1721.1/97690 https://dspace.mit.edu/handle/1721.1/97690
- bogantech 5y ago
  > Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise. What alternatives are there? I honestly don't know
  - ownagefool 5y ago
    It's not really about alternatives, what would the spyware stop that a simple Daemon that version checks your device won't? If you're working from home and your device gets owned, and the attacker just sits there slowly slurping data as you go about your business... Chances are you're not going to detect it, but if you did you'd probably notice it's running when it's not supposed to and it's sending network traffic when not actively used. If someone uses a laptop breach to go look at data you wouldn't normally look at ( or tons of records ) an audit log would give that away. So really to do security well you have to profile the role. Why are you looking up customer record abc123? Trying to see what your girlfriends doing, or is it because they've called the customer support line? You basically have to define what does misuse look like and protect for that. Back on the slow slurp, hardend immutable devices that are regularly updated with limited Auth sessions would likely contain the breach. Same deal on servers, you harder to stop it, but you monitor for when it happens. Do people really monitor though? Some, sure, but your average org buys a tool the fails configure it with any sort of context.
xvector 5y ago
In security engineering there's this subculture of individuals that just implicitly trust every vendor that offers a solution because that means they don't have to do their own research on the issue. And if anything goes wrong, just blame the vendor! I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security. For God's sake, I had to explain what end-to-end-encryption was to a team of "senior" security engineers the other day. They genuinely had no concept of it. As a security SWE I am so done with these sort of people. Fuck them! Why are they even in security!? Real private data is at risk because of their incompetency!
- indigodaddy 5y ago
  Many of them the extent of their knowledge is: push a button and run a scan and tell an App or Infra Team: here are your vulnerabilities now fix them. Ask them to dive in a little deeper with you on the vulnerability (Eg past the entry in the spreadsheet they gave you) and they often don’t have the technical ability to do so..
- jjeaff 5y ago
  It is rather appalling. I recently listened to a podcast about a police station in a small city that was compromised and all their data ransomed. They had a contract company that handled all their cyber security needs. The "security" company had an RDP port open to the world to an admin account on the server that ran everything for the police station and city. In order to protect the employees webmail, they required that you login from an internal IP and so they gave this admin remote desktop account credentials to employees that needed to check their email remotely. They could login to the server with the admin account and then use the browser on the server to log in to their webmail. The same set of root admin credentials was given to every employee. It's just insanity. And I'm sure that government contractor was hella expensive.
  - username190 5y ago
    In case others are curious, that (probably) was Episode 96[0] of the "Darknet Diaries" podcast. Very worth a listen IMO. [0] https://darknetdiaries.com/episode/96/ https://darknetdiaries.com/episode/96/
dantillberg 5y ago
Bill Demirkapi posted an update later that this earlier assumption was perhaps incorrect [0]. It seems an internet-routable RDP server at rdp.chrisro.fun ("chrisro" is apparently named after the specific Okta employee/contractor whose name is visible in screenshots) is a more likely vector for compromise. 0: https://twitter.com/BillDemirkapi/status/1506123471352438784 https://twitter.com/BillDemirkapi/status/1506123471352438784

pm90 5y ago

Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times I argued with IT that MITMing SSL was not ok (there are some tools.. crowdstrike maybe? That do this). They made their bed, now they gotta sleep in it.

unethical_ban 5y ago
It's always interesting to hear people think they have rights on corporate networks. It is a complex issue with entry of nuance I'm too tired to thumb type. I know there are lines that shouldn't be crossed. But it is so naive to think companies shouldn't have an eye on their data. Do you think banks shouldn't have cameras in their lobbies? Or that tellers can walk in and out of the vault with black bags and no one ask what's inside?
- morbia 5y ago
  I don't think the OP's point was about rights as an individual on a corporate network, more about trying to backdoor your staff's equipment and the consequences of that. To use your camera analogy, you better have a good lock on the security room holding the tapes.
bitwize 5y ago
MITMing SSL is also Zscaler's MO, and guess what my job is preparing to mandate. Organizational endpoint security seems to be much more about incident response than incident prevention. That is, it's more focused on providing a nice audit trail that can be used to find and fire/arrest the perp once a breach occurs than it is at preventing breaches from happening. It probably fills a due-diligence tickbox somewhere, allowing the company to say "if a breach occurs (the probability of which is always nonzero) then we have measures in place to find out how, where, and by whom and mitigate the damage" to shareholders and important customers.
- unixhero 5y ago
  It is not an audit tickbox. It is barriers on the right side of the bowtie, and in the RECOVER dimension of NIST. Here you go: https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie.png?w=1024 https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie....
unixhero 5y ago
I work in corporate security. It's a great gig! MITMing SSL is something I refuse to implement, and argue against in every forum I attend.

_wldu 5y ago

Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise. Software diversity is good. Remotely controlled mono-cultures are bad. IT management and security compliance people need to understand this. I liken the mindset of (only we will use the remote control software to do good things) to Encryption back doors (only law enforcement will use them to catch criminals). Computer scientists call these 'Exceptional Access Systems' and it has been shown (many times) that it is impossible to ensure they will not be abused and used against you. Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications: https://dspace.mit.edu/handle/1721.1/97690 https://dspace.mit.edu/handle/1721.1/97690

bogantech 5y ago
> Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise. What alternatives are there? I honestly don't know
- ownagefool 5y ago
  It's not really about alternatives, what would the spyware stop that a simple Daemon that version checks your device won't? If you're working from home and your device gets owned, and the attacker just sits there slowly slurping data as you go about your business... Chances are you're not going to detect it, but if you did you'd probably notice it's running when it's not supposed to and it's sending network traffic when not actively used. If someone uses a laptop breach to go look at data you wouldn't normally look at ( or tons of records ) an audit log would give that away. So really to do security well you have to profile the role. Why are you looking up customer record abc123? Trying to see what your girlfriends doing, or is it because they've called the customer support line? You basically have to define what does misuse look like and protect for that. Back on the slow slurp, hardend immutable devices that are regularly updated with limited Auth sessions would likely contain the breach. Same deal on servers, you harder to stop it, but you monitor for when it happens. Do people really monitor though? Some, sure, but your average org buys a tool the fails configure it with any sort of context.

xvector 5y ago

In security engineering there's this subculture of individuals that just implicitly trust every vendor that offers a solution because that means they don't have to do their own research on the issue. And if anything goes wrong, just blame the vendor! I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security. For God's sake, I had to explain what end-to-end-encryption was to a team of "senior" security engineers the other day. They genuinely had no concept of it. As a security SWE I am so done with these sort of people. Fuck them! Why are they even in security!? Real private data is at risk because of their incompetency!

indigodaddy 5y ago
Many of them the extent of their knowledge is: push a button and run a scan and tell an App or Infra Team: here are your vulnerabilities now fix them. Ask them to dive in a little deeper with you on the vulnerability (Eg past the entry in the spreadsheet they gave you) and they often don’t have the technical ability to do so..
jjeaff 5y ago
It is rather appalling. I recently listened to a podcast about a police station in a small city that was compromised and all their data ransomed. They had a contract company that handled all their cyber security needs. The "security" company had an RDP port open to the world to an admin account on the server that ran everything for the police station and city. In order to protect the employees webmail, they required that you login from an internal IP and so they gave this admin remote desktop account credentials to employees that needed to check their email remotely. They could login to the server with the admin account and then use the browser on the server to log in to their webmail. The same set of root admin credentials was given to every employee. It's just insanity. And I'm sure that government contractor was hella expensive.
- username190 5y ago
  In case others are curious, that (probably) was Episode 96[0] of the "Darknet Diaries" podcast. Very worth a listen IMO. [0] https://darknetdiaries.com/episode/96/ https://darknetdiaries.com/episode/96/

dantillberg 5y ago

Bill Demirkapi posted an update later that this earlier assumption was perhaps incorrect [0]. It seems an internet-routable RDP server at rdp.chrisro.fun ("chrisro" is apparently named after the specific Okta employee/contractor whose name is visible in screenshots) is a more likely vector for compromise. 0: https://twitter.com/BillDemirkapi/status/1506123471352438784 https://twitter.com/BillDemirkapi/status/1506123471352438784