4 ms·

I've been inspecting their dumps since the iPhone X leaks. As it turns out, they got access to huawei, apple, nvidia, samsung, microsoft bing/maps/notes and pr

I've been inspecting their dumps since the iPhone X leaks. As it turns out, they got access to huawei, apple, nvidia, samsung, microsoft bing/maps/notes and probably (unconfirmed) vodafone, lge, impresa, mercadolibre and others. They actively infiltrate organizations with Windows monoculture that never updates, most exploits they seem to have used were running on _really_ outdated systems that are targeting enterprise monoculture as well, like atlassian software, and pretty much everything with an ADS integration. As I commented previously, it's likely that the SOCs (Security Operations Center) are part of this, too, because _if the certification_ of the targeted organizations isn't utter BS, then they must have caught an incident like this. A server transferring more than 200GB to a single IP? C'mon, firewalls of the 90s detected that. They also shamed okta in response to their blog post a lot for having wrong security in place, aka publicly accessible slack channels that have more than ~9k members, where even AWS secrets are posted regularly. I mean, attack scenarios like this are bound to happen when management decides it's cheaper to hire an external SOC with VPN access for everything. As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change. Better laws have to be written to enforce the incentive, because clearly, even Microsoft was too late to catch them in the act. This is what you get for being "cloud native" and there's no way to prevent it. Infrastructure out of your control has to be treated as such, everyone in cybersec was talking about the dangers of using AWS and hire SOCs and external support teams from India for decades already, and nobody listened.

kingcharles 5y ago
200GB is nothing these days though. I'm on a cell connection and I move that a day.
- cookiengineer 5y ago
  If a single IP produces that much traffic to a build system, and is an external resident IP...it's 100% either a DDoS attempt or a malicious actor that is in the process of exfiltrating data. There's not a single scenario where a traffic this size to an internal buildbot machine to/from a single unknown resident IP is legit.
- sennight 5y ago
  You download 18.51 megabits per second over a cellular connection for 24 hours straight? Do you really? Because somebody, either you or your service provider, is doing it wrong.
  - sjmm1989 5y ago
    There are ways... I've taken multiple cellphone connections and sorta merged their connections using a hacky workaround in windows to force it to happen even without a proper setting for it. (Note: Not a bridge. Merged. Sorta.) Just setup each phone as a shared access point through multiple usb ports and let er rip. After doing what I was mentioning though that is. It's rather simple too, but I don't know how best to explain how it works. BUT I can tell you what I did. I disable and re-enable each connection one after the other back and forth multiple times until they all are send and receiving data at the same time. This seems to work best when there is already an active connection going. I would use this for Steam downloads a lot. And yes, all my files I send and receive this way would come and go proper and working. I was doing this back when cell speeds were more like 3mbit/second out in the rural areas. That kind of thing. So getting 10mbit out in the boonies was like living in the city all of a sudden.
  - senectus1 5y ago
    nah, i know people that abuse the crap out of 4G/5G from their home cell network all the time. they would use a terrestrial connection but the National Broadband Network in Australia is arguably incomplete (putting aside the parts that are supposed to be complete are often very crap). One of my workmates lives 25 mins drive from the WA capital city CBD and has just recently bought Starlink because he couldn't get fast enough or reliable enough internet speeds at home for WFH purposes (Ms Teams is bad but not THAT BAD)
    - sjmm1989 5y ago
      For a moment there I thought you and sennight were the same user. Heh. Yeah, Canada is pretty bad too when it comes to having the last mile rolled out to every last town and village. We have tower based internet for those usually. If you are really out in the boonies, you might have something based on Xplornet's tech. Having starlink is only a new thing recently; and that's apparently touch and go for people as well. Ironically, if you don't play video games at all, Cellular is the best kind of connection you can get out there in some places. Otherwise, get a dish and point it at the nearest tower. It's still basically a giant wifi connection at that point, so the latency will not be the best; but it's far better than Xplornet or cellular ever will be on that front. The only thing better than tower, is a proper line going to the house. One of my old homes was supposed to have said line installed to that town as part of a province wide thing going on at the time. Sasktel was supposed to get EVERYONE connected with cable and internet... That never happened. They stuck to the cities and bigger towns close to the backbone, and that was it. They then sold access to companies putting up towers and said "that's a wrap". That said... they had to contend with the rail lines to get past them on multiple occasions, and that gets expensive.
agnokapathetic 5y ago
I missed the Apple LAPSUS$ leak, do you have a link?
- cookiengineer 5y ago
  Does this work? :D https://t.me/minsaudebr/54?single https://t.me/minsaudebr/54?single In the channel they posted lots of specs and design documents from the iPhone X. So technically it could also have been a vendor in the supply chain (as of now). They announced a leak at the time, but deleted the torrent files in their posts/comments a couple times and I was too late to verify. (I'm in European time zone, they are in Brazil).
shp0ngle 5y ago
What does SOC stands for here? (Clearly not system on chip)
- cookiengineer 5y ago
  Oh, sorry. Security Operations Center. They're basically the ones watching alert dashboards like suricata all day, investigating issues and trying to isolate systems that have been compromised. So they're the operational part of an IT security department. Sometimes they're also called CSIRT.
  - Datagenerator 5y ago
    Frequently combined as SOC / SIEM, the acronym for Security Information and Event Management. Dataflow analysis can be provided by for example Cisco Smart Network Application (SNA). A system that displays an overview of the network topology including detailed monitoring information for devices and traffic.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
deleted 5y ago
[deleted]
dhruvrrp 5y ago
None of the issues here are related to being cloud native. If you are completely on-prem, but your employees are remote the same social engineering attacks would work on your organization. The issue is with companies having absolutely garbage security practices.
- oh_sigh 5y ago
  I thought it was interesting that neither Facebook nor Google were listed
- cookiengineer 5y ago
  While I agree with the sentiment there, lapsus didn't get initial access via social engineering. They used social engineering to stay ahead of detection. My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.
  - sofixa 5y ago
    There are VPC flow logs for all things in a VPC.
  - bijoo 5y ago
    > My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services." Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoint-services-gwlbe.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
  - milkshakes 5y ago
    this is dangerously incorrect
aahortwwy 5y ago
> As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change. Security shouldn't be exempt from ROI concerns, that's bizarre. Governments should regulate more, to make good security have a positive ROI. Or introduce criminal liability, I suppose.
JamesonNetworks 5y ago
"A server transferring more than 200GB to a single IP? C'mon, firewalls of the 90s detected that." Do you have examples of firewalls that support this and setup guides? I'm using pfSense but haven't come across anything that would flag traffic in this manner. There is snort I guess? Just curious. Always looking to improve my own protection :)
- adrian_b 5y ago
  I am using the FreeBSD firewall, which is simpler than pfSense, so I am pretty certain that this must be possible in most, if not all, firewalls. For any rule of the firewall, which may match any kind of traffic, you may set the rule to update a counter. The values of the counters will accumulate the total quantity of data transferred until the counters are reset (periodically), and you may choose to store the values in a log for later inspection or you can use a shell script to interrogate the firewall periodically and compare the counter values with thresholds and send alerts when they are exceeded. As long as the firewall rules include the option for a "count" or similar action, which I believe to be available in all of them, then you can use the firewall to monitor the amount of data that passes through the network. Even when a firewall does not provide the length of the packets, just counting the number of packets is enough to estimate the maximum amount of data that might have been transferred, because you know the maximum packet sizes on your interfaces.
- GartzenDeHaes 5y ago
  As I recall, this is on the default Palo Alto dashboard. https://www.paloaltonetworks.com/ https://www.paloaltonetworks.com/ Note, this is a $6 figure firewall, so it doesn't compare to something like pfSense.

kingcharles 5y ago

200GB is nothing these days though. I'm on a cell connection and I move that a day.

cookiengineer 5y ago
If a single IP produces that much traffic to a build system, and is an external resident IP...it's 100% either a DDoS attempt or a malicious actor that is in the process of exfiltrating data. There's not a single scenario where a traffic this size to an internal buildbot machine to/from a single unknown resident IP is legit.
sennight 5y ago
You download 18.51 megabits per second over a cellular connection for 24 hours straight? Do you really? Because somebody, either you or your service provider, is doing it wrong.
- sjmm1989 5y ago
  There are ways... I've taken multiple cellphone connections and sorta merged their connections using a hacky workaround in windows to force it to happen even without a proper setting for it. (Note: Not a bridge. Merged. Sorta.) Just setup each phone as a shared access point through multiple usb ports and let er rip. After doing what I was mentioning though that is. It's rather simple too, but I don't know how best to explain how it works. BUT I can tell you what I did. I disable and re-enable each connection one after the other back and forth multiple times until they all are send and receiving data at the same time. This seems to work best when there is already an active connection going. I would use this for Steam downloads a lot. And yes, all my files I send and receive this way would come and go proper and working. I was doing this back when cell speeds were more like 3mbit/second out in the rural areas. That kind of thing. So getting 10mbit out in the boonies was like living in the city all of a sudden.
- senectus1 5y ago
  nah, i know people that abuse the crap out of 4G/5G from their home cell network all the time. they would use a terrestrial connection but the National Broadband Network in Australia is arguably incomplete (putting aside the parts that are supposed to be complete are often very crap). One of my workmates lives 25 mins drive from the WA capital city CBD and has just recently bought Starlink because he couldn't get fast enough or reliable enough internet speeds at home for WFH purposes (Ms Teams is bad but not THAT BAD)
  - sjmm1989 5y ago
    For a moment there I thought you and sennight were the same user. Heh. Yeah, Canada is pretty bad too when it comes to having the last mile rolled out to every last town and village. We have tower based internet for those usually. If you are really out in the boonies, you might have something based on Xplornet's tech. Having starlink is only a new thing recently; and that's apparently touch and go for people as well. Ironically, if you don't play video games at all, Cellular is the best kind of connection you can get out there in some places. Otherwise, get a dish and point it at the nearest tower. It's still basically a giant wifi connection at that point, so the latency will not be the best; but it's far better than Xplornet or cellular ever will be on that front. The only thing better than tower, is a proper line going to the house. One of my old homes was supposed to have said line installed to that town as part of a province wide thing going on at the time. Sasktel was supposed to get EVERYONE connected with cable and internet... That never happened. They stuck to the cities and bigger towns close to the backbone, and that was it. They then sold access to companies putting up towers and said "that's a wrap". That said... they had to contend with the rail lines to get past them on multiple occasions, and that gets expensive.

agnokapathetic 5y ago

I missed the Apple LAPSUS$ leak, do you have a link?

cookiengineer 5y ago
Does this work? :D https://t.me/minsaudebr/54?single https://t.me/minsaudebr/54?single In the channel they posted lots of specs and design documents from the iPhone X. So technically it could also have been a vendor in the supply chain (as of now). They announced a leak at the time, but deleted the torrent files in their posts/comments a couple times and I was too late to verify. (I'm in European time zone, they are in Brazil).

shp0ngle 5y ago

What does SOC stands for here? (Clearly not system on chip)

cookiengineer 5y ago
Oh, sorry. Security Operations Center. They're basically the ones watching alert dashboards like suricata all day, investigating issues and trying to isolate systems that have been compromised. So they're the operational part of an IT security department. Sometimes they're also called CSIRT.
- Datagenerator 5y ago
  Frequently combined as SOC / SIEM, the acronym for Security Information and Event Management. Dataflow analysis can be provided by for example Cisco Smart Network Application (SNA). A system that displays an overview of the network topology including detailed monitoring information for devices and traffic.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]

deleted 5y ago

[deleted]

dhruvrrp 5y ago

None of the issues here are related to being cloud native. If you are completely on-prem, but your employees are remote the same social engineering attacks would work on your organization. The issue is with companies having absolutely garbage security practices.

oh_sigh 5y ago
I thought it was interesting that neither Facebook nor Google were listed
cookiengineer 5y ago
While I agree with the sentiment there, lapsus didn't get initial access via social engineering. They used social engineering to stay ahead of detection. My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.
- sofixa 5y ago
  There are VPC flow logs for all things in a VPC.
- bijoo 5y ago
  > My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services." Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoint-services-gwlbe.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
- milkshakes 5y ago
  this is dangerously incorrect

aahortwwy 5y ago

> As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change. Security shouldn't be exempt from ROI concerns, that's bizarre. Governments should regulate more, to make good security have a positive ROI. Or introduce criminal liability, I suppose.

JamesonNetworks 5y ago

"A server transferring more than 200GB to a single IP? C'mon, firewalls of the 90s detected that." Do you have examples of firewalls that support this and setup guides? I'm using pfSense but haven't come across anything that would flag traffic in this manner. There is snort I guess? Just curious. Always looking to improve my own protection :)

adrian_b 5y ago
I am using the FreeBSD firewall, which is simpler than pfSense, so I am pretty certain that this must be possible in most, if not all, firewalls. For any rule of the firewall, which may match any kind of traffic, you may set the rule to update a counter. The values of the counters will accumulate the total quantity of data transferred until the counters are reset (periodically), and you may choose to store the values in a log for later inspection or you can use a shell script to interrogate the firewall periodically and compare the counter values with thresholds and send alerts when they are exceeded. As long as the firewall rules include the option for a "count" or similar action, which I believe to be available in all of them, then you can use the firewall to monitor the amount of data that passes through the network. Even when a firewall does not provide the length of the packets, just counting the number of packets is enough to estimate the maximum amount of data that might have been transferred, because you know the maximum packet sizes on your interfaces.
GartzenDeHaes 5y ago
As I recall, this is on the default Palo Alto dashboard. https://www.paloaltonetworks.com/ https://www.paloaltonetworks.com/ Note, this is a $6 figure firewall, so it doesn't compare to something like pfSense.