3 ms·

The servers that were attacked weren't the actual exchange server but the servers for Director's Desk. To be frank, it's a logistical nightmare to keep all you

The servers that were attacked weren't the actual exchange server but the servers for Director's Desk. To be frank, it's a logistical nightmare to keep all your servers completely patched to the very latest patch level, so "unpatched" is really non-descriptive. Was it vanilla W2K3 or was it a couple of months old? I would imagine most servers that run Windows that house mission critical services is at least 1 month unpatched, because it takes time to test the patches to make sure it doesn't cause problems, so the title is a bit misleading. I've had customers that had a window of 8 hrs per quarter to upgrade their mission critical servers for any reason (upgrading OS, upgrading software, etc), so I can imagine they would have been considered "unpatched" as well. That being said, there's no excuse for misconfigured firewalls. You would have thought the 10 companies they hired for security would have noticed this, but I guess they were just feeding from the trough.

tptacek 15y ago
(We've never done work with NASDAQ). It is extraordinarily rare for talented security firms (which tend to be --- no, wait, are invariably boutique operations) to get true site-wide discover- audit- recommend- retest- repeat-til-fixed projects. The closest approximation that boutique firms get regularly are "sitewide pentests", which compromise the objective you're talking about by (a) timeboxing the project (and particularly the earlier discovery phase of the project), (b) deliberately hiding information from the team (often in the name of "judging what attackers would find in the real world") and (c) if retesting is part of the project, its one cycle. While large companies use sitewide pentests as their "once a year do the whole network" project, the reality is that these projects are designed first to prove that it's possible to pop the network (it always is), second to provide a triaged list of "most glaring" security flaws, and only lastly as a true survey of all the weaknesses on the network. This makes sense, because the true survey would cost 5-10x more, involve weeks (not days) of discovery, doc review, and staff interviews, and take many months to run start-to-finish. There's a lot of value in sitewide pentests (I think past a certain size every company should do them every year), but a lot of people have unrealistic expectations about what they can really accomplish. For most companies, if you're going to need to catch things like "one unpatched Win2k3 server in an obscure application cluster from a company you bought 5 years ago", you're going to have to match the external consultant pentest with a very focused very diligent very well-designed internal security effort designed from the outset understanding the limitations of pentesting projects. My perception is that larger security firms do in fact get the all-singing all-dancing sitewide audit/fix projects, but those companies often are just feeding at the trough, sending people with no real talent for the work to bill lots of hours. It's also, frankly, hard to get talented people excited about spending months reviewing firewall rules.
- steve8918 15y ago
  It's sad to see that most companies don't really care about security, they care about securing their own jobs by covering their ass. This pentest that you talk about sounds exactly like that, just enough to cover his-or-her ass when the shit hits the fan but doesn't solve the problem. "See, I followed procedures and got the audit, and we fixed the top 5 most critical things. It's not my fault. How were we to know that the hackers would break in using the 15th thing in the list?" I guess there's not much we can do about this, it seems ingrained in our culture these days, at least in the larger corporations. I know a bunch of Big 4 public auditors and some of the stories I would hear sounded like outright fraud. I would point that out, and they would say "Public auditors aren't in the business to detect fraud. We are only supposed to ensure that whatever gets published is accurate." The same goes for the financial "controls" that were supposed to be put in place with SarBox. Higher-level directors are supposed to sign off every quarter or every year that certain financial procedures are done, but they robosign the forms because they don't care. It's only when the shit hits the fan and people start scratching beneath the surface that everyone realizes that nothing is actually working as it's supposed to.
  - yuhong 15y ago
    Yea, a cover-up culture, as it often is called.
ldar15 15y ago
SA: We need to patch the servers against critical vulnerabilities. PHB: Well you can only bring the system down for 8 hours per quarter. SA: That's not enough time. PHB: I dont care, I have a business to run! You: Well it was ok for my boss, so I guess its Ok for NASDAQ. It just the reality of running Windows. File under, "Space Shuttle, O-Rings, Business Requirements override Technical Reality, What Could Possible Go Wrong", Dept.

tptacek 15y ago

(We've never done work with NASDAQ). It is extraordinarily rare for talented security firms (which tend to be --- no, wait, are invariably boutique operations) to get true site-wide discover- audit- recommend- retest- repeat-til-fixed projects. The closest approximation that boutique firms get regularly are "sitewide pentests", which compromise the objective you're talking about by (a) timeboxing the project (and particularly the earlier discovery phase of the project), (b) deliberately hiding information from the team (often in the name of "judging what attackers would find in the real world") and (c) if retesting is part of the project, its one cycle. While large companies use sitewide pentests as their "once a year do the whole network" project, the reality is that these projects are designed first to prove that it's possible to pop the network (it always is), second to provide a triaged list of "most glaring" security flaws, and only lastly as a true survey of all the weaknesses on the network. This makes sense, because the true survey would cost 5-10x more, involve weeks (not days) of discovery, doc review, and staff interviews, and take many months to run start-to-finish. There's a lot of value in sitewide pentests (I think past a certain size every company should do them every year), but a lot of people have unrealistic expectations about what they can really accomplish. For most companies, if you're going to need to catch things like "one unpatched Win2k3 server in an obscure application cluster from a company you bought 5 years ago", you're going to have to match the external consultant pentest with a very focused very diligent very well-designed internal security effort designed from the outset understanding the limitations of pentesting projects. My perception is that larger security firms do in fact get the all-singing all-dancing sitewide audit/fix projects, but those companies often are just feeding at the trough, sending people with no real talent for the work to bill lots of hours. It's also, frankly, hard to get talented people excited about spending months reviewing firewall rules.

steve8918 15y ago
It's sad to see that most companies don't really care about security, they care about securing their own jobs by covering their ass. This pentest that you talk about sounds exactly like that, just enough to cover his-or-her ass when the shit hits the fan but doesn't solve the problem. "See, I followed procedures and got the audit, and we fixed the top 5 most critical things. It's not my fault. How were we to know that the hackers would break in using the 15th thing in the list?" I guess there's not much we can do about this, it seems ingrained in our culture these days, at least in the larger corporations. I know a bunch of Big 4 public auditors and some of the stories I would hear sounded like outright fraud. I would point that out, and they would say "Public auditors aren't in the business to detect fraud. We are only supposed to ensure that whatever gets published is accurate." The same goes for the financial "controls" that were supposed to be put in place with SarBox. Higher-level directors are supposed to sign off every quarter or every year that certain financial procedures are done, but they robosign the forms because they don't care. It's only when the shit hits the fan and people start scratching beneath the surface that everyone realizes that nothing is actually working as it's supposed to.
- yuhong 15y ago
  Yea, a cover-up culture, as it often is called.

ldar15 15y ago

SA: We need to patch the servers against critical vulnerabilities. PHB: Well you can only bring the system down for 8 hours per quarter. SA: That's not enough time. PHB: I dont care, I have a business to run! You: Well it was ok for my boss, so I guess its Ok for NASDAQ. It just the reality of running Windows. File under, "Space Shuttle, O-Rings, Business Requirements override Technical Reality, What Could Possible Go Wrong", Dept.