4 ms·

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer

Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems

bombcar 4y ago
Someone forgot the “and then watch that basket” part about putting all your eggs in one.
gnu8 4y ago
> - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic This is gross incompetence.
toomuchtodo 4y ago
Thycotic and Centrify have been rolled up into Delinea fwiw. https://delinea.com/ https://delinea.com/
- gnu8 4y ago
  It's just multiuser keepass with integrations for active directory and such. It's not surprising that three startups building the same thing would realize they could merge and charge 10x the price they could get if they were competing. Since Delinea's rep just took a hit (due to customer error), there is easily room for two or three new players in this space.
galacticaactual 4y ago
Thoroughly basic and preventable attack.
Shank 4y ago
> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it's behind a VPN, because you now have to hope and pray all of your VPN users aren't bribable, aren't morally bankrupt, aren't disgruntled, etc. The same thing could have happened via insider from the lowest level of employee with VPN access if that report is true.
- hardnose 4y ago
  Ding ding ding. This whole incident is symptomatic of eggshell security - crunchy exterior with a delicious gooey inside once you break through it. Hedgehogs dont have this problem.
- staticassertion 4y ago
  People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.
  - Shank 4y ago
    I was recently on a call with someone who said their company was "totally zero-trust" because they disabled copy & paste on all workstations. I definitely believe in the concept, but it's definitely turning into a parroted term that's applied to anything.
  - jjav 4y ago
    > People who call ZTN a meme are usually just ignorant. It's become a "meme" because it is used in endless irrelevant ways. So many companies are pushing zero-trust solutions that don't have anything to do with the basic idea of requiring access control at every endpoint. Also, while it is a very sound practice, there's also the hyped idea that it replaces everything else. Which is not very wise. You still want defense in depth over and above requiring acess control everywhere.
colemannugent 4y ago
>scan their intranet and find a network share Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol I can't wait for the post-mortem, hopefully lots of good lessons to learn.
- judge2020 4y ago
  >scan their intranet and find a network share Assuming screenshot is real[0], they have over 1PB in their Google Drive, so chances are everyone just uses Google Drive with shared drives, and employees use Drive for Desktop (previously drive file stream)[1]. Shared drives are pretty powerful and access to them can be gated at the same level as you can regular Drive files. My theory is that some high-level IT person either got phished and didn't have hardware 2fa, or that high-level IT person downloaded malware / got RAT'd and the Google Drive scanning was done in the background on their machine. Depending on the hierarchy, it might not have even been a scan, could've been the attackers sating their curiosity by browsing through all their internal files and happening to find some PAM credentials. 0: https://twitter.com/praise_terryd/status/1570583105123258369?s=20 https://twitter.com/praise_terryd/status/1570583105123258369... 1: https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cwindows https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cw...
- dx034 4y ago
  Maybe just clicking around until they found something. That's what many employees do on a daily basis looking for files on network drives, so nothing that would be noticed easily.
marcinzm 4y ago
>Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Even using certificate based authentication for VPN along with their existing MFA would have prevented this. Unless the attacker compromised the employee's laptop in which case nothing would stop that.
AtNightWeCode 4y ago
Assume breach. I just hate it when you can access anything on networks just cause you are logged on to it.

bombcar 4y ago

Someone forgot the “and then watch that basket” part about putting all your eggs in one.

gnu8 4y ago

> - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic This is gross incompetence.

toomuchtodo 4y ago

Thycotic and Centrify have been rolled up into Delinea fwiw. https://delinea.com/ https://delinea.com/

gnu8 4y ago
It's just multiuser keepass with integrations for active directory and such. It's not surprising that three startups building the same thing would realize they could merge and charge 10x the price they could get if they were competing. Since Delinea's rep just took a hit (due to customer error), there is easily room for two or three new players in this space.

galacticaactual 4y ago

Thoroughly basic and preventable attack.

Shank 4y ago

> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it's behind a VPN, because you now have to hope and pray all of your VPN users aren't bribable, aren't morally bankrupt, aren't disgruntled, etc. The same thing could have happened via insider from the lowest level of employee with VPN access if that report is true.

hardnose 4y ago
Ding ding ding. This whole incident is symptomatic of eggshell security - crunchy exterior with a delicious gooey inside once you break through it. Hedgehogs dont have this problem.
staticassertion 4y ago
People who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.
- Shank 4y ago
  I was recently on a call with someone who said their company was "totally zero-trust" because they disabled copy & paste on all workstations. I definitely believe in the concept, but it's definitely turning into a parroted term that's applied to anything.
- jjav 4y ago
  > People who call ZTN a meme are usually just ignorant. It's become a "meme" because it is used in endless irrelevant ways. So many companies are pushing zero-trust solutions that don't have anything to do with the basic idea of requiring access control at every endpoint. Also, while it is a very sound practice, there's also the hyped idea that it replaces everything else. Which is not very wise. You still want defense in depth over and above requiring acess control everywhere.

colemannugent 4y ago

>scan their intranet and find a network share Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol I can't wait for the post-mortem, hopefully lots of good lessons to learn.

judge2020 4y ago
>scan their intranet and find a network share Assuming screenshot is real[0], they have over 1PB in their Google Drive, so chances are everyone just uses Google Drive with shared drives, and employees use Drive for Desktop (previously drive file stream)[1]. Shared drives are pretty powerful and access to them can be gated at the same level as you can regular Drive files. My theory is that some high-level IT person either got phished and didn't have hardware 2fa, or that high-level IT person downloaded malware / got RAT'd and the Google Drive scanning was done in the background on their machine. Depending on the hierarchy, it might not have even been a scan, could've been the attackers sating their curiosity by browsing through all their internal files and happening to find some PAM credentials. 0: https://twitter.com/praise_terryd/status/1570583105123258369?s=20 https://twitter.com/praise_terryd/status/1570583105123258369... 1: https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cwindows https://support.google.com/a/answer/7491144?hl=en#zippy=%2Cw...
dx034 4y ago
Maybe just clicking around until they found something. That's what many employees do on a daily basis looking for files on network drives, so nothing that would be noticed easily.

marcinzm 4y ago

>Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Even using certificate based authentication for VPN along with their existing MFA would have prevented this. Unless the attacker compromised the employee's laptop in which case nothing would stop that.

AtNightWeCode 4y ago

Assume breach. I just hate it when you can access anything on networks just cause you are logged on to it.