5 ms·
Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will g
by _8j50 4y ago
Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell.
The big screw up here is powershell script on a network share. A cheap pentest would have uncovered something like that.
Modern security is not perimeter focused where you try to keep the bad guys out. Yes, you should do MFA,firewalls,vpns the whole schtick but(!!) your presumption should always be that threat actors already have a foot-hold in your network. This is very important because it helps you focus on basic things like scripts and gpos with creds in them but also you treat internal devices the same as internet exposed devices. It's sort of what the whole "zero trust" thing is about as well. In other words, host/user compromise is a given but lateral movement should be at least as difficult as breaching the perimeter.
But my prediction is, just like top commenters here, they will slap MFA on it and of course cleanup scripts with creds and call it fixed until the next compromise. Oh and FYI, MFA on VPNs is a PITA, that's rarely done for good reason, instead you use device certificates in addition to passwords which is what the recommendation should be not yubikeys or webauthn (vpn!=web??) because VPNs need to reconnect and you can't have people insert a yubi each time their connection drops. Ideal setup would have 7 day valid (or however long is reasonable for users to disconnect their PC and remain out of office) mutual-auth certs+ocsp getting conditionally reissued new certs to remain connected (compliance stuff like patching, unapporoved software,security alerts for the device). If you think about it, you typically issue users two yubikeys not just one so if the backup gets stolen you have a problem depending on how easy it is to social engineer users or reset their password with a good yubikey but a stolen laptop means certs+password revoked immediately.
- philliphaydon 4y agoThere’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…
- vanshg 4y agoSo that you're protected from data breaches of the service itself (e.g. revealing a reused password)
- philliphaydon 4y agoThat doesn't have anything to do with MFA. If for some reason your 1Password masterpass is compromised, the hacker has access to your passwords and your MFA tokens. If you use 1Password and say Authy (Assuming your Authy pass isn't in 1Password) or Google Authenticator. Then all services with MFA wont be compromised if the 1Password masterpass is...
- bwoodruff 4y agoHi there! Not quite. An attacker would need either your account password AND an already authorized device, OR they would need both your account password AND Secret Key. If you have 2FA enabled for your 1Password account, and the attacker doesn't have one of your authorized devices, they would also need your second factor (TOTP or hardware key). Additionally our Principal Security Architect, Jeff Goldberg, wrote some thoughts on this subject, here: https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/ - Ben, 1Password
- philliphaydon 4y agoSo you're banking on the idea that in order to login to 1Password you need an authorized device as your layer of security.
- brianoconnor 4y agoThe benefit over SMS or Authenticator apps is that it doesn't pre-fill codes (and passwords) if the URL doesn't match. But yeah, I also have mixed feelings about it. Just slightly better than SMS maybe.
- marcosdumay 4y ago
- insanitybit 4y agoBecause auth to the VPN should have required a device cert and/ or unphishable 2FA. Also because the SMS phish was one of the first details leaked. Obviously access to the VPN shouldn't also be a full system compromise. There are many things to criticize here, we can point all of them out.
- Dowwie 4y agoI'm curious what your take is on the incident detection side of things. Would Grapl have helped Uber detect anomalies?
- _8j50 4y agoMaybe that was still required with the vpn, access vpn can also mean compromise a device, they only said yes to an attack chain someone was asking them about in the screenshot. I agree with you to the most part but at the time of posting the discussion was entirely around initial access and mfa which is not inline with how security is done these days.
- pyrale 4y agoIt is irrelevant though. If your whole multi-billion company folds like a wet towel when one user is compromised, the question isn't how that user is going to get pwned, it's when. Relevant xkcd: https://xkcd.com/538/ https://xkcd.com/538/ If you really really want one user to control everything, maybe they should work on a desktop station with a guard at the door.
- _Adam 4y agoThe powershell script is a minor part of the screw up. The real issues are multitude... 1) hardcoding actual production credentials in a script at all. Seriously what the fuck. 2) Thycotic not enforcing MFA for the keys to the kingdom admin account. Even my cellphone provider has better security. The root cause is likely the assumption that the VPN is sacred. This needs to die asap - your internal network should assume the VPN is wide open and secure everything accordingly. Defense in depth not eggshells.
- fjfbsufhdvfy 4y agoI'm curious what's the alternative if the script must have those credentials to do its job.
- bad416f1f5a2 4y agoEnvironment variables are an easy first pass at ensuring a script at rest isn’t dangerous.
- arbitrage 4y agoencryption based authentication (keys or certs) that can be revoked. welcome to 1996.
- ThePadawan 4y agoAs sibling points out: Don't authorize the script, authorize whoever is executing the script.
- lapser 4y agoBesides what the sibling comments said, it's very unlikely to that any script needs keys to the kingdom. Credentials should be created with limited access, just enough for the script to do its thing.
- _8j50 4y agoNot for PAMs like tychotic their service accounts are domain admins
- kccqzy 4y ago> Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) Block unknown executables on company machines. Google developed Santa to protect themselves: https://github.com/google/santa https://github.com/google/santa > and that's all it takes to steal cookies and tokens post-mfa, Make post-MFA cookies and tokens short-lived. Require MFA re-authentication at least daily. > or why even bother with that, if you're running code just make it a reverse shell. All outbound connections should be strictly monitored, especially from production servers, which should have no ability to connect to the Internet at all. With modern dependency management, that's harder for build servers, but still doable.