3 ms·
Not necessarily. Yes, it can be hard to fight off dedicated hackers, but it shouldn’t be that easy. I know it’s easy to judge them when we’re not in their shoes
by jay-barronville 4y ago
Not necessarily. Yes, it can be hard to fight off dedicated hackers, but it shouldn’t be that easy. I know it’s easy to judge them when we’re not in their shoes, but one compromised employee shouldn’t be able to produce these results. There wasn’t even proper key management protocols in place here. I can set up a production-ready Vault (HashiCorp) cluster (with decentralized key shares) in a weekend and exercise better OPSEC than them. That’s actually disappointing.
- AYBABTME 4y agoUsing Vault isn't going to make this impossible. The secrets still end up somewhere on a host in an env var. People still get permission at some point to read from Vault. Combine enough parts of the puzzle and you can find cracks in the system.
- komuW 4y agoNote that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-221625921 https://github.com/hashicorp/vault/issues/1446#issuecomment-... I'm bringing this up because the circleCI blogpost says that the attacker did memory-dump encryption keys from a running process. See https://circleci.com/blog/jan-4-2023-incident-report/ https://circleci.com/blog/jan-4-2023-incident-report/ So even if they were using hashicorp/vault, the attacker could probably still have been able to mem-dump vault's process.
- robszumski 4y agoYou can run Vault inside of an enclave to protect it's memory: https://edgebit.io/enclaver/docs/0.x/guide-vault/ https://edgebit.io/enclaver/docs/0.x/guide-vault/