5 ms·

If they are taking the 'drastic' step of bringing everything offline, how about banning future internet explorer use in all sensitive areas. Chrome would provid

If they are taking the 'drastic' step of bringing everything offline, how about banning future internet explorer use in all sensitive areas. Chrome would provide much better security thanks to its update mechanism. Any workplace still using this abomination is just begging to be hacked.

cheald 14y ago
Is Chrome be subject to being used as a malware delivery vector if you could MITM the DNS? Or does its SSL pinning prevent that (presuming that the updates happen over SSL)?
- option_greek 14y ago
  Interesting.. theoretically SSL should prevent MITM of this kind. But if you are able to redirect at DNS level, probably you can deliver your own certificate and its authority.
  - niels_olson 14y ago
    I don't see how DNS MiTM is going to subvert the basic math of public key crypto. Even if the browser is implementing its own SSL stack, it would have access to validate those keys against those that ship with the OS. This SSL pinning seems to be something outside the crypto mechanism. It's flair.
    - option_greek 14y ago
      You are correct. That should handle it.
  - gojomo 14y ago
    Creating a phony certificate is much harder -- or at least by design it's supposed to be much harder -- than DNS redirection/spoofing. So there's not a "if you can do one you can probably do the other" kind of threat-equality. However, given how many Certificate Authorities have been flaky, compromised, or deferential to certain unsavory authorities, there probably are some actors who could launch both kinds of attacks. I expect both Google and Microsoft use some private mechanism for authenticating their updates, perhaps SSL but not dependent on any Certificate Authorities or secrets other than those they manage themselves. Pressure from some state authorities, or catastrophic failures in these companies' own security, could give some other malicious actor the power to hijack these updates. But that should be again harder than either DNS subversion or finding/compromising the weakest browser-trusted CA. (When Google suddenly became so mad at China a while back, my favorite theory -- wholly unsupported by any confirmed info, however -- was that Google had observed China's incursions trying to win control of the various Google auto-update mechanisms. Third-party malware injection via those avenues might threaten Google's very existence, which would justify the strongest possible reaction, in the name of self-preservation.)
- simonbrown 14y ago
  To my knowledge, it's both sent over SSL and signed with its own key. SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.
dkokelley 14y ago
Here's the thing, network security needs to be balanced against organizational operations. Internet Explorer has been sold to organizations as a platform where thin client applications can be deployed cheaply. Internet Explorer doesn't update automatically because the last thing Microsoft wants to do to their clients is break all of their web apps through an untested update. Security updates also need to have backwards compatibility, or large firms won't upgrade, since their web apps might break. Security and usability are at odds. Large organizations (thus far) tend to favor usability. It's a cost-benefit analysis, and the benefit of not redeveloping their web apps outweighs the cost of increasing security.
- fjarlq 14y ago
  Considering the type of work that goes on at Oak Ridge, I'm not so sure they correctly calculated the true cost of using Windows and Internet Explorer....
  - peeters 14y ago
    I'm not sure they (or any other really high-risk security company) calculated the true cost of connecting their network to the internet at all. A really simple, effective way of protecting sensitive data is to say that the network that hosts it will have absolutely no path outside. Then give your employee another machine on the same desk which connects to the internet but is on a completely network. It's annoying at first, but it works pretty damned well.
- reidrac 14y ago
  If their applications break because of an upgrade of IE (or even if the apps doesn't work with a different browser/operating system), I'm not sure their problem is with security. It's true that after the attackers got the entry point, there are several thing wrong according to article (ie. "Four days after the e-mails arrived, administrators spotted suspicious traffic leaving a server." -- so they got a mail that used an IE vulnerability, and then a server got affected?).
  - 14y ago
gbog 14y ago
Not only that, but also active directory,which requires a window server, which requires a special dns thing, which almost requires a dns serviced by windows. An endless chain of turds...
snowwrestler 14y ago
Chrome is less protection that you might think, given that most spearfishing attempts target Flash, PDF, or Java vulnerabilities.

cheald 14y ago

Is Chrome be subject to being used as a malware delivery vector if you could MITM the DNS? Or does its SSL pinning prevent that (presuming that the updates happen over SSL)?

option_greek 14y ago
Interesting.. theoretically SSL should prevent MITM of this kind. But if you are able to redirect at DNS level, probably you can deliver your own certificate and its authority.
- niels_olson 14y ago
  I don't see how DNS MiTM is going to subvert the basic math of public key crypto. Even if the browser is implementing its own SSL stack, it would have access to validate those keys against those that ship with the OS. This SSL pinning seems to be something outside the crypto mechanism. It's flair.
  - option_greek 14y ago
    You are correct. That should handle it.
- gojomo 14y ago
  Creating a phony certificate is much harder -- or at least by design it's supposed to be much harder -- than DNS redirection/spoofing. So there's not a "if you can do one you can probably do the other" kind of threat-equality. However, given how many Certificate Authorities have been flaky, compromised, or deferential to certain unsavory authorities, there probably are some actors who could launch both kinds of attacks. I expect both Google and Microsoft use some private mechanism for authenticating their updates, perhaps SSL but not dependent on any Certificate Authorities or secrets other than those they manage themselves. Pressure from some state authorities, or catastrophic failures in these companies' own security, could give some other malicious actor the power to hijack these updates. But that should be again harder than either DNS subversion or finding/compromising the weakest browser-trusted CA. (When Google suddenly became so mad at China a while back, my favorite theory -- wholly unsupported by any confirmed info, however -- was that Google had observed China's incursions trying to win control of the various Google auto-update mechanisms. Third-party malware injection via those avenues might threaten Google's very existence, which would justify the strongest possible reaction, in the name of self-preservation.)
simonbrown 14y ago
To my knowledge, it's both sent over SSL and signed with its own key. SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.

dkokelley 14y ago

Here's the thing, network security needs to be balanced against organizational operations. Internet Explorer has been sold to organizations as a platform where thin client applications can be deployed cheaply. Internet Explorer doesn't update automatically because the last thing Microsoft wants to do to their clients is break all of their web apps through an untested update. Security updates also need to have backwards compatibility, or large firms won't upgrade, since their web apps might break. Security and usability are at odds. Large organizations (thus far) tend to favor usability. It's a cost-benefit analysis, and the benefit of not redeveloping their web apps outweighs the cost of increasing security.

fjarlq 14y ago
Considering the type of work that goes on at Oak Ridge, I'm not so sure they correctly calculated the true cost of using Windows and Internet Explorer....
- peeters 14y ago
  I'm not sure they (or any other really high-risk security company) calculated the true cost of connecting their network to the internet at all. A really simple, effective way of protecting sensitive data is to say that the network that hosts it will have absolutely no path outside. Then give your employee another machine on the same desk which connects to the internet but is on a completely network. It's annoying at first, but it works pretty damned well.
reidrac 14y ago
If their applications break because of an upgrade of IE (or even if the apps doesn't work with a different browser/operating system), I'm not sure their problem is with security. It's true that after the attackers got the entry point, there are several thing wrong according to article (ie. "Four days after the e-mails arrived, administrators spotted suspicious traffic leaving a server." -- so they got a mail that used an IE vulnerability, and then a server got affected?).
- 14y ago

gbog 14y ago

Not only that, but also active directory,which requires a window server, which requires a special dns thing, which almost requires a dns serviced by windows. An endless chain of turds...

snowwrestler 14y ago

Chrome is less protection that you might think, given that most spearfishing attempts target Flash, PDF, or Java vulnerabilities.