4 ms·

I feel the article linked by the article is more substantial, this one is mostly a hype piece for the other article. https://www.theregister.com/2024/03/11/bri

by 542458 3y ago

I feel the article linked by the article is more substantial, this one is mostly a hype piece for the other article. https://www.theregister.com/2024/03/11/british_library_slaps_the_cloud/ https://www.theregister.com/2024/03/11/british_library_slaps... Or the actual British library report: https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf https://www.bl.uk/home/british-library-cyber-incident-review...

Animats 3y ago
> Or the actual British library report Which contains near zero technical detail. No mention of vendors, or software used, or hardware used, or the attack type, or vulnerability IDs, or much of anything, really. It's 18 pages, and only pages 6-9 are really about what happened. Much of the rest is generic boilerplate, including a copy of their mission statement.
- 542458 3y ago
  I think that’s a bit harsh. The early pages provide a high level overview of the timeline of the event and the impact on services. The mission statement is more of a list of key activities, and is only there as framing for a breakdown of what is currently broken and what still works. While I too would like more technical details, I think the report is pretty clear that they don’t know how the attackers broke in, but they do know horizontal spread was extremely easy due to a wide array of outdated systems and a very non-compartmentalized network. While knowing exact vectors and CVEs would be somewhat interesting, a) I don’t think it would substantially change the key messages of the report and b) it’s almost certainly some fairly boring long-since-patched vulns in legacy software.
- gerdesj 3y ago
  It implied to me that they got their end users using MFA etc but 'coz: reasons, third party suppliers were given a terminal server with user/pass access and no MFA. At least some of those third parties may have had say Domain Admin access privs. One of those accounts was compromised in some way. They have no logs 'coz vandalism but I bet a shufti through their or their third party's password database(s) might be instructive. There is no real technical detail because the break in did not involve anything fancy. I had a customer who sadly no longer trade (unrelated to these events) who once created a temporary email account called mail with a password of mail so that the CEO could get up and running whilst on a trip to China (we are all Brits here!) What could possibly go wrong? It took two years for this account to be used to send a tiny deluge of spam emails for a few hours. I should point out that this email account was attached to a login account which was an admin because they had simply copied an existing account to use as a template and then added email to it. The template account was called admin. Oh how we laughed when I explained all this to them. On behalf of another customer, I ended up driving into deepest, darkest Wales with a NAS wrapped in a blanket in my car to a data restoration company. The NAS had crashed when the baddies tried to wipe it. They had "deleted" the data but not managed to overwrite it with rubbish. This break in was a terminal server for third parties to use and a compromised password ... That 18 pages speaks volumes to me.
pvg 3y ago
Discussed a couple of weeks ago here https://news.ycombinator.com/item?id=39640190 https://news.ycombinator.com/item?id=39640190

by 542458 3y ago

Animats 3y ago

> Or the actual British library report Which contains near zero technical detail. No mention of vendors, or software used, or hardware used, or the attack type, or vulnerability IDs, or much of anything, really. It's 18 pages, and only pages 6-9 are really about what happened. Much of the rest is generic boilerplate, including a copy of their mission statement.

542458 3y ago
I think that’s a bit harsh. The early pages provide a high level overview of the timeline of the event and the impact on services. The mission statement is more of a list of key activities, and is only there as framing for a breakdown of what is currently broken and what still works. While I too would like more technical details, I think the report is pretty clear that they don’t know how the attackers broke in, but they do know horizontal spread was extremely easy due to a wide array of outdated systems and a very non-compartmentalized network. While knowing exact vectors and CVEs would be somewhat interesting, a) I don’t think it would substantially change the key messages of the report and b) it’s almost certainly some fairly boring long-since-patched vulns in legacy software.
gerdesj 3y ago
It implied to me that they got their end users using MFA etc but 'coz: reasons, third party suppliers were given a terminal server with user/pass access and no MFA. At least some of those third parties may have had say Domain Admin access privs. One of those accounts was compromised in some way. They have no logs 'coz vandalism but I bet a shufti through their or their third party's password database(s) might be instructive. There is no real technical detail because the break in did not involve anything fancy. I had a customer who sadly no longer trade (unrelated to these events) who once created a temporary email account called mail with a password of mail so that the CEO could get up and running whilst on a trip to China (we are all Brits here!) What could possibly go wrong? It took two years for this account to be used to send a tiny deluge of spam emails for a few hours. I should point out that this email account was attached to a login account which was an admin because they had simply copied an existing account to use as a template and then added email to it. The template account was called admin. Oh how we laughed when I explained all this to them. On behalf of another customer, I ended up driving into deepest, darkest Wales with a NAS wrapped in a blanket in my car to a data restoration company. The NAS had crashed when the baddies tried to wipe it. They had "deleted" the data but not managed to overwrite it with rubbish. This break in was a terminal server for third parties to use and a compromised password ... That 18 pages speaks volumes to me.

pvg 3y ago

Discussed a couple of weeks ago here https://news.ycombinator.com/item?id=39640190 https://news.ycombinator.com/item?id=39640190