4 ms·

What I find curious is, everybody is acting like, yeah, we found that one attempt! But there gotta be more. And this is only open source. At Google, Meta, Micro

by _ink_ 3y ago

What I find curious is, everybody is acting like, yeah, we found that one attempt! But there gotta be more. And this is only open source. At Google, Meta, Microsoft there gotta be the same forces at play. So yeah, congrats to everyone involved discovering this, excellent work, really! But how sure can we be, that there was no other successful attempt?

Lacerda69 3y ago
I think we should assume there as at least one or more other successful attempts.
cpach 3y ago
We can never be sure about that. One’s threat model has to assume that Mallory can find a way in. Backdoor’s are not super common, but there will always be 0-days. Security operations need to be setup with this in mind. Design your infra for defence-in-depth. Logging and access control is very important. Log everything that happens in your systems. Don’t use long-lived credentials. Don’t give people more access than they need. Audit users’ privileges, remove privileges that are no longer required. Try to make your logs tamper-proof. (Perhaps keep copies of the logs offline?)
- _ink_ 3y ago
  Thanks, that's all good advice.
- 1letterunixname 3y ago
  Yep. Assume one or more layers are pwned and rootkitted, especially if it runs Linux because the attack surface is huge in most distros. Never fall for the braggadocio of arrogant, lazy MAANG employees who blindly declare the infra to be "secure" without evidence. Where possible, run a transparent proxy/scrubbing/NIDS/NIPS network layer running OpenBSD or similar. Log setup using WORM media, log structured fs, and/or blockchain would be ideal.
jpsouth 3y ago
Someone else posted this in another thread and I found it a really interesting read. It doesn’t really answer your question directly, but it is very related. https://www.teamten.com/lawrence/writings/coding-machines/ https://www.teamten.com/lawrence/writings/coding-machines/
- qrobit 3y ago
  That is definitely creepy. Having an age of AI in mind I wonder how much more sophisticated will viruses become and what makes me believe my machines are not compromised already? I hope to never get an answer, or even better, get a negative one. Makes me wonder whether it's time to reduce complexity and diversity in technology? Wouldn't it be beneficial to recreate everything from scratch(except maybe for machines producing hardware)? Leave one or two compression standards that are easy to understand and implement once and for ever. Maybe even aim to make them "finished" since the very beginning? So that they won't require changes after some time. I believe that recreating that and foundational things: compiler(of a language that is reinvented and standardized), OS components, web protocols and so on would be beneficial. There are so many of each and each can be vulnerable now or get vulnerable in the future. Many pitfalls aren't mentioned like why would we believe existing hardware producing new components to be trustworthy or how to make such a revolution without loosing so much progress, who will found it and how can it found commercial interest. These are, of course, just murky dreams that linked book gave birth to, but there is no reason not to be paranoid.

by _ink_ 3y ago

Lacerda69 3y ago

I think we should assume there as at least one or more other successful attempts.

cpach 3y ago

We can never be sure about that. One’s threat model has to assume that Mallory can find a way in. Backdoor’s are not super common, but there will always be 0-days. Security operations need to be setup with this in mind. Design your infra for defence-in-depth. Logging and access control is very important. Log everything that happens in your systems. Don’t use long-lived credentials. Don’t give people more access than they need. Audit users’ privileges, remove privileges that are no longer required. Try to make your logs tamper-proof. (Perhaps keep copies of the logs offline?)

_ink_ 3y ago
Thanks, that's all good advice.
1letterunixname 3y ago
Yep. Assume one or more layers are pwned and rootkitted, especially if it runs Linux because the attack surface is huge in most distros. Never fall for the braggadocio of arrogant, lazy MAANG employees who blindly declare the infra to be "secure" without evidence. Where possible, run a transparent proxy/scrubbing/NIDS/NIPS network layer running OpenBSD or similar. Log setup using WORM media, log structured fs, and/or blockchain would be ideal.

jpsouth 3y ago

Someone else posted this in another thread and I found it a really interesting read. It doesn’t really answer your question directly, but it is very related. https://www.teamten.com/lawrence/writings/coding-machines/ https://www.teamten.com/lawrence/writings/coding-machines/

qrobit 3y ago
That is definitely creepy. Having an age of AI in mind I wonder how much more sophisticated will viruses become and what makes me believe my machines are not compromised already? I hope to never get an answer, or even better, get a negative one. Makes me wonder whether it's time to reduce complexity and diversity in technology? Wouldn't it be beneficial to recreate everything from scratch(except maybe for machines producing hardware)? Leave one or two compression standards that are easy to understand and implement once and for ever. Maybe even aim to make them "finished" since the very beginning? So that they won't require changes after some time. I believe that recreating that and foundational things: compiler(of a language that is reinvented and standardized), OS components, web protocols and so on would be beneficial. There are so many of each and each can be vulnerable now or get vulnerable in the future. Many pitfalls aren't mentioned like why would we believe existing hardware producing new components to be trustworthy or how to make such a revolution without loosing so much progress, who will found it and how can it found commercial interest. These are, of course, just murky dreams that linked book gave birth to, but there is no reason not to be paranoid.