8 ms·
An attacker’s blunder gave us a look into their operations
- s46dxc5r7tv8 1y agoDisturbing that they would be proud enough of spying on their users to post this. Threat intelligence is nearly as bad as the threats themselves. From crowdstrike destroying computer systems to this type of spying on their own users, who wants to trust these people? What happened to holding microsoft accountable for the security of their products?
- Finnucane 1y agoFor some value of 'spying', I guess. This is a product, as noted above, that say, a corporate IT dept. is installing in your company-issued laptop. Which means the customer, that is, not you, is okay with this behavior; it is what they are paying for.
- deleted 1y ago[deleted]
- cbisnett 1y agoIt’s not that we’re spying on users for fun. We’re analyzing the browser history so determine if the history contains any sites that are associated with malicious activity. We definitely don’t care about your pr0n
- lostlogin 1y agoI wouldn’t lead with this in the marketing. It’s entirely disturbing.
- rcxdude 1y agoBut you are spying on users?
- jml7c5 1y agoYou're supposed to spy on an organization's users and machines for the benefit of the organization that has contracted you. That's not what you're doing here. You've taken an adversarial relationship with your (potential) customer, acting to harm them. Presumably legal, but morally gray.
- zer00eyz 1y agoJesus. I can rob people one at a time or I can go rob the bank. I can break into your clients one at a time or I can break into your "security" company. Where is the product that keeps that data, your infrastructure safe? Why arent you selling that. Oh wait there is no such thing as it does not exist. You are a compromise by a state level actor waiting to happen. In fact if you were compromised by a state level actor it is in your companies best interest to cover it up rather than disclose it (as that would be the end of your organization). It's the fox guarding the hen house. At some point were going to find out that a government, China, Russia, India.... used you, or one of your peers doing the same. This is taking off my shoes at the airport levels of stupid and ineffective. I spend a fair bit of time talking to C-levels. The bulk of them use your services not because they think they are effective but because they know that they can point the finger at you when the shit hits the fan.
- hunter-gatherer 1y agoSo many of the comments here seem to be completely unaware of what an EDR does. Do none of you all work for companies with managed devices? There isn't anything abnormal here... I work on a REM team in a SOC for a big finance company all you US people know. An employee can't hardly fart in front of their corporate machine without us knowing about it. How do you all think managed cyber security works?
- mc32 1y agoThey might be under the impression that all this activity is looked at by someone for curiosity’s sake -snooping. It isn’t. People only look and discover if there is reason (a critical alert or some legal action). No one goes snooping to see what sites Joe visited this morning for no reason at all.
- boston_clone 1y ago> No one goes snooping to see what sites Joe visited this morning for no reason at all. In fact, I have worked at several organizations in which this type of activity would be a terminable offense.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- jamesnorden 1y agoThe point you seem to be (intentionally?) missing is that this wasn't installed by the IT staff in an org to an employee's computer, an user downloaded their software to trial it an they just happened to take a peek on all of his activity based on tenuous evidence at best.
- deleted 1y ago[deleted]
- isatsam 1y agoI don't work in cybersecurity and, after looking at the site's homepage, couldn't exactly figure out from all the buzzwords what exactly is this product. The most concerning takeaway from this article for me is that the maintainers of Huntress (whatever it is) can keep a log of, as well as personally access, the users' browser history, history of launched executables, device's hostname, and presumably a lot of other information. How is this product not a total security nightmare?
- skulk 1y agoIt looks like Huntress is a "install this on your computer and we'll watch over your systems and keep you safe, for sure." I also find it kind of funny that the "blunder" mentioned in the title, according to the article is ... installing Huntress's agent. Do they look at every customer's google searches to see if they're suspicious too?
- neffy 1y agoIt´s also a lot of assumptions. This probably is an attacker - or wannabe at least. But you could be a student or researcher working on a cyber security course looking and for some projects your search flow would look a lot like this.
- viccis 1y agoThey mention in the write up that they correlated certain indicators with what they had seen in other attacks to be reasonably sure they knew this was an active attacker. The problem to me is that this is the kind of thing you'd expect to see being done by a state intelligence organization with explicitly defined authorities to carry out surveillance of foreign attackers codified in law somewhere. For a private company to carry out a massive surveillance campaign against a target based on their own determination of the target's identity and to then publish all of that is much more legally questionable to me. It's already often ethically and legally murky enough when the state does it; for a private company to do it seems like they're operating well beyond their legal authority. I'd imagine (or hope I guess) that they have a lawyer who they consulted before this campaign as well as before this publication. Either way, not a great advertisement for your EDR service to show everyone that you're shoulder surfing your customers' employees and potentially posting all that to the internet if you decide they're doing something wrong.
- viccis 1y agoHaving worked in the computer security world for many years and been completely on board with the "it's good to open source attack tools so that everyone knows what can be done", it's still sometimes hard not to feel like a useful idiot when I see attackers operating with big stacks of almost all open source tooling that are now mature and full featured enough to make almost any skid into a decently effective procurer and vendor of stolen information with a bit of effort.
- neodymiumphish 1y agoI've been through 2 offensive courses (SANS GPEN and Parrot Labs Offensive Methodology and Analysis) and yeah, that was the take I got even back then (5+ years ago). Everything we used was open source and near-fully functional. There was a lot of knowledge needed on the syntax for some tools, but otherwise it was insane to think how easily these could be used by a motivated person.
- viccis 1y agoFor some of them, it makes sense. Metasploit, Cobalt Strike, and similar tools are good because they can be used to give people a good idea of the impact of the vulnerabilities in their system as well as giving them knowledge of the TTPs that attackers use. But some of these, like Bloodhound are not really telling you much you didn't know. They are tools to make exploiting access, whether authorized or otherwise, easier and more automated. Hell, even in the case of Cobalt Strike, they are doing their best to limit who can obtain it and chasing down rogue copies because used for real attack purposes. I'm not really saying anything should (or can) be done about this. Just ruminating about it, as after many years in the industry, seeing a list of a mostly open source stack used for every aspect of cybercrime sometimes surprises me at just how good a job we've done of equipping malicious actors. For all the high minded talk of making everyone more secure, a lot of things just seem to be done for a mixture of bragging rights ego and sharing things with each other to make our offensive sec job a bit easier.
- deleted 1y ago[deleted]
- bensons1 1y agoReading through the article, the "hacker" was pretty naive and junior, installing an EDR on his hacking box. Or it was just a way to distract you guys ;)
- mzajc 1y agoI don't understand how "we actively spy on our customers and blog about it" is a viable marketing strategy..?
- evanjrowley 1y agoThe cybersecurity industry is dominated by companies who sell this as their "cyber threat intelligence" and "real-time protection" special sauce.
- neodymiumphish 1y agoPresumably this > We knew this was an adversary, rather than a legitimate user, based on several telling clues. The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent. So in any other context, they probably wouldn't do any digging into the machine or user history, but they did this time because they already had high confidence of malicious use from this endpoint.
- deleted 1y ago[deleted]
- sciencejerk 1y agoCool insight into a (novice?) threat actor's operations and tooling. I personally knew nothing of "residential proxies" like LunaProxy so I learned something new
- Sophira 1y agoI personally would be careful about that sort of thing. I would imagine that few people would want to run a proxy on their home computer that can be accessed by others - and if they did, they'd probably have a specific reason for it, and thus would be looking for specific ways to make that proxy available to the people who they feel would want to use it. So, I can only assume that a lot of residential machines that have proxies on them offered by companies like these have actually had those proxies installed by malware. The company themselves may not even be aware of this. (I'm not saying that LunaProxy in particular is like this. I actually have never heard of LunaProxy before now, so the above may not even apply to it. Regardless, it's still worth applying caution.)
- ctoth 1y agoA lot of us are missing what actually happened here. Some random person downloaded Huntress to try it out. Not a company. Not through IT. Just clicked "start trial" like you might with any software. Were they trying to figure out how to get around it? We have no idea! Huntress employees then decided - based on a hostname that matched something in their private database - to watch everything this person did for three months. Their browser history, their work patterns, what tools they used, when they took breaks. Then they published it. The "but EDR needs these permissions!" comments are completely missing the point. Yeah, we know EDR is basically spyware. The issue is that Huntress engineers personally have access to trial user data and apparently just... browse it when they feel like it? Based on hostname matches??? Think about what they're saying: they run every trial signup against their threat intel database. If you match their criteria - which could be as weak as a hostname collision - their engineers start watching you. No warrant. No customer requesting it. No notification. Just "this looks interesting, let's see what they're up to." Their ToS probably says something vague about "security monitoring" but I doubt it says "we reserve the right to extensively surveil individual trial users for months and publish the results if we think you're suspicious." And even if it did, that doesn't make it right or legal. They got lucky this time - caught an actual attacker. But what about next time? What about the security researcher whose hostname happens to match? The pentester evaluating their product? Hell, what about corporate users whose hostname accidentally matches something in their database? The fact that they thought publishing this was a good idea tells you a lot. This isn't some one-off investigation. This is apparently? how they operate.
- wvenable 1y ago> caught an actual attacker. But what about next time? What about the time before this where it wasn't an attacker, so they didn't write an article about it, and so we never found out about it?
- raptor99 1y agoWhy would they NOT do this? They are a fucking cyber security company. It should be no surprise to anyone that a company that specializes in endpoint security software would be analyzing this shit non-stop, even for trial versions that users run. That's how their software works!
- coppsilgold 1y agoWhile amusing it probably isn't particularly informative. A person like that obviously has extremely poor operational security and is therefore of low competence. Competent actors likely utilize virtualization or in cases where the software is adversarial and may reveal virtualization, physical machines (eg. cheap Mini PC's) with isolated and managed networks (eg. connections routed through a commercial VPN or a residential proxy) not under the control of the machine. Also styxmmarket doesn't appear to be in any way a dark web marketplace/forum. It doesn't even have an onion address? It has a .com domain, something that should be easy for the authorities to seize. Probably is a honeypot of some kind.
- saagarjha 1y agoA bunch of commenters are confused how this "blunder" even happened. I was too, except I recognized the company name. They have a history of making up or completely misunderstanding their own software. They make EDR products which trigger "events" except they don't really have the knowledge to triage them, so they come up with wild explanations for them that involve threat actors and anomalies which are not real. For example, earlier they posted this to their Twitter account: https://twitter.com/HuntressLabs/status/1865111713948852572 https://twitter.com/HuntressLabs/status/1865111713948852572 Anyone who knows anything about macOS knows that it is not possible to disable System Integrity Protection without rebooting into recovery (an environment that it is not possible to actually get events from). So their "detection" is just some random guy typing "csrutil disable" in their terminal and it doing absolutely nothing. I would not be surprised if there is some similar dumb explanation here that they missed, which would make for a substantially less interesting story.
- elnerd 1y agoUnrelated story; how politician gave us a look into their financial adventures. I am curious where the red line is. Any criminal activity or just behavior that the analysts find interesting?
- elnerd 1y agoAfter thinking of it for a while, I do not think it is such a big issue. The threat actor was probably an adversary to existing huntress customers and the EDR probably reacted to his tooling and mistakes. When doing red team engagements, we do the same, install same security solutions as the customer and work around it. It could be what happened here? That the analysts spotted him and were able to connect it to existing cases is just good craftsmanship. I no longer feel that it’s relevant to discuss a red line here. Huntress just did their job.
- cmiller1 1y ago> Like most good stories, this one starts in the middle and works its way back and forth Don't tell me your story is "good," let me read it and I'll be the judge of that.
- curtisszmania 1y ago[dead]