5 ms·
It looks like Huntress is a "install this on your computer and we'll watch over your systems and keep you safe, for sure." I also find it kind of funny that th
by skulk 1y ago
It looks like Huntress is a "install this on your computer and we'll watch over your systems and keep you safe, for sure."
I also find it kind of funny that the "blunder" mentioned in the title, according to the article is ... installing Huntress's agent. Do they look at every customer's google searches to see if they're suspicious too?
- neffy 1y agoIt´s also a lot of assumptions. This probably is an attacker - or wannabe at least. But you could be a student or researcher working on a cyber security course looking and for some projects your search flow would look a lot like this.
- viccis 1y agoThey mention in the write up that they correlated certain indicators with what they had seen in other attacks to be reasonably sure they knew this was an active attacker. The problem to me is that this is the kind of thing you'd expect to see being done by a state intelligence organization with explicitly defined authorities to carry out surveillance of foreign attackers codified in law somewhere. For a private company to carry out a massive surveillance campaign against a target based on their own determination of the target's identity and to then publish all of that is much more legally questionable to me. It's already often ethically and legally murky enough when the state does it; for a private company to do it seems like they're operating well beyond their legal authority. I'd imagine (or hope I guess) that they have a lawyer who they consulted before this campaign as well as before this publication. Either way, not a great advertisement for your EDR service to show everyone that you're shoulder surfing your customers' employees and potentially posting all that to the internet if you decide they're doing something wrong.
- fckgw 1y ago> The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent. The machine was already known to the company as belonging to a threat actor from previous activity
- bornfreddy 1y agoThat's not very convincing. They still abused trust placed in them - by an active attacker, granted, but still... This seems like a legally risky move and it doesn't inspire trust in Huntress.
- fckgw 1y agoWho's trust? Their job is to hunt down and research threat actors. The information gained from this is used to better protect their enterprise customers. This gains more trust with their customers and breaking trust with ... threat actors?
- viccis 1y ago>Who's trust? Their job is to hunt down and research threat actors No, their job is to provide EDR protection for their customers.
- cybergreg 1y agoThreat intelligence is a thing.in fact there’s entire companies that sell just that. In fact, there’s entire government organizations that do just that.
- viccis 1y agoSure but that's not what their customer was engaging with them to do. It's not ethical to sell "EDR" services and then use that access to spy on your customers for intelligence purposes.
- viccis 1y agoThat is what I said, yes.
- glitchc 1y agoYes, but only according to the company's own logs, which were not externally validated. To rephrase, the company thinks this was an active attacker based on logs its own tool generates. It does not discount the possibility that the tool generated erroneous logs or identified the wrong machine(s).
- pizzalife 1y agoIndeed, this article makes them look bad. Seems completely tone deaf to release this as a puff piece about the product.
- cbisnett 1y agoActually we just thought it was interesting that an attacker installed our EDR agent on the machine they use to attack their victims. That’s really bad operational security and we were able to learn a lot from that access.
- ctoth 1y agoWhat is weird to me is that you have access to this information at all? It would make sense for the people who use your software ... the IT departments or whatever to have access but why on earth do your engineers need access? What gates access to your customers' machines? What triggers a write-up like this? Hostnames, "machine names" are ... not unique by nature.
- cybergreg 1y agoHuntress is a cybersecurity company. They’re specifically hired for this purpose, to protect the company and its assets. As far as unique identifiers go, advertisers use a unique fingerprint of your browser to target you individually. Cookies, JavaScript, screen size, etc, are all used.
- ctoth 1y agoThe article states that the "attacker" downloaded the software via a Google ad, not deployed by their corporate IT. I'm also slightly curious as to if you might be associated with an EDR vendor? I notice that you only have three comments ever, and they all seem to be defending how EDR software and Huntress works without engaging with this specific instance.
- moffkalast 1y ago
- mrbluecoat 1y agoI found that creepy too. Apparently `blunder == installing their software`
- fckgw 1y agoA threat actor installing software specifically designed to log and monitor attacks from threat actors would be considered a blunder, no?
- moffkalast 1y agoWell they aren't wrong. Crowdstrike showed how much of a blunder it can become.
- tgv 1y agoIt's stated in the article: "The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent." However, it's obvious that protection-ware like this is essentially spyware with alerts. My company uses a similar service, and it includes a remote desktop tool, which I immediately blocked from auto-startup. But the whatever scanner sends things to some central service. All in the name of security.
- boston_clone 1y agoDirectly impinging the enterprise-approved security tooling is really not a good idea, no matter your own personal opinions on their functionality. Unless maybe you just want to develop a more personal relationship with your internal cybersecurity team, who knows.
- jacquesm 1y agoOr with the HR team and the corporate security guys assisting your departure from the building holding a small cardboard box.
- coppsilgold 1y agoI would assume any machine not owned by me is fully compromised and there is no recovery possible. And treat it accordingly, such as using it just for the purpose the owner of the machine dictates assuming I value that relationship. The startup script you blocked could have just been a decoy. And set off a red flag. A lot of these EDR's operate in kernel space.
- beefnugs 1y agoWell lets be real, you dont decide one day "today is the day we read one users entire history" and BLAMMO its a hacker! Lets keep reading!