34 ms·

Admin consoles: the soft underbelly of billion dollar software operations since... Seriously, though: you almost certainly have one if you run a software busin

by patio11 14y ago

Admin consoles: the soft underbelly of billion dollar software operations since... Seriously, though: you almost certainly have one if you run a software business. Client side SSH certificates are your friend. If you're not able to do that, because it is really annoying, separate it from the main app and lock it down as much as possible. (Separate authentication from the main site/app's authentication scheme. Lock down access, ideally at the network level. Strongly consider two-factor auth.)

ChuckMcM 14y ago
Blizzard does use client side SSH certificates according to a dev at BlizCon 2 I think. If I had to hazard a guess, I'd guess that someone laid off in [1] took some of the family jewels with them which enabled [2] and ultimately this as well. [1] http://massively.joystiq.com/2012/02/29/blizzard-announces-layoffs-of-600-employees-worldwide/ http://massively.joystiq.com/2012/02/29/blizzard-announces-l... [2] http://kotaku.com/5933454/blizzard-network-breached-change-your-passwords http://kotaku.com/5933454/blizzard-network-breached-change-y...
- lazyjones 14y ago
  That's odd, Blizzard should be competent enough to revoke the certificates of former GMs (and have per-user certs, not shared ones).
trafficlight 14y ago
Take a look at Authy for a reasonably easy way to add two-factor auth to your normal SSH login. It's intended for website authentication, but there is a Github project for adding it to sshd. https://www.authy.com/ https://www.authy.com/ https://github.com/authy/authy-ssh https://github.com/authy/authy-ssh
- RossM 14y ago
  Alternatively, a solution using Google Authenticator.[1] [1]: http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/ http://www.howtogeek.com/121650/how-to-secure-ssh-with-googl...
- singlow 14y ago
  I thought that was a great idea but it broke scp when I tried it. Is there a way around that?
  - davidblondeau 14y ago
    Duo-unix from Duo security [1] works with scp as long as you install duo-push on your cell phone. [1] http://www.duosecurity.com/ http://www.duosecurity.com/
TazeTSchnitzel 14y ago
>Client side SSH certificates are your friend Of note, if you do use a client-side SSH cert, disable username and password auth.
klodolph 14y ago
There are a few scenarios in which client-side certificates just aren't good enough by themselves. So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything. * But maybe it won't even show up in the logs. Maybe he was editing a file in sudo with vi and ran ":! bash". Okay, so you're a good admin and disabled that. * Maybe he was editing crontab one day and added a one-shot script to create a nefarious account. Okay, you are a good admin and you have tripwires. * Maybe he knows where your tripwires are. Do you honestly think you know every possible attack vector someone with legitimate sudo access could use? It's really hard to stop an inside job. The principle of least privilege is a nice maxim, but there's a cost to figuring out exactly what the least privilege is, and there's a cost to giving someone too little privilege -- downtime when they can't fix something they're supposed to fix.
- lancewiggs 14y ago
  Maybe it's you - the person responsible for security.
- keithpeter 14y ago
  "Maybe he was editing a file in sudo with vi and ran ":! bash"" Ah, yes, works on a default Ubuntu desktop install provided you have vim installed (not the usual tiny-vim package that uses nano for visudo editing).
  - iso8859-1 14y ago
    why wouldn't it work? sudo -s works too. sudo su. sudo bash.
    - klodolph 14y ago
      1) All sudo commands show up in the logs. You can put the logs on another server, possibly a server where only the head of IT has sudo privileges, possibly one that automatically replicates to other sites. Seeing a "sudo su", "sudo bash", or "sudo -s" in the logs could get you reprimanded, and if there's a security breach it could make you a suspect. 2) You can disable sudo -s, sudo su, and sudo bash. Maybe the people with root access only need to run a few commands and edit a few files as root, so you whitelist those. But as I mentioned, if they need to edit crontab you've probably given away the keys to the kingdom right there. There are more attack vectors you can enable without knowing about it and you've got a business to run, so you make a cost/benefit analysis -- it's always a trade-off between efficiency and security.
eli 14y ago
Good advice, but I think you're underestimating the sort of attackers going after WoW. It's not going to be some drive-by script kiddies looking for an easy target... it's people specifically targeting this game. I'd be more worried about spearphishing and social engineering.
spindritf 14y ago
> Client side SSH certificates What are those? We're talking key-based ssh authentication? Or something else?
- shawnz 14y ago
  Key-based authentication in general. Doesn't have to be ssh.
wdr1 14y ago
FWIW, we used client certificates for the Beijing Olympics ticketing system. I have to admit they were a giant pain in the ass, but I still have to image they saved us more pain than they created.
dsl 14y ago
It's just speculation that someone used GM powers to do this. Most likely they tracked down a boss mass wipe ability (i.e. kills all players within 30 yards) that was incorrectly flagged as useable by players. You can then write an AddOn that uses CastSpellByID() to give you that ability. The GM interface requires a special build of the WoW client, a specially flagged account, and a two factor auth token to login. It's pretty hard to emulate the client as opcodes are randomly shuffled based on the hash of the binary itself.

by patio11 14y ago

ChuckMcM 14y ago

Blizzard does use client side SSH certificates according to a dev at BlizCon 2 I think. If I had to hazard a guess, I'd guess that someone laid off in [1] took some of the family jewels with them which enabled [2] and ultimately this as well. [1] http://massively.joystiq.com/2012/02/29/blizzard-announces-layoffs-of-600-employees-worldwide/ http://massively.joystiq.com/2012/02/29/blizzard-announces-l... [2] http://kotaku.com/5933454/blizzard-network-breached-change-your-passwords http://kotaku.com/5933454/blizzard-network-breached-change-y...

lazyjones 14y ago
That's odd, Blizzard should be competent enough to revoke the certificates of former GMs (and have per-user certs, not shared ones).

trafficlight 14y ago

Take a look at Authy for a reasonably easy way to add two-factor auth to your normal SSH login. It's intended for website authentication, but there is a Github project for adding it to sshd. https://www.authy.com/ https://www.authy.com/ https://github.com/authy/authy-ssh https://github.com/authy/authy-ssh

RossM 14y ago
Alternatively, a solution using Google Authenticator.[1] [1]: http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/ http://www.howtogeek.com/121650/how-to-secure-ssh-with-googl...
singlow 14y ago
I thought that was a great idea but it broke scp when I tried it. Is there a way around that?
- davidblondeau 14y ago
  Duo-unix from Duo security [1] works with scp as long as you install duo-push on your cell phone. [1] http://www.duosecurity.com/ http://www.duosecurity.com/

TazeTSchnitzel 14y ago

>Client side SSH certificates are your friend Of note, if you do use a client-side SSH cert, disable username and password auth.

klodolph 14y ago

There are a few scenarios in which client-side certificates just aren't good enough by themselves. So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything. * But maybe it won't even show up in the logs. Maybe he was editing a file in sudo with vi and ran ":! bash". Okay, so you're a good admin and disabled that. * Maybe he was editing crontab one day and added a one-shot script to create a nefarious account. Okay, you are a good admin and you have tripwires. * Maybe he knows where your tripwires are. Do you honestly think you know every possible attack vector someone with legitimate sudo access could use? It's really hard to stop an inside job. The principle of least privilege is a nice maxim, but there's a cost to figuring out exactly what the least privilege is, and there's a cost to giving someone too little privilege -- downtime when they can't fix something they're supposed to fix.

lancewiggs 14y ago
Maybe it's you - the person responsible for security.
keithpeter 14y ago
"Maybe he was editing a file in sudo with vi and ran ":! bash"" Ah, yes, works on a default Ubuntu desktop install provided you have vim installed (not the usual tiny-vim package that uses nano for visudo editing).
- iso8859-1 14y ago
  why wouldn't it work? sudo -s works too. sudo su. sudo bash.
  - klodolph 14y ago
    1) All sudo commands show up in the logs. You can put the logs on another server, possibly a server where only the head of IT has sudo privileges, possibly one that automatically replicates to other sites. Seeing a "sudo su", "sudo bash", or "sudo -s" in the logs could get you reprimanded, and if there's a security breach it could make you a suspect. 2) You can disable sudo -s, sudo su, and sudo bash. Maybe the people with root access only need to run a few commands and edit a few files as root, so you whitelist those. But as I mentioned, if they need to edit crontab you've probably given away the keys to the kingdom right there. There are more attack vectors you can enable without knowing about it and you've got a business to run, so you make a cost/benefit analysis -- it's always a trade-off between efficiency and security.

eli 14y ago

Good advice, but I think you're underestimating the sort of attackers going after WoW. It's not going to be some drive-by script kiddies looking for an easy target... it's people specifically targeting this game. I'd be more worried about spearphishing and social engineering.

spindritf 14y ago

> Client side SSH certificates What are those? We're talking key-based ssh authentication? Or something else?

shawnz 14y ago
Key-based authentication in general. Doesn't have to be ssh.

wdr1 14y ago

FWIW, we used client certificates for the Beijing Olympics ticketing system. I have to admit they were a giant pain in the ass, but I still have to image they saved us more pain than they created.

dsl 14y ago

It's just speculation that someone used GM powers to do this. Most likely they tracked down a boss mass wipe ability (i.e. kills all players within 30 yards) that was incorrectly flagged as useable by players. You can then write an AddOn that uses CastSpellByID() to give you that ability. The GM interface requires a special build of the WoW client, a specially flagged account, and a two factor auth token to login. It's pretty hard to emulate the client as opcodes are randomly shuffled based on the hash of the binary itself.