3 ms·

Sorry, I should have stated that better. I'm not talking about, "best practice for an advanced attack from an unknown perpetrator". I absolutely agree with you

Sorry, I should have stated that better. I'm not talking about, "best practice for an advanced attack from an unknown perpetrator". I absolutely agree with you in general. I'm saying that, this particular attacker, is a known, identifiable actor. They have names, they have huge reams of files in manilla envelopes. If you are privy, you get to know their actual names, see photos of them. They have a very specific methodology which they use. You use that methodology to determine the extent of what they've accomplished. This specific actor is not using any super fancy BIOS rootkits. If one of their campaigns ever gets to the point that they are unable to obtain repeatable persistent access, that campaign is sent to a different actor (with a completely different big manilla envelope about) who will then attempt a more advanced campaign. The tools and tactics for these intrusions are very specific to the actual actors responsible.

btilly 14y ago
Your reply has a lot of very specific information about the attack, attacker, and state of the compromise that I find rather dubious and cannot find in the article. Do you have a source that you would care to share? Furthermore in this case we've been told that the attacker managed to achieve a rather thorough compromise of the network. And managed to persist through multiple attempts to remove them. Even if the attack proceeded by the rules that you describe, it would be foolhardy to assume that they were not subjected to the advanced campaign.
- m0nastic 14y ago
  You aren't assuming, you are looking on all machines for IOC's (specifically machines that have been compromised before), and hopefully making use of all that fancy network security monitoring technology you paid entirely too much money for. And you're monitoring outbound connections to any of the places which are known to be "bad neighborhoods", as well as any other suspicious traffic. In the gmail example you used, it would indeed be difficult to see that on the network. If that was sent out by some BIOS rootkit it would indeed be very difficult to detect. I have no idea why we don't see more of that stuff (I suppose you could argue that we wouldn't recognize it even if we did), but that's not been the level of attack associated with these actors. I suppose the main reason they don't do that is because they don't need to. They will just keep sending malicious emails over and over again until they get someone to click on one. Or, if the company does a good job with protecting email, they'll compromise another company that partners with the target company (which is what ensnares a lot of small companies today, who are partners with larger defense contractors) and exploit a trust relationship there. It might just be that the five guys they have who can write BIOS rootkits are all busy being used on projects that have more strategic importance. The shortage of good programmers isn't just a problem in the west.
  - btilly 14y ago
    I was trying to figure out how you think you know all of this when I clicked on your profile. Then the thought suddenly hit me that publicly disclosing details about how we think they work, and what we actually look for in cleaning up, might not be the best thing to do on a forum that is world accessible. Also if you're right, I'm depressed that they don't in practice use ideas that have been publicly known for decades. One final thought. The gmail approach would leave fingerprints in Google's system. The actor in question could easily have some paranoia about doing that, even though Google would be unlikely to notice.
    - m0nastic 14y ago
      So I've tried to be careful to not discuss anything on here that I wouldn't give in a talk in a public forum (we are working on sharing nonclass information, as many of the companies in my area are all particular targets for these attacks. It's almost like a 12-step program.) And I share your sadness that we're still dealing with these types of attacks, when we could make things so much more difficult for attackers by just implementing the things we've learned in the past thirty years. I feel a little torn, though, because I also worry about what unintended consequences would arise if we actually replaced all of our infrastructure with things like hardware roots of trust, and trusted network connect implementations (which are systems which really provide very little value unless everything on your network uses them). Whether that's just moving the ball ten yards forward, when we still struggle to engineer large systems in a secure manner. If that depresses you, I worry how you'd react when most organizations balk even at the prospect of a mass password reset. How many try to argue why can't they just reset the ones that you "know" are compromised? Or how long it takes to get said password reset signed-off and put into the change management process. For what it's worth, I work a lot now with TPM's, and even the places that have actually gone through the trouble of rolling out bios measurements and signed firmware, are still getting breached.

btilly 14y ago

Your reply has a lot of very specific information about the attack, attacker, and state of the compromise that I find rather dubious and cannot find in the article. Do you have a source that you would care to share? Furthermore in this case we've been told that the attacker managed to achieve a rather thorough compromise of the network. And managed to persist through multiple attempts to remove them. Even if the attack proceeded by the rules that you describe, it would be foolhardy to assume that they were not subjected to the advanced campaign.

m0nastic 14y ago
You aren't assuming, you are looking on all machines for IOC's (specifically machines that have been compromised before), and hopefully making use of all that fancy network security monitoring technology you paid entirely too much money for. And you're monitoring outbound connections to any of the places which are known to be "bad neighborhoods", as well as any other suspicious traffic. In the gmail example you used, it would indeed be difficult to see that on the network. If that was sent out by some BIOS rootkit it would indeed be very difficult to detect. I have no idea why we don't see more of that stuff (I suppose you could argue that we wouldn't recognize it even if we did), but that's not been the level of attack associated with these actors. I suppose the main reason they don't do that is because they don't need to. They will just keep sending malicious emails over and over again until they get someone to click on one. Or, if the company does a good job with protecting email, they'll compromise another company that partners with the target company (which is what ensnares a lot of small companies today, who are partners with larger defense contractors) and exploit a trust relationship there. It might just be that the five guys they have who can write BIOS rootkits are all busy being used on projects that have more strategic importance. The shortage of good programmers isn't just a problem in the west.
- btilly 14y ago
  I was trying to figure out how you think you know all of this when I clicked on your profile. Then the thought suddenly hit me that publicly disclosing details about how we think they work, and what we actually look for in cleaning up, might not be the best thing to do on a forum that is world accessible. Also if you're right, I'm depressed that they don't in practice use ideas that have been publicly known for decades. One final thought. The gmail approach would leave fingerprints in Google's system. The actor in question could easily have some paranoia about doing that, even though Google would be unlikely to notice.
  - m0nastic 14y ago
    So I've tried to be careful to not discuss anything on here that I wouldn't give in a talk in a public forum (we are working on sharing nonclass information, as many of the companies in my area are all particular targets for these attacks. It's almost like a 12-step program.) And I share your sadness that we're still dealing with these types of attacks, when we could make things so much more difficult for attackers by just implementing the things we've learned in the past thirty years. I feel a little torn, though, because I also worry about what unintended consequences would arise if we actually replaced all of our infrastructure with things like hardware roots of trust, and trusted network connect implementations (which are systems which really provide very little value unless everything on your network uses them). Whether that's just moving the ball ten yards forward, when we still struggle to engineer large systems in a secure manner. If that depresses you, I worry how you'd react when most organizations balk even at the prospect of a mass password reset. How many try to argue why can't they just reset the ones that you "know" are compromised? Or how long it takes to get said password reset signed-off and put into the change management process. For what it's worth, I work a lot now with TPM's, and even the places that have actually gone through the trouble of rolling out bios measurements and signed firmware, are still getting breached.