4 ms·

You aren't assuming, you are looking on all machines for IOC's (specifically machines that have been compromised before), and hopefully making use of all that f

You aren't assuming, you are looking on all machines for IOC's (specifically machines that have been compromised before), and hopefully making use of all that fancy network security monitoring technology you paid entirely too much money for. And you're monitoring outbound connections to any of the places which are known to be "bad neighborhoods", as well as any other suspicious traffic. In the gmail example you used, it would indeed be difficult to see that on the network. If that was sent out by some BIOS rootkit it would indeed be very difficult to detect. I have no idea why we don't see more of that stuff (I suppose you could argue that we wouldn't recognize it even if we did), but that's not been the level of attack associated with these actors. I suppose the main reason they don't do that is because they don't need to. They will just keep sending malicious emails over and over again until they get someone to click on one. Or, if the company does a good job with protecting email, they'll compromise another company that partners with the target company (which is what ensnares a lot of small companies today, who are partners with larger defense contractors) and exploit a trust relationship there. It might just be that the five guys they have who can write BIOS rootkits are all busy being used on projects that have more strategic importance. The shortage of good programmers isn't just a problem in the west.

btilly 14y ago
I was trying to figure out how you think you know all of this when I clicked on your profile. Then the thought suddenly hit me that publicly disclosing details about how we think they work, and what we actually look for in cleaning up, might not be the best thing to do on a forum that is world accessible. Also if you're right, I'm depressed that they don't in practice use ideas that have been publicly known for decades. One final thought. The gmail approach would leave fingerprints in Google's system. The actor in question could easily have some paranoia about doing that, even though Google would be unlikely to notice.
- m0nastic 14y ago
  So I've tried to be careful to not discuss anything on here that I wouldn't give in a talk in a public forum (we are working on sharing nonclass information, as many of the companies in my area are all particular targets for these attacks. It's almost like a 12-step program.) And I share your sadness that we're still dealing with these types of attacks, when we could make things so much more difficult for attackers by just implementing the things we've learned in the past thirty years. I feel a little torn, though, because I also worry about what unintended consequences would arise if we actually replaced all of our infrastructure with things like hardware roots of trust, and trusted network connect implementations (which are systems which really provide very little value unless everything on your network uses them). Whether that's just moving the ball ten yards forward, when we still struggle to engineer large systems in a secure manner. If that depresses you, I worry how you'd react when most organizations balk even at the prospect of a mass password reset. How many try to argue why can't they just reset the ones that you "know" are compromised? Or how long it takes to get said password reset signed-off and put into the change management process. For what it's worth, I work a lot now with TPM's, and even the places that have actually gone through the trouble of rolling out bios measurements and signed firmware, are still getting breached.

btilly 14y ago

I was trying to figure out how you think you know all of this when I clicked on your profile. Then the thought suddenly hit me that publicly disclosing details about how we think they work, and what we actually look for in cleaning up, might not be the best thing to do on a forum that is world accessible. Also if you're right, I'm depressed that they don't in practice use ideas that have been publicly known for decades. One final thought. The gmail approach would leave fingerprints in Google's system. The actor in question could easily have some paranoia about doing that, even though Google would be unlikely to notice.

m0nastic 14y ago
So I've tried to be careful to not discuss anything on here that I wouldn't give in a talk in a public forum (we are working on sharing nonclass information, as many of the companies in my area are all particular targets for these attacks. It's almost like a 12-step program.) And I share your sadness that we're still dealing with these types of attacks, when we could make things so much more difficult for attackers by just implementing the things we've learned in the past thirty years. I feel a little torn, though, because I also worry about what unintended consequences would arise if we actually replaced all of our infrastructure with things like hardware roots of trust, and trusted network connect implementations (which are systems which really provide very little value unless everything on your network uses them). Whether that's just moving the ball ten yards forward, when we still struggle to engineer large systems in a secure manner. If that depresses you, I worry how you'd react when most organizations balk even at the prospect of a mass password reset. How many try to argue why can't they just reset the ones that you "know" are compromised? Or how long it takes to get said password reset signed-off and put into the change management process. For what it's worth, I work a lot now with TPM's, and even the places that have actually gone through the trouble of rolling out bios measurements and signed firmware, are still getting breached.