4 ms·

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited fi

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart might make a lot of money.

tptacek 13y ago
There is a market here.
- larrys 13y ago
  Someone who does security work for me on the side (for about 12 years works now) manages a team that does this at a large consulting company. I can't remember exactly, but he told me what they bill him out for and it sounded like NY senior attorney level rates. He travels overseas regularly on longer term assignments. I told him he should go out on his own but he's not entrepreneurial. He also said that a few of the "sales guys" at the firm already did that with some of the other security people last year.
  - tptacek 13y ago
    I think starting a security consultancy is a business idea that just might work.
    - janzer 13y ago
      I admit by the time I made it through this comment thread, I wasn't quite laughing out loud, but I was having a good chuckle.
      - larrys 13y ago
        When I was maybe 5 years old I asked my parents why they couldn't just cut cancer out? Everybody is a newbie at one point.
- deleted 13y ago
  [deleted]
mcphilip 13y ago
Some services that scan the assets on a network for a wide range of vulnerabilities: QualysGuard, Nexpose, McAfee EPO. There is a market there among Fortune 500 companies, for sure. The difficulties (as I've experienced it) are: 1. Companies want some omni tool that scans vulnerabilities, manages tickets, enforces policies, tests controls, etc and feeds all the data into a single database that they can run reports on. 2. Large companies (especially financial ones) don't want their data in the cloud so you have to provide some sort of support onsite.
- riskable 13y ago
  The bigger the network the more likely something like a simple vulnerability scan will take something down. For this reason many organizations don't allow blanket scans to take place which is a shame because if the scan itself is capable of taking down an important system on your network then clearly you have a huge vulnerability! I remember when I was working as a security consultant doing a "safe" Nessus scan of a relatively small organization that happened to have a mainframe. The mere act of scanning the ports on the mainframe caused it to crash. The whole thing had to be rebooted and it took HOURS. Essentially, a whole day of work was lost. When we met with the CSO to talk about it he was both happy and sad: Happy that we discovered such a huge vulnerability and sad that he was going to have to explain to his superiors that an action that he undertook (hiring security consultants to perform a scan) cost the business a lot of money. I later found out that he was fired because of the incident. That right there explains a lot about the state of IT security in business right now.
adamlj 13y ago
The real problem here is that this is extremely asymmetric. All the bad guys need to do is to find a single mistake from an employee, subcontractor, vendor etc.
- riskable 13y ago
  I wish more people would get this through their heads. The secretary opening a zero-day PDF is usually all it takes for an entire organization to be owned! Especially organizations with Active Directory and Windows workstations. Here's why: * Secretary's workstation gets owned via zero day. * Attacker installs keylogger. * Attacker "breaks" the workstation's join to the domain. * Domain admin shows up to re-join the workstation to the domain (to "fix it"). Now the attacker has the credentials necessary to manage all of AD and give themselves rights to whatever they want. Also, since AD doesn't use a salt with password hashes the attacker can now trivially obtain the passwords of every employee in the company along with things like service accounts. It's game over at that point--rebuild everything time.
oogali 13y ago
Sure, you can identify them -- but will they listen and actually take corrective action?
rogerbinns 13y ago
A good blog to follow is Krebs on Security: https://krebsonsecurity.com/ https://krebsonsecurity.com/ He often has screenshots and other details on the working of various markets. Here is a market for ecommerce credentials: https://krebsonsecurity.com/2012/12/exploring-the-market-for-stolen-passwords/ https://krebsonsecurity.com/2012/12/exploring-the-market-for... What use a hacked PC has: http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/ http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hack... And even a thriving software industry for the bad guys http://krebsonsecurity.com/2013/07/one-stop-bot-chop-shops/ http://krebsonsecurity.com/2013/07/one-stop-bot-chop-shops/ Counterpane is a company (now owned by BT) that sells managed network security services as an example of how you sell to the firms.
trotsky 13y ago
software is fundamentally broken in some way that it just gets harder and harder to keep a lid on the more effort we make. There is money to be made selling inflatable rafts before a tsunami, but it's pretty depressing work and pretty much everyone is still going to die. The only semi-workable answers are air gapping and drastically reducing the size of your code base, and neither are working that awesome for people or is anyone much willing to do it. Look at google chromeos. One of the lowest attack surface pcs on the market and it was designed from the ground up assuming they'd get owned regularly. Very few other orgs are doing either one.

tptacek 13y ago

There is a market here.

larrys 13y ago
Someone who does security work for me on the side (for about 12 years works now) manages a team that does this at a large consulting company. I can't remember exactly, but he told me what they bill him out for and it sounded like NY senior attorney level rates. He travels overseas regularly on longer term assignments. I told him he should go out on his own but he's not entrepreneurial. He also said that a few of the "sales guys" at the firm already did that with some of the other security people last year.
- tptacek 13y ago
  I think starting a security consultancy is a business idea that just might work.
  - janzer 13y ago
    I admit by the time I made it through this comment thread, I wasn't quite laughing out loud, but I was having a good chuckle.
    - larrys 13y ago
      When I was maybe 5 years old I asked my parents why they couldn't just cut cancer out? Everybody is a newbie at one point.
deleted 13y ago
[deleted]

mcphilip 13y ago

Some services that scan the assets on a network for a wide range of vulnerabilities: QualysGuard, Nexpose, McAfee EPO. There is a market there among Fortune 500 companies, for sure. The difficulties (as I've experienced it) are: 1. Companies want some omni tool that scans vulnerabilities, manages tickets, enforces policies, tests controls, etc and feeds all the data into a single database that they can run reports on. 2. Large companies (especially financial ones) don't want their data in the cloud so you have to provide some sort of support onsite.

riskable 13y ago
The bigger the network the more likely something like a simple vulnerability scan will take something down. For this reason many organizations don't allow blanket scans to take place which is a shame because if the scan itself is capable of taking down an important system on your network then clearly you have a huge vulnerability! I remember when I was working as a security consultant doing a "safe" Nessus scan of a relatively small organization that happened to have a mainframe. The mere act of scanning the ports on the mainframe caused it to crash. The whole thing had to be rebooted and it took HOURS. Essentially, a whole day of work was lost. When we met with the CSO to talk about it he was both happy and sad: Happy that we discovered such a huge vulnerability and sad that he was going to have to explain to his superiors that an action that he undertook (hiring security consultants to perform a scan) cost the business a lot of money. I later found out that he was fired because of the incident. That right there explains a lot about the state of IT security in business right now.

adamlj 13y ago

The real problem here is that this is extremely asymmetric. All the bad guys need to do is to find a single mistake from an employee, subcontractor, vendor etc.

riskable 13y ago
I wish more people would get this through their heads. The secretary opening a zero-day PDF is usually all it takes for an entire organization to be owned! Especially organizations with Active Directory and Windows workstations. Here's why: * Secretary's workstation gets owned via zero day. * Attacker installs keylogger. * Attacker "breaks" the workstation's join to the domain. * Domain admin shows up to re-join the workstation to the domain (to "fix it"). Now the attacker has the credentials necessary to manage all of AD and give themselves rights to whatever they want. Also, since AD doesn't use a salt with password hashes the attacker can now trivially obtain the passwords of every employee in the company along with things like service accounts. It's game over at that point--rebuild everything time.

oogali 13y ago

Sure, you can identify them -- but will they listen and actually take corrective action?

rogerbinns 13y ago

A good blog to follow is Krebs on Security: https://krebsonsecurity.com/ https://krebsonsecurity.com/ He often has screenshots and other details on the working of various markets. Here is a market for ecommerce credentials: https://krebsonsecurity.com/2012/12/exploring-the-market-for-stolen-passwords/ https://krebsonsecurity.com/2012/12/exploring-the-market-for... What use a hacked PC has: http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/ http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hack... And even a thriving software industry for the bad guys http://krebsonsecurity.com/2013/07/one-stop-bot-chop-shops/ http://krebsonsecurity.com/2013/07/one-stop-bot-chop-shops/ Counterpane is a company (now owned by BT) that sells managed network security services as an example of how you sell to the firms.

trotsky 13y ago

software is fundamentally broken in some way that it just gets harder and harder to keep a lid on the more effort we make. There is money to be made selling inflatable rafts before a tsunami, but it's pretty depressing work and pretty much everyone is still going to die. The only semi-workable answers are air gapping and drastically reducing the size of your code base, and neither are working that awesome for people or is anyone much willing to do it. Look at google chromeos. One of the lowest attack surface pcs on the market and it was designed from the ground up assuming they'd get owned regularly. Very few other orgs are doing either one.