6 ms·
How would they know this? Presumably they would have to log the entirety of IP communications with their services.
by personZ 13y ago
How would they know this? Presumably they would have to log the entirety of IP communications with their services.
- loceng 13y agoYou'd imagine that this is probably a place that you'd want to track all communications.
- tacoman 13y agoThey were likely doing full packet capture and in my experience it's not as rare or difficult are you might think. At my place of employment we're doing it on much more mundane and less sensitive services with up to 4 weeks of buffer in some places. Even at a previous job back in the late 90's we were doing full pcap of our gov't department's T1 to the internet. Products from companies like Netscout and VSS make this pretty straightforward.
- personZ 13y agoThe rareness assumption comes about given that the general response to the exploit is a complete blindness to the possibility that it was exploited before it gained public awareness: There seems to be a complete lack of ability by almost all players to "go back in time" and detect exploits. I imagine a government agency, particularly dealing with revenue, might be a primary user of such a tool, though.
- 3pt14159 13y agoThe CRA is the most competent organization in all of Canada, public or private. They probably log every packet. Worst case scenario they are looking into streams of suspicious behavior, like Russian IPs attempting to validate the SINs somewhere else, like at a bank.
- tlrobinson 13y agoGeneral question: the leaked data in the heartbeat packets is encrypted, correct? If the service doesn't use perfect forward secrecy they would definitely be able to decrypt those packets to see what was leaked. What if they did use PFS?
- 3pt14159 13y agoThat is a really good question! I would only be guessing at whether or not they have PFS or not. On the one hand, it leaves the past vulnerable in case a breach happened, but on the other it makes diagnosing what much harder in cases like this.
- tlrobinson 13y agoActually now I'm not sure if heartbeats are encrypted: "It is irrelevant whether your system can even support some of the cipher suites in the list, because the Heartbeat request that triggers the vulnerability is sent before any encryption takes place." http://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts- http://www.hut3.net/blog/cns---networks-security/2014/04/14/...
- 3pt14159 13y agoInteresting. So this leads me to believe that they do record every packet.
- mschuster91 13y agoEasy: check the access logs for all those people who logged in in a given timeframe and assume these are pwnd.
- mrtron 13y agoThat would be substantially higher than 900.
- moyix 13y agoDepending on how the exploit is written it can be encrypted or unencrypted. If the heartbeat is sent before the TLS handshake is finished, then the memory contents will be sent in the clear. If it is sent after the handshake is finished (meaning all crypto stuff has been agreed on by both sides) then the data will be encrypted. This also makes Heartbleed very hard to detect on the wire in general.
- boombip 13y agoWhy do you say that the CRA is the most competent organization in all of Canada? Not doubting that it could be or anything I was more wondering on what basis you made that claim.
- Plasmoid 13y agoA few years ago the CRA messed up a tax return of mine and credited my payments to the next year. I got a letter from them saying your tax bill of $11k has not been paid, please pay it, and here are some interest payments due, also you have $11k in credit for next year. So I called them up, waited on hold for 5 minutes. I spoke with a CRA rep who said "Yup, we screwed up. Fixed". And it was fixed. Total time to fix an $11K screw up? 15 minutes. Try that with any other organization.
- dobbsbob 13y agoThey are at least more competent than this department who lost an unencrypted drive with 583,000 SIN#'ers http://o.canada.com/news/national/federal-government-loses-hard-drive-with-information-on-more-than-half-a-million-people/ http://o.canada.com/news/national/federal-government-loses-h...
- 3pt14159 13y agoI have a pretty complex tax life, I know many accountants and tax lawyers, my uncle was an Auditor for the Auditor General's office, my mom used to work for the CRA, I've spoken to them multiple times. Every single interaction with them and every single person I know that has to deal with them has been nothing but mindblowingly professional. Even on the phone, they are exceptionally good at getting to the point IMMEDIATELY but without the normal "this isn't the right department" BS that every other Canadian government agency has. It's hard to even think of a number two. The Supreme Court maybe? Elections Canada? Ellis Don?
- User8712 13y agoAgreed. I had the pleasure of calling CRA last month to sort out a problem. I spent an afternoon trying to piece together all these letters, payments, refunds, etc, and what exactly went wrong. Anyway, I call, and it was the closest thing to magic I've ever seen. I give reception my SIN, and ask for the woman that signed the letter I received. I'm on hold for only 10 or 20 seconds, the woman answers, and greets me with my name. I didn't say more than a couple of sentences explaining the issue, and she says she'll check her computer, taps a button and poof she knows everything. Literally a few more seconds, and everything is sorted, and a cheque is being mailed. I was almost speechless, I was expecting a 30 minute call between departments, explaining numbers, CRA scratching their heads since this was taking place across multiple provinces, and then me having to physically mail in a variety of personal information. Instead, it was a 1 or 2 minute call with an incredibly friendly woman, and she was so organized, it's like she spent the day preparing for me to call in advance. And, to reiterate, this was the woman that signed the original letter I received, not someone from support or customer service. Now, the CRA website is a nightmare, but talking to them on the phone was the most impressive service I've ever encountered.
- cones688 13y agoMost enterprise security tools could pick this up the night it became a CVE, or IBM QRadar could.... http://securityintelligence.com/heartbleed-vulnerability-security-intelligence-tool/ http://securityintelligence.com/heartbleed-vulnerability-sec...
- deleted 13y ago[deleted]
- richardlblair 13y agoI have had friends who work at the CRA. Apparently they are pretty good at monitoring activity. For instance, one guy looked up the information attached to his SIN. Something like an hour later RCMP showed up, and escorted the fellow out of the building.
- tomcorrigan 13y agoIf they were that good they would have patched heartbleed a lot sooner.
- igrekel 13y agoActually they did close the web services quite early. It is likely they are not the only ones with a similar problem, only they did notice the bug was being exploited and did act and communicate on it. And you don't really expect them to blindly patch things right away do you?
- dobbsbob 13y agoI'm going to assume they calculated this by simply counting the amounts of returns filed/logins done during the time the exploit was announced to being patched and wrote them off as compromised. Maybe the Canadian government should walk down to the CSEC offices and ask them hey can you guys stop conspiring with the rest of the 5 Eyes Alliance to sabotage IETF standards