3 ms·

Direct link to the CRA response http://www.cra-arc.gc.ca/gncy/sttmnt2-eng.html http://www.cra-arc.gc.ca/gncy/sttmnt2-eng.html "Regrettably, the CRA has been no

by anaphor 13y ago

Direct link to the CRA response http://www.cra-arc.gc.ca/gncy/sttmnt2-eng.html http://www.cra-arc.gc.ca/gncy/sttmnt2-eng.html "Regrettably, the CRA has been notified by the Government of Canada's lead security agencies of a malicious breach of taxpayer data that occurred over a six-hour period." That seems to be implying that another government agency (RCMP? CSEC?) monitors at least the CRA network and does some kind of deep packet inspection and/or packet logging. So are they logging every packet that gets sent to the CRA network? Or did they know about it beforehand and could detect it in real time with an IDS?

CanSpice 13y ago
Also mentioned in that link is Shared Services Canada, which appears to be a division that's tasked with bringing the various departments' IT infrastructures under a single umbrella. From their website (http://www.ssc-spc.gc.ca/index-eng.html http://www.ssc-spc.gc.ca/index-eng.html): "Shared Services Canada was created on August 4, 2011 to fundamentally transform how the Government manages its information technology (IT) infrastructure. Its mandate for the provision of enterprise-wide IT-infrastructure services represents better value for money and a more reliable IT infrastructure to support modern government operations."
meowface 13y ago
Agreed, it's quite impressive they were able to detect this attack and find its source so quickly after a brand new vulnerability was exposed. If a central agency is managing security for various important government systems, they may have full packet capture logging for up to the past 48 hours or longer. An analyst may have downloaded the entire packet capture and used a tool like Wireshark to drill down into all heartbeat requests, and then use filters to find suspicious and malformed requests. One example of how they could do this is with the advice given here: http://security.stackexchange.com/a/55533 http://security.stackexchange.com/a/55533
kyrra 13y ago
Depends on the timeline. IDS rules for detecting attacks aren't all that complicated. But getting those rules into place before attackers went crazy is a whole other thing. So either their network security people were on the ball or they were possibly recording traffic and ran a playback of the data against a detection ruleset. Also, the US may be similar to Canada in this respect. I believe the Department of Homeland Security[0] handles a lot of the network security for much of the federal government. [0] http://www.dhs.gov/network-security-deployment http://www.dhs.gov/network-security-deployment

by anaphor 13y ago

CanSpice 13y ago

Also mentioned in that link is Shared Services Canada, which appears to be a division that's tasked with bringing the various departments' IT infrastructures under a single umbrella. From their website (http://www.ssc-spc.gc.ca/index-eng.html http://www.ssc-spc.gc.ca/index-eng.html): "Shared Services Canada was created on August 4, 2011 to fundamentally transform how the Government manages its information technology (IT) infrastructure. Its mandate for the provision of enterprise-wide IT-infrastructure services represents better value for money and a more reliable IT infrastructure to support modern government operations."

meowface 13y ago

Agreed, it's quite impressive they were able to detect this attack and find its source so quickly after a brand new vulnerability was exposed. If a central agency is managing security for various important government systems, they may have full packet capture logging for up to the past 48 hours or longer. An analyst may have downloaded the entire packet capture and used a tool like Wireshark to drill down into all heartbeat requests, and then use filters to find suspicious and malformed requests. One example of how they could do this is with the advice given here: http://security.stackexchange.com/a/55533 http://security.stackexchange.com/a/55533

kyrra 13y ago

Depends on the timeline. IDS rules for detecting attacks aren't all that complicated. But getting those rules into place before attackers went crazy is a whole other thing. So either their network security people were on the ball or they were possibly recording traffic and ran a playback of the data against a detection ruleset. Also, the US may be similar to Canada in this respect. I believe the Department of Homeland Security[0] handles a lot of the network security for much of the federal government. [0] http://www.dhs.gov/network-security-deployment http://www.dhs.gov/network-security-deployment