Slashdot Mirror
Bit9 Hacked, Stolen Certs Used To Sign Malware
tsu doh nimh writes "Bit9, a company that provides software and network security services to the U.S. government and at least 30 Fortune 100 firms, has suffered a compromise that cuts to the core of its business: helping clients distinguish known 'safe' files from computer viruses and other malicious software. A leading provider of 'application whitelisting' services, Bit9's security technology turns the traditional approach to fighting malware on its head. Antivirus software, for example, seeks to identify and quarantine files that are known bad or strongly suspected of being malicious. In contrast, Bit9 specializes in helping companies develop custom lists of software that they want to allow employees to run, and to treat all other applications as potentially unknown and dangerous. But in a blog post today, the company disclosed that attackers broke into its network and managed to steal the digital keys that Bit9 uses to distinguish good from bad applications. The attackers then sent signed malware to at least three of Bit9's customers, although Bit9 isn't saying which customers were affected or to what extent. The kicker? The firm said it failed to detect the intrusion in part because the servers used to store its keys were not running Bit9's own software."
"Our software is good, so good -- infact, that if we had used it ourselves our software wouldn't have been hacked.". That's one way to preserve confidence I suppose, use recursion.
Revoke the keys, issue new ones, and contact all of your clients on how to update. Check and mate.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Let me guess: these Bit9 geniuses are all ex-RSA employees?
apk is a misunderstood genius
Because 11 is better than 10 or even 9!
Because everyone knows there's no hacking threat. Right?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Why was this system connected to the internet either directly through the main lan or an unsecured vlan?
We have basic white papers and common sense security plans to stop this kind of thing.
Its revolutionary software, I say, Nobody has ever even thought of ... a *whitelist* before!! Why its so a amazing that it, ah, shoot it just killed my dog. Well it was good, before it decided to exterminate all canines. What? The cat too? Well, it apparently hates all pets now. FML. Piece of crap software.
Not Eaten Here
New and improved with 5% more bits!
They're idiots, holding on to outdated tech and business models. They should have shifted everything to the cloud last summer and all of this could have been avoided! They're probable being run by a bunch of old fuckers. Serves them right.
What?
I hate fuckers who make software designed to prevent computer users from using their computer.
What they are developing is really not fundamentally different from something like SELinux.
DRM is only evil because someone who is not the computer owner is unilaterally dictating what you can do with it.
Secureboot, SE Linux, and this stuff from bit9 are all tools that enable the owner of the computer to dictate what software is allowed to run on it.
Why shouldn't the owner decide that flash shall not have access to the internet? Or that flash shall not run. period.
The only time any of this is evil is when the owner isn't in control.
-smartass- I hope they used the stolen *keys* to sign malware -/smartass-
Impressive:
Well... technically right, but the "product" people buy is not just the software: It is the whole package, which includes the on-going maintenance of whitelists, signing binaries and whatnot. And that appears to have been badly compromised.
Surely, if the product is that great, then you can relax, right? Isn't that what you're selling to your customers? "Security in a box?" (I know. Security is an on-going process, but not if you ask sales)
Repetition Repetition... "product not compromised" ... except that it no longer provided any protection against those evil hackers?
I think I'm getting my head around doublespeak - will be useful when I respond to bugs...
I hate fuckers who make software designed to prevent computer users from using their computer. This applies whether the software claims to be white-hat anti-malware stuff or outright admits it's a tool-of-the-devil locked bootloader or DRM tool.
A company has every right to lock down their own computers. Dumbass employees with Admin rights = disaster!! This software is similar to SUA + AppLocker (deny all) + whitelisted certs and it's a solid approach.
Just like the RSA hack..the infiltrators here appear to be just after signing certificates. They must have an objective to hack a client that uses Bit9 systems and thus required whitelisting. That means that some client of Bit9 is about to get seriously compromised.
What a shame. The truly bullshit "security" companies (as opposed to the moderately bullshit ones line bit9) will go on making money with AV software, while someone who sort of tried to do things right (whitelists) is utterly clobbered. But they did fuck up.
Ok, so you didn't run your own wares, kind of like back when (and maybe this is still the case) OpenBSD was hosted on Solaris systems. ;-)
Beyond that, though, we see another failure here, and it's one that it also shared by most of today's HTTPS problems and even some of the proposed fixes: single signers, totally trusted as part of the totally-unrealistic all-or-nothing trust model.
In PGP, imagine the conspiracy that's required to compromise a stranger's identity, for one which you might happen to believe due to it being certified by three "moderately trusted" parties. Three amateurs could trivially supply vastly better security than a major government contractor. It's that easy to do better than what bit9 did, with 20-25 year old solutions.
Something like this will happen again. Something like this does happen every few months, it seems, when some root CA is found to be shady or compromised. The lesson: one signature is not enough. Require a conspiracy, or require that some uber-badass break into multiple different systems, administered by different people, in a narrow band of time. It makes sense, whether it's to get a email public key, or check a signed binary, or whatever. If it's important then do it right. And if it's not important, then why did you pay bit9?
The only time any of this is evil is when the owner isn't in control.
Several fans of game consoles and Apple consumer electronics would claim that some individual hardware owners can't be trusted not to disable security to see dancing animals, and taking control away from them is in their own good. They tend to pop up every time the Android trojan story of the week breaks or the Ouya project reaches another milestone.
CAs keep getting hacked recently. How can I place my trust on CAs these days? Perhaps the browser should inform the users about certificate change for individual websites, similar to SSH?
They say they got hacked because they did not run their own software. I see another reason: either one of the accredited operators of the signing infrastructure launched a malware on their signing machine (scaring), or the signing machine offered hackable services on the company network (scaring again).
The reason viruses are such a problem is that blacklisting simply can't work, and "detecting malicious activity" is HARD.
Ultimately, capabilities are the real answer to "detecting malicious activity". OLPC Bitfrost protections, Android permissions, Ubuntu AppArmor, and Mac App Store entitlements work by characterizing the threat model, finding which actions are sensitive, and giving applications just enough privileges to do their work. AppArmor whitelists the parts of the file system that an application can see. Android permissions have been criticized as being yet another extra screen that the user just taps through to see the dancing bunnies, and some of this criticism is warranted especially for applications that request too many privileges that they don't really need. OLPC Bitfrost goes beyond that by making some privileges mutually exclusive at install time, such as Internet and directory scan, unless the user manually adds privileges to an application after install.
The right, certainly. But turning a computer into a glorified cash register running only "approved" apps is a terrible move, even when you own it. Sure, you prevent malware. You also prevent everything else.
The right, certainly. But turning a computer into a glorified cash register running only "approved" apps is a terrible move, even when you own it. Sure, you prevent malware. You also prevent everything else.
From the summary:
Bit9, a company that provides software and network security services to the U.S. government and at least 30 Fortune 100 firms
This has nothing to do with consumer toys or personal computers. It's to do with gov't/corp workstations. It prevents employees from accidentally installing unsigned updates and plugins. It prevents spies, defectors or hackers from stealing the "secret sauce". The integrity of the certs is crucial to its effectiveness.
Removing rights from your own Windows acct. is not a bad idea and can be comfortable with tools like SuRun
(I'm the same AC that you replied to)
Is that a big DUH! or what? Not running their own stuff? Idiots.
The problem is that Microsoft had the manufacturers use an implentation that's hard to use for non-Microsoft OS's. The FSF proposed a fair implementation, but Microsoft said no. That alone proves what their goal is.
It also prevents employees from deliberately installing useful items. It means they have to do their work on the computer in exactly the way that work has always been done; if they think some tool will make things easier or more efficient, that's just tough because they can't install it.
Imagine if you had to do everything in edlin because some program refused to let you install your favorite editor.
It also prevents employees from deliberately installing useful items. It means they have to do their work on the computer in exactly the way that work has always been done; if they think some tool will make things easier or more efficient, that's just tough because they can't install it.
Imagine if you had to do everything in edlin because some program refused to let you install your favorite editor.
I understand the frustration but you're judged by your peers performance and they're dealing with the same handicaps. Efficiency takes a backseat to security. If this is unacceptable then find another job.
Fortune 100 and gov't agencies are high value targets. We're not talking about preventing run-of-the-mill malware but targeted attacks that utilize unknown unknowns. The best way to safeguard is to assume that the OS and every piece of software has unpatched vulnerabilities, that every employee is a wolf in sheep's clothing and LOCK IT ALL DOWN. Any "new" software needs to be vetted to levels that not all will pass. That's just the way it is and for good reason.
This breach is about as bad as it gets and heads will roll but it's no reason to throw solid security practices out the window. On the contrary, it proves the paranoia is founded.
The problem is that Microsoft had the manufacturers use an implentation that's hard to use for non-Microsoft OS's.
How so? Any hardware vendor that wishes to release linux preinstalled hardware will have no difficulty whatsoever.
The only part that is 'harder' is taking windows pre-installed hardware and converting it to another operating system. And that is ENTIRELY THE POINT OF SECURE BOOT -- that there is something preventing arbitrary unknown software booting up with the PC... whether a rootkit, or the neighbor kid 'hacker' with a live thumbdrive etc. Now, sure, switching operating systems on a computer that shipped with Windows requires the owner either disable the lock, or re-key the system to run something else.
But how is that 'evil'? That's the reasonable price of increased security.
The FSF proposed a fair implementation, but Microsoft said no.
Which FSF proposal are you referring to specifically? The one where they wanted systems to be shipped with secureboot off and then users could turn it on? Resulting in piles of confused users, and users who left it off and needlessly reduced their own security? Yeah, that would have been great.
That alone proves what their goal is.
Even without knowing exactly what you are talking about, it proves nothing. There is nothing about the current secureboot implementation that is overly discriminatory against alternative operating systems.