Slashdot Mirror
Bit9 Hacked, Stolen Certs Used To Sign Malware
tsu doh nimh writes "Bit9, a company that provides software and network security services to the U.S. government and at least 30 Fortune 100 firms, has suffered a compromise that cuts to the core of its business: helping clients distinguish known 'safe' files from computer viruses and other malicious software. A leading provider of 'application whitelisting' services, Bit9's security technology turns the traditional approach to fighting malware on its head. Antivirus software, for example, seeks to identify and quarantine files that are known bad or strongly suspected of being malicious. In contrast, Bit9 specializes in helping companies develop custom lists of software that they want to allow employees to run, and to treat all other applications as potentially unknown and dangerous. But in a blog post today, the company disclosed that attackers broke into its network and managed to steal the digital keys that Bit9 uses to distinguish good from bad applications. The attackers then sent signed malware to at least three of Bit9's customers, although Bit9 isn't saying which customers were affected or to what extent. The kicker? The firm said it failed to detect the intrusion in part because the servers used to store its keys were not running Bit9's own software."
"Our software is good, so good -- infact, that if we had used it ourselves our software wouldn't have been hacked.". That's one way to preserve confidence I suppose, use recursion.
Revoke the keys, issue new ones, and contact all of your clients on how to update. Check and mate.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Let me guess: these Bit9 geniuses are all ex-RSA employees?
apk is a misunderstood genius
Because 11 is better than 10 or even 9!
going to continue, - Netcraft has [amazingkreskin.com] with the laundry cleanF for the next another cunting
I hate fuckers who make software designed to prevent computer users from using their computer. This applies whether the software claims to be white-hat anti-malware stuff or outright admits it's a tool-of-the-devil locked bootloader or DRM tool.
Because everyone knows there's no hacking threat. Right?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Why was this system connected to the internet either directly through the main lan or an unsecured vlan?
We have basic white papers and common sense security plans to stop this kind of thing.
Its revolutionary software, I say, Nobody has ever even thought of ... a *whitelist* before!! Why its so a amazing that it, ah, shoot it just killed my dog. Well it was good, before it decided to exterminate all canines. What? The cat too? Well, it apparently hates all pets now. FML. Piece of crap software.
Not Eaten Here
New and improved with 5% more bits!
They're idiots, holding on to outdated tech and business models. They should have shifted everything to the cloud last summer and all of this could have been avoided! They're probable being run by a bunch of old fuckers. Serves them right.
What?
-smartass- I hope they used the stolen *keys* to sign malware -/smartass-
Impressive:
Well... technically right, but the "product" people buy is not just the software: It is the whole package, which includes the on-going maintenance of whitelists, signing binaries and whatnot. And that appears to have been badly compromised.
Surely, if the product is that great, then you can relax, right? Isn't that what you're selling to your customers? "Security in a box?" (I know. Security is an on-going process, but not if you ask sales)
Repetition Repetition... "product not compromised" ... except that it no longer provided any protection against those evil hackers?
I think I'm getting my head around doublespeak - will be useful when I respond to bugs...
Just like the RSA hack..the infiltrators here appear to be just after signing certificates. They must have an objective to hack a client that uses Bit9 systems and thus required whitelisting. That means that some client of Bit9 is about to get seriously compromised.
What a shame. The truly bullshit "security" companies (as opposed to the moderately bullshit ones line bit9) will go on making money with AV software, while someone who sort of tried to do things right (whitelists) is utterly clobbered. But they did fuck up.
Ok, so you didn't run your own wares, kind of like back when (and maybe this is still the case) OpenBSD was hosted on Solaris systems. ;-)
Beyond that, though, we see another failure here, and it's one that it also shared by most of today's HTTPS problems and even some of the proposed fixes: single signers, totally trusted as part of the totally-unrealistic all-or-nothing trust model.
In PGP, imagine the conspiracy that's required to compromise a stranger's identity, for one which you might happen to believe due to it being certified by three "moderately trusted" parties. Three amateurs could trivially supply vastly better security than a major government contractor. It's that easy to do better than what bit9 did, with 20-25 year old solutions.
Something like this will happen again. Something like this does happen every few months, it seems, when some root CA is found to be shady or compromised. The lesson: one signature is not enough. Require a conspiracy, or require that some uber-badass break into multiple different systems, administered by different people, in a narrow band of time. It makes sense, whether it's to get a email public key, or check a signed binary, or whatever. If it's important then do it right. And if it's not important, then why did you pay bit9?
The only time any of this is evil is when the owner isn't in control.
Several fans of game consoles and Apple consumer electronics would claim that some individual hardware owners can't be trusted not to disable security to see dancing animals, and taking control away from them is in their own good. They tend to pop up every time the Android trojan story of the week breaks or the Ouya project reaches another milestone.
CAs keep getting hacked recently. How can I place my trust on CAs these days? Perhaps the browser should inform the users about certificate change for individual websites, similar to SSH?
They say they got hacked because they did not run their own software. I see another reason: either one of the accredited operators of the signing infrastructure launched a malware on their signing machine (scaring), or the signing machine offered hackable services on the company network (scaring again).
The reason viruses are such a problem is that blacklisting simply can't work, and "detecting malicious activity" is HARD.
Ultimately, capabilities are the real answer to "detecting malicious activity". OLPC Bitfrost protections, Android permissions, Ubuntu AppArmor, and Mac App Store entitlements work by characterizing the threat model, finding which actions are sensitive, and giving applications just enough privileges to do their work. AppArmor whitelists the parts of the file system that an application can see. Android permissions have been criticized as being yet another extra screen that the user just taps through to see the dancing bunnies, and some of this criticism is warranted especially for applications that request too many privileges that they don't really need. OLPC Bitfrost goes beyond that by making some privileges mutually exclusive at install time, such as Internet and directory scan, unless the user manually adds privileges to an application after install.
Is that a big DUH! or what? Not running their own stuff? Idiots.