Slashdot Mirror
Schneier Explains How To Protect Yourself From Sony-Style Attacks (You Can't)
phantomfive writes: Bruce Schneier has an opinion piece discussing the Sony attack. He says, "Your reaction to the massive hacking of such a prominent company will depend on whether you're fluent in information-technology security. If you're not, you're probably wondering how in the world this could happen. If you are, you're aware that this could happen to any company." He continues, "The worst invasion of privacy from the Sony hack didn’t happen to the executives or the stars; it happened to the blameless random employees who were just using their company’s email system. Because of that, they’ve had their most personal conversations—gossip, medical conditions, love lives—exposed. The press may not have divulged this information, but their friends and relatives peeked at it. Hundreds of personal tragedies must be unfolding right now. This could be any of us."
Related: the FBI has officially concluded that the North Korean government is behind the attack.
But you can mitigate the hell out of it, I suggest air gapping.
Om, nomnomnom...
Nobody mentioned "The Interview" or North Korea until days after the attack, then it simply appeared from nowhere and asserted itself as the truth. The emails from the hackers are in the stash, and reputable sources who have time to read such things have reported that not a single email from GOP prior to the release mentioned The Interview, only demands for money.
and throw in some mass drops of MP3 players loaded with Sony tunes on the country.
There's no call for such drastic and morally questionable measures, yet; let's just try airstrikes first.
Security is not easy, but it can be done. But most companies like security theater it's cheaper, until something like this happens.
Ding! Problem solved!
Likewise, how long does it take to download 100TB of data? I'm guessing that this was probably something that took a bit of time to pull off, and they probably should have found something while all this data was flying out of their system.
XDInd
it happened to the blameless random employees who were just using their company's email system. Because of that, they've had their most personal conversations -- gossip, medical conditions, love lives -- exposed
If you were using your company's Exchange server for gossiping and thought it was safe (i.e. the IT department would never have access to this, oh no) then you're stupid and deserve whatever fate you get.
I can sympathize with the people whose SS numbers were stolen out of no fault of their own. But Amy Pascal making Obama black jokes on company email was just stupid as hell and she deserves whatever scorn people will heap on her.
I'd be interested in knowing the details of the attack. Was it a "social engineering" attack of some kind (ie. a virus-laden email that someone with high privileges opened)? Was it a vulnerability in their networks? I've heard someone with high level admin privileges had their account hacked, but in what way was it done?
The organization I work for is a contractor for the government of a North American jurisdiction, and yesterday morning I started getting reports that some sort of virus-laden emails were flowing out of this government's networks. Sure enough, within a half an hour, I got emails from a contact I have within this particularly agency, with an attached ZIP file with an SCR file inside. That has to be one of the oldest ways that malware has been transmitted in Windows system, I saw my first virus-laden SCR file somewhere around 1997-1998.
Apparently this critter is so new that by the time we checked, only a few AV companies had caught on to it. Even worse in some ways is that it appears that it made its debut on the very government servers in question, making me think this was a targeted attack. So you have a combination of a brand new virus of some kind that won't get caught by the scanners, lax email rules that allow the opening and execution of executable file types (not that blocking EXE variants doesn't mean some bastard won't be firing off a compromised PDF at an unpatched system), and users who through a combination of laziness and ignorance happily take the final step.
With this particular attack, there would have been no problem if Outlook had been configured not to open these kinds of attachments, and in an Active Directory environment, that's pretty trivial, so some of the blame has to go to this government agency's IT team. But still, even with the best safeguards, where users just happily click on any old attachment, it doesn't exactly take a rare alignment of the stars to have malware planted in a network. Sure, it won't have root privileges and won't be able to propagate itself via more sophisticated means, but it appears in this case it didn't need to.
So I do agree to some point that there are finite limits to what any person or organization can do to secure itself against a determined and directed attack. But there are ways to make such attacks much more difficult, and more quickly captured before they wreak too much harm.
The world's burning. Moped Jesus spotted on I50. Details at 11.
While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:
* Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.
* The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
* Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.
"First they came for the slanderers and i said nothing."
If they have nothing to hide, they shouldn't worry. Who cares about their boring lives?
... said the Coward who posted anonymously.
Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
Because Sony Pictures is an American subsidiary of the Japanese conglomerate, which was based in the US and the majority of the affected employees were US citizens or at least Residents?
He knows what he is saying. He said that if you are targetted in a high-skill, high-focus attack, it's basically game over.
It's like defending yourself from a random mugging on the streets and surviving a professional hitman. You can make it harder to be attacked by a random hacker or a unfocused hacker, but it's impossible to defend yourself from all kinds of attacks of a very skilled hacker focused on attacking you.
The other advantage of the air-gapped network is that you no longer "need" to update the computers within the network with most of the security updates that come across Windows Update. Build them from DVDs & SPs with known hash values, never having connected them. Who cares if those PCs are still stuck on Win7-SP1 or Win8.1 RTM. Their primary attack vector (e.g. the big bad Internet) is unavailable. Even if these machines are built with malware, the worst that could happen is that they get erased, but the data still doesn't go out.
But what about e-mail? IM? Interwebs? Facebooking? Really??? Buy a 2nd, low end PC, wirelessly connect it to the corporate network, and volia! Hell, you could even use a KVM for this purpose, if you'd rather not spring for the expensive $400 laptops. Don't take the easy approach of connecting the networks in a way that only allows for RDP sessions--a determined hacker with unlimited funds (e.g. state sponsors) would figure that one out.
But what about Adobe Cloud or whatever program needs to connect to the Internet? Most such programs have alternative options for air-gapped networks (e.g. a license server), and a company like Adobe could be brow-beat by a company like Sony into disabling phone home. For high-risk applications where you can't talk your vendor out of phone-home, it's time to look for a new vendor...
Windows 3.1x calc: 3.11 - 3.10 = 0.00
Why MP3 players? Drop Sony CDs on NK to install a rootkit on every computer in the country.
He forgot the next step, always burn the flash drive afterwards.
That's why they're called flash drives right?
XML is a known as a key material required to create SMD: Software of Mass Destruction
You do have to cut them a little slack, here. If we were talking about a coal mining company or something and terabytes of data going out the door would be pretty unusual, and SEIM systems would be trained to flag that sort of thing.
This is Sony Pictures, though, terabytes probably go out the door all the time. I mean that might be less than a few hours of uncompressed video going to a contractor for post processing or something.
No my bigger question having done this kind of thing for a living now for some time is why would a basically purely IP organization not have effective controls in place, to know what kind of data is going out the door and to put a hard stop to it the moment something that should not be there is spotted.
Ok you can't maybe do that with the aforementioned video data, but you certainly can watch for byte patterns that look like address, SS numbers, e-mails in usually great quantity etc on the wire.
You certainly do not allow anything encrypted to go out unless you MITM it. Could an attacker do something like slap some mpeg headers on top a big encrypted data stream? probably, but they'd have to know to do it.
If my entire world was IP like Sony Pictures id probably take it a few steps further make sure my firewall devices knew the common container formats for various media types and continued to make sure sync bytes and frame markers occur where they ought to, anytime more than a hanful of megabytes of something I can't recognize flowed it would alert and some form the CERT team would pick up the phone a call whoever it was associated with that source IP. No attribution shut it down, no explanation shut it down.
The hardware and software to do this is commercially available, more or less off the shelf and has been for at least five or seven years now.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I'd be interested in knowing the details of the attack. Was it a "social engineering" attack of some kind (ie. a virus-laden email that someone with high privileges opened)? Was it a vulnerability in their networks? I've heard someone with high level admin privileges had their account hacked, but in what way was it done?
I can't find the story, but if i recall correctly, the short version is that the hackers probed Sony, couldn't get in, then started targeting affiliated companies until they found a remotely exploitable vulnerability.
Once they breached that company's network, they found cached(?) credentials for a top Sony sys admin account and used that to access the US Sony intranet.
They mapped the intranet, spread malware all over the place, exfiltrated ~100TB over the course of a ~year, then changed everyone's screensaver and went nuclear with the wiper attack.
[Fuck Beta]
o0t!
This could be any of us. We have no choice but to entrust companies with our intimate conversations: on email, on Facebook, by text and so on. We have no choice but to entrust the retailers that we use with our financial details. And we have little choice but to use cloud services such as iCloud and Google Docs.
Bullshit. There's always a choice. It's often less convenient, but that's a far cry from not having one.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
This tells a lot about what was first reported and how the actual claim of it being North Korea was fabricated. Most interesting is the line "Among the more than 11,000 newly-released files are hundreds of employee usernames and passwords as well as RSA SecurID tokens and certificates belonging to Sony". Ahhhh yea I'm going to say North Korea wasn't involved in the least in this......... Former employee(s) seem about a million times more likely.
What this shows yet again is that anti-virus scanners are a flawed methodology. There will always be a delay between a virus being released and the signature updates getting to the clients. It's inherent in the concept.
Unfortunately, some early technology journalists were partially responsible for this because, in reviews, they ranked anti-virus products that identified threats by signature higher than ones that identified threats through behaviour -- and this was because signature analysis also provided a name to the threat. In other words, the flawed idea that if you tell the user a name for the threat, you provide better protection than if you just block it. This reinforced the concept of signature analysis and slowed down research of identification of threats based on generic behavioural patterns.
The real "Libtards" are the Libertarians!
Partially, yes, for three reasons:
So yes, I wholeheartedly dispute your blanket analogy on the grounds that is a flawed analogy, and that we don't know enough about our planet to make any intelligent predictions or models at this time. Indeed, every model we have, when fed historical temperature data, says we should be at much higher temperatures than we are now. Most assume some kind of blanket model, but since none match our measured results, we can conclude that a simple blanket model does not match the complex reality of the systems on Earth.
Beware of bugs in the above code; I have only proved it correct, not tried it.
"Galactica is a reminder of a time when we were so frightened by our enemies that we literally looked backward for protection..."
... and, of course ...
"... But I will not allow a networked, computerized system to be placed on this ship while I am in command."
We live in a world of Cylons.
More than likely, in a world without PHP, another language with similar benefits and drawbacks to PHP would likely have been invented.