Russian hack Government, Private sector through Solarwinds

[Jon]

This seems like the largest story we should all be looking at right now but aren't.

Billions Spent on U.S. Defenses Failed to Detect Giant Russian Hack (Published 2020)

The broad Russian espionage attack on the U.S. government and private companies, underway since spring and detected only a few weeks ago, is among the greatest intelligence failures of modern times.

www.nytimes.com

 

[TIDE-HSV]

Personally, I'm just as happy knowing only that it took place. Any detailed information released has the potential to be of use to the Russians. They'd better just quietly fix it!

 

[Go Bama]

It's very scary to think about how long this was going on and what information the Russians may have had access to. It seems like the Russians have made a priority of hacking into our computers. As expensive as cybersecurity is, this should not be happening.

 

[MattinBama]

https://twitter.com/i/web/status/1338952986358292480

 

[4Q Basket Case]

It's very scary to think about how long this was going on and what information the Russians may have had access to. It seems like the Russians have made a priority of hacking into our computers. As expensive as cybersecurity is, this should not be happening.

To paraphrase Derek Bok and one of my all time favorite quotes: You think cybersecurity is expensive? Just try not having it.

 

[dtgreg]

It's very scary to think about how long this was going on and what information the Russians may have had access to. It seems like the Russians have made a priority of hacking into our computers. As expensive as cybersecurity is, this should not be happening.

It's scary to think who they have on the inside helping out.

 

[4Q Basket Case]

It's scary to think who they have on the inside helping out.

You touch on the real vulnerability.

It’s not so much protecting a system from outside threats. Protective measures and software have progressed to the point that that’s not nearly the threat it once was.

The real threat comes from inside. You get the wrong person owing to the wrong people money they can’t pay, but can make all that go away with “only a little“ cooperation, and all those protective measures don’t mean a blessed thing.

Doesn’t matter if you’re talking about the military, the civilian government, financial institutions, your 401k’s custodian.....the real risk is internal, and it’s incredibly hard to mitigate.

Could be as simple as the Administrative Assistant of the head of Corporate Security comes into the boss’s credentials. His girlfriend owes the Russian mafia a bunch of money because of a previous boyfriend’s gambling and drug habit.

Ivan is making her (and his) life hard in ways the American legal system wasn’t built to counter, and can’t even imagine. The AA can clear all that up by “misplacing” credentials nobody even knows he has.

Out of the millions of employees at these places, at salaries ranging from low five figures to low seven figures, it takes only one person, knowing one thing too many, at only one of these, and it’s a problem that affects tens or hundreds of millions of people.

If you’re a bad guy, with essentially unlimited state-sponsored resources, it’s a ton easier to find the vulnerable key person than it is to hack in from the outside, unaided.

 

[dtgreg]

You touch on the real vulnerability.

It’s not so much protecting a system from outside threats. Protective measures and software have progressed to the point that that’s not nearly the threat it once was.

The real threat comes from inside. You get the wrong person owing to the wrong people money they can’t pay, but can make all that go away with “only a little“ cooperation, and all those protective measures don’t mean a blessed thing.

Doesn’t matter if you’re talking about the military, the civilian government, financial institutions, your 401k’s custodian.....the real risk is internal, and it’s incredibly hard to mitigate.

Could be as simple as the Administrative Assistant of the head of Corporate Security comes into the boss’s credentials. His girlfriend owes the Russian mafia a bunch of money because of a previous boyfriend’s gambling and drug habit.

Ivan is making her (and his) life hard in ways the American legal system wasn’t built to counter, and can’t even imagine. The AA can clear all that up by “misplacing” credentials nobody even knows he has.

Out of the millions of employees at these places, at salaries ranging from low five figures to low seven figures, it takes only one person, knowing one thing too many, at only one of these, and it’s a problem that affects tens or hundreds of millions of people.

If you’re a bad guy, with essentially unlimited state-sponsored resources, it’s a ton easier to find the vulnerable key person than it is to hack in from the outside, unaided.

THANK YOU.
This is just so obvious, at least to me. How we can allow Russian money and Russian Mob and KGB people into our Western Democratic alliances and nations and institutions is unfathomable. Nerve agent poisonings - no response. Polonium poisonings - no response. Fiftieth-floor flight attempts - no response.

And then I contemplate the British selling Hitler airplane parts on the eve of WW2. Nothing new under the sun.

 

[Bamaro]

Wait until trump begins his push to build in Moscow. I wouldn't put anything past him.

 

[Jon]

You touch on the real vulnerability.

It’s not so much protecting a system from outside threats. Protective measures and software have progressed to the point that that’s not nearly the threat it once was.

The real threat comes from inside. You get the wrong person owing to the wrong people money they can’t pay, but can make all that go away with “only a little“ cooperation, and all those protective measures don’t mean a blessed thing.

Doesn’t matter if you’re talking about the military, the civilian government, financial institutions, your 401k’s custodian.....the real risk is internal, and it’s incredibly hard to mitigate.

Could be as simple as the Administrative Assistant of the head of Corporate Security comes into the boss’s credentials. His girlfriend owes the Russian mafia a bunch of money because of a previous boyfriend’s gambling and drug habit.

Ivan is making her (and his) life hard in ways the American legal system wasn’t built to counter, and can’t even imagine. The AA can clear all that up by “misplacing” credentials nobody even knows he has.

Out of the millions of employees at these places, at salaries ranging from low five figures to low seven figures, it takes only one person, knowing one thing too many, at only one of these, and it’s a problem that affects tens or hundreds of millions of people.

If you’re a bad guy, with essentially unlimited state-sponsored resources, it’s a ton easier to find the vulnerable key person than it is to hack in from the outside, unaided.

People are always the problem and most hacking isn't technical it is social. I work for one of the largest players in the cyber security space and we regularly test our own employees with fake phishing emails etc and far too often even we fail

 

[4Q Basket Case]

People are always the problem and most hacking isn't technical it is social. I work for one of the largest players in the cyber security space and we regularly test our own employees with fake phishing emails etc and far too often even we fail

I worked for a large regional bank, and it had a fake phishing email routine that I’m sure was similar to the one your company has.

Amazing the number of employees who fell for it. There was a series of escalating consequences. First failure generated a nasty-gram, essentially calling you stupid (in an HR-approved manner). Second required additional training. Soon enough, termination. And a few were terminated over it.

As with lots of things, there were some unintended consequences. A lot of legitimate requests went without response because the recipients feared they were fake.

 

[Jon]

I worked for a large regional bank, and it had a fake phishing email routine that I’m sure was similar to the one your company has.

Amazing the number of employees who fell for it. There was a series of escalating consequences. First failure generated a nasty-gram, essentially calling you stupid (in an HR-approved manner). Second required additional training. Soon enough, termination. And a few were terminated over it.

As with lots of things, there were some unintended consequences. A lot of legitimate requests went without response because the recipients feared they were fake.

what is funny for us is that it is easier here to fall for fake as our systems are so good at catching phishing it gets really easy to assume that you are safe with anything that makes it to you. It is a great exercise and I know of no one fired over it

 

[spock*]

It's scary to think who they have on the inside helping out.

Can you imagine what would happened if the russian insider was the president?

Wait a minute.... what?

 

[2003TIDE]

Seeing a lot of companies panicked about this. Solarwinds got lazy and I don't know that I'd use them at this point until they prove they can use a password stronger than solarwinds123 for their source code repo.

 

[Jon]

Seeing a lot of companies panicked about this. Solarwinds got lazy and I don't know that I'd use them at this point until they prove they can use a password stronger than solarwinds123 for their source code repo.

it is unbelievable how lax and lazy they are. I agree with you but as you know well, once a tool is built into an IT Process it can be hell to remove

 

[Go Bama]

Wait until trump begins his push to build in Moscow. I wouldn't put anything past him.

It's not too hard to imagine the Russians paying off Trump's debt in return for information.

 

[TIDE-HSV]

It's not too hard to imagine the Russians paying off Trump's debt in return for information.

I will almost guarantee it. He will shortly be desperate...

 

[Jon]

I will almost guarantee it. He will shortly be desperate...

he has pulled in like $250M in donations in the last month but I agree, he will still be desperate shortly

 

[2003TIDE]

it is unbelievable how lax and lazy they are.

Oh, I believe it. Like you said people are always the problem. Most end users are idiots with passwords and at least 50% of people in IT are just plain lazy.

 

[92tide]

he has pulled in like $250M in donations in the last month but I agree, he will still be desperate shortly

i imagine he's probably getting close to half a billion by now, or will get there by the time the georgia election is held.

he's currently "fundraising" for the ga senate races with almost all of it going into his pockets.