Everyone Has Been Hacked. Now What?

http://www.wired.com/threatlevel/2012/05/everyone-hacked/

by jordhy • 14 years ago

47 27 14 years ago

If they are taking the 'drastic' step of bringing everything offline, how about banning future internet explorer use in all sensitive areas. Chrome would provide much better security thanks to its update mechanism. Any workplace still using this abomination is just begging to be hacked.

cheald• 14 years ago

Is Chrome be subject to being used as a malware delivery vector if you could MITM the DNS? Or does its SSL pinning prevent that (presuming that the updates happen over SSL)?

option_greek3• 14 years ago

Interesting.. theoretically SSL should prevent MITM of this kind. But if you are able to redirect at DNS level, probably you can deliver your own certificate and its authority.

simonbrown• 14 years ago

To my knowledge, it's both sent over SSL and signed with its own key.

SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.

dkokelley2• 14 years ago

Here's the thing, network security needs to be balanced against organizational operations. Internet Explorer has been sold to organizations as a platform where thin client applications can be deployed cheaply. Internet Explorer doesn't update automatically because the last thing Microsoft wants to do to their clients is break all of their web apps through an untested update. Security updates also need to have backwards compatibility, or large firms won't upgrade, since their web apps might break.

Security and usability are at odds. Large organizations (thus far) tend to favor usability. It's a cost-benefit analysis, and the benefit of not redeveloping their web apps outweighs the cost of increasing security.

fjarlq• 14 years ago

Considering the type of work that goes on at Oak Ridge, I'm not so sure they correctly calculated the true cost of using Windows and Internet Explorer....

reidrac2• 14 years ago

If their applications break because of an upgrade of IE (or even if the apps doesn't work with a different browser/operating system), I'm not sure their problem is with security.

It's true that after the attackers got the entry point, there are several thing wrong according to article (ie. "Four days after the e-mails arrived, administrators spotted suspicious traffic leaving a server." -- so they got a mail that used an IE vulnerability, and then a server got affected?).

Joeri• 14 years ago

I've had chrome updates that broke working standards-compliant code. There's some truth to IE stability between minor releases. The problem is that every major release of IE so far has required big changes (usually to take out IE-specific code). What they win on minor updates, they squander on the major ones. Chrome and firefox haven't had that much of migration pain in years.

gbog• 14 years ago

Not only that, but also active directory,which requires a window server, which requires a special dns thing, which almost requires a dns serviced by windows. An endless chain of turds...

snowwrestler• 14 years ago

Chrome is less protection that you might think, given that most spearfishing attempts target Flash, PDF, or Java vulnerabilities.

scotty792• 14 years ago

I find it comforting that no matter how much money you have someone still can get the information you are trying to hide.

keithpeter• 14 years ago

So another way of 'shortening the perimeter' that you are trying to defend would be to simply decide that some information does not have to be hidden?

How much information does a commercial company selling a product or service have to keep secret?

* User details

* Future plans that might affect customers or employees

* 'Secret Sauce' stuff like code if it is closed source or plans &c

What else?

scotty792• 14 years ago

I'm all for operating as publicly as you can while being prepared that things that you have not made public can become public at any moment.

I think companies should put more effort into looking for ways how to provide service without gathering and storing user details.

Examples being lastpass and various storage services that can't access filess you keep at their machines.

comex• 14 years ago

> On Apr. 7, 2011, five days before Microsoft patched a critical zero-day vulnerability in Internet Explorer that had been publicly disclosed three months earlier on a security mailing list

I don't think "zero-day" means what you think it means.

InclinedPlane• 14 years ago

"zero-day" doesn't mean what it means any more. Today it means only "unpached security hole", full stop. Sadly, a lot of security terminology use has tended more towards the desire to provide a titillating story than to accurately portray facts.

lawnchair_larry3• 14 years ago

zero day has always meant an unpatched vuln.

roc2• 14 years ago

Zero-day was coined to describe malware being found in the wild that exploits a previously unknown vulnerability. The terminology is literally referring to there being zero days between discovery of a vulnerability and discovery of malware in the wild that exploits it.

They are prized in the black hat community specifically because they've never been disclosed and thus no-one has had any chance to patch the vulnerability.

In this case the vulnerability was known and unpatched for three months. It was more like a 90-day exploit than a 0-day exploit.

lordlicorice• 14 years ago

This reads like a thinly-veiled advocacy for CISPA.

Everyone Has Been Hacked. Now What?

Related Stories