Re: Security breach at multiple Federal agencies via SolarWinds

[Rick Moen <rick@linuxmafia.com>]

Quoting Michael Paoli (Michael.Paoli@cal.berkeley.edu):

> I think Rick Moen - and others, have already quite well covered it.
> Though I might come from slightly different perspective,
> and maybe if I were sufficiently motivated, I might find a few
> minor bits to quibble slightly over, but I think Rick already pretty
> much has it spot on well covered.

Since as mentioned I _literally_ was trying to assess the news coverage
in real time as I read it, I'd not be the least bit surprised at my
having missed things.  And also, there will doubtless be plot twists. 
Anyway, all I promised was a quick take.

> First of all, yes, it's a big deal.

Seconded.  A _lot_ of important government institutions, businesses,
research institutions, etc. now have to worry about undetermined amounts
of security compromise, and that is a Big Problem.  It's a problem
equally if the institution decides it might have been rooted and decides
to do a ground-up rearchitecting and rebuild, if the institution elects
to shrug off the problem and bet that it'll get away with it, or -- most
likely -- if the institution takes a few half-assed ineffective steps
involving buying some more security wooga-wooga.

Anyone who's worked in the field has seen management go for dumb
wooga-wooga 99 times out of 100 -- and never learning from experience.

Like, for example, corporate board rooms all over the world are having
briefings where the point discussed is "We relied on SolarWinds Orion
Platform for network management and ran versions said to have been
trojaned, and have excised that software and changed all passwords, 
but really have no idea whether systems have been intruded upon by
criminals, what systems, and whether we've now locked them out."
Rationally, the next point of discussion _ought_ to be "Why is our 
internal monitoring and detection is so bad, that we cannot answer that
question?", but experience says it won't be.

Instead, they'll just at most buy a consulting package to issue a report
and make some recommendations, so management can claim they followed
"best practices".

http://linuxmafia.com/~rick/lexicon.html#best-practices

   Best Practices

   Making sure your blunders are popular ones. Rationally, this term 
   _should_ mean "methods that meet professional standards of competence
  and due care", but tends instead to be a managerial code phrase
  meaning "If anything goes wrong, I want to escape being a specific
  target of blame by pointing out that our hapless cock-up was the same
  one countless others made, too."


> Additionally, something gravely lacking here in so many places,
> adequate monitoring and detection.  This should'a been caught a whole
> lot sooner and stopped and shut down ... but ... it wasn't.

Quite.

This is exactly where FireEye stands out for its leadership.


> One of the posts I saw mentioned, Debian, and "what if", as if what if
> something like that had happened to Debian?  Well, fair number of
> years back, it kind'a did.  A Debian Developer (DD)'s key was
> compromised.  And some bad folks started doing some nasty stuff - even
> using a Zero-day
> https://en.wikipedia.org/wiki/Zero-day_(computing)
> exploit.

And, as it happens, I wrote in some depth about it for _Linux Gazette_:
http://linuxmafia.com/~rick/constructive-paranoia.html

In particular, I pointed out how and why the Debian Project detected
within one day the compromise of four of their machines _despite_ it
having been a zero-day kernel exploit, took immediate effective action,
and wrote an authoritative after-action postmortem report.  Also, I 
pointed out that the Debian package archive was not compromised by the
intruder, and why.

As I mention in the article, Gentoo Project was likewise hit by the same
kernel security bug and that the compromise was detected within an
_hour_ by effective use of an IDS and a file-integrity checker.

These were two all-volunteer geek projects, and yet, when challenged by
an existential security threat, they responded correctly and effectively
-- succeeding immediately to a worse threat than SolarWinds faced, and 
where SolarWinds allegedly had absolutely no idea they'd vfailed at
their one job for something like eight months (until customer FireEye
briefed them).

> Well, was bit earlier, but in any case, SolarWinds blames
> Open Source.
> https://thwack.solarwinds.com/t5/Geek-Speak-Blogs/The-Pros-and-Cons-of-Open-source-Tools/ba-p/478665

Oh, that is, as Dana Carvey's Church Lady used to say, Extra Special.  ;->
How does crow taste, Greg W. Stuart?

This _partcular_ Greg W. Stuart appears to be one of a stable of
rent-a-pundits SolarWinds publishes.
https://orangematter.solarwinds.com/brains/  If I have found the correct
one in hunting around, this one is an ex-USAF guy who fell in love with 
VMware while in the service, and then decided that he's an IT expert.

-- 
You received this message because you are subscribed to the Google Groups "BerkeleyLUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to berkeleylug+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/berkeleylug/20201221223007.GC28791%40linuxmafia.com.