Comment by Johnny555 | Hacker News Reader

Comment by Johnny555 | Hacker News Reader

Why is there absolutely zero focus on the lack of basic security measures that would prevent a large scale breach like this?

The government still doesn't know exactly what data he walked off with. And while you'd think they'd have stepped up security since then, now Harold T. Martin has again walked off with terabytes of secret data. In both cases, these secrets were stolen by contractors, not even full employees.

I have full admin rights to every server at work, but I can't gain access to customer data without tripping access alarms that notify our security team. How is it possible that the NSA has no similar controls? I realize that such controls can be expensive (in direct costs and ongoing operations), but "with great data comes great responsibility", and if there's any database in the country that needs exceptional controls, it's the NSA's database that is much more valuable than any other corporate database.

How many foreign powers have walked off with even more data undetected because they aren't going to publicize it -- they are likely siphoning off data right now, and the NSA has no idea.

In part, I think you're overestimating how difficult it would be for you to gain access to customer data covertly, given root access to all the servers at your company.

i agree. to some people root still means root which means you can do anything local undetected if you're smart enough (most people aren't). apparently these days it means something else. who knew.

"full admin rights"

When audit logs go to an audit server, you can't do anything undetected, even as root - the initial login, sudo to root and subsequent activity are logged, so even if I log in and kill the audit daemon, that will be detected and tied back to me.

If I even log on to one of the audit servers without prior approval, it will page the security team. And if they can't validate why I've logged in there, they'll lock out my account.

Uhm, you're not using your imagination to put it mildly. There's many ways of getting a plausible deniability.

Plus, breaks are never done through the strongest part of the wall.

Computers can be made totally secure in management minds, and in the minds of the broader public.

We know from stories of break-in after break-in to some of the worlds top companies, that that is a dangerous lie.

Most of these break-ins were done without the conscious cooperation of anyone inside who had admin rights.

Now, just imagine what can be done calculatedly with admin rights.

It comes down to trusting people eventually. It's always about people.

If I could find a zero day exploit that would give me root, that might get me in, but network accesses are logged too, so even if I found a back door way into the server, I'd still be discovered "Johnny, someone altered binaries on our server yesterday, there were no SSH logins, but your VPN session hit our application server port at the exact time the application daemon crashed. Explain?"

Even though I have server admin rights, I can't touch the network so I can't open an unaudited path to the server.

It's not that the server security will keep me from accessing the data, but it will keep me from accessing it without being discovered.

Being able to tell who grabbed the data and when is nice, but what's to stop someone who is willing to grab the data and run/leak?

"my new home alarm system will tell you with 100% certainty after you get robbed, that you were robbed!"

If you have full root access - then you don't go at the customer data directly, that's amateur hour.

Think about how the data is stored... is it within LVM of some sort(this is likely)? If so, create a new LV mirrored from the volumes containing customer data. Since you're root, make sure this new block device is absent from tools like 'lsblk' or walking through /dev/mapper.

That's just one (poor) suggestion. Never think about bee-lining right towards the valuable data though, that's precisely what every IDS is "best" at detecting. Come at it sideways, so to speak :)

Replying just to add another idea that came to me after hitting submit. Use the network-namespaces feature of linux(assuming this data resides on linux). Then you can create the equivalent of a hidden span-port, letting you inspect all the IP traffic at your leisure - including the traffic that contains customer data.

If someone can snoop traffic and see confidential data, you're not very serious about security - no confidential data is sent off-server without being encrypted. (SSL mostly, with point to point VPN tunnels for a few apps that don't support encryption natively)

That's very true - if data is leaving unencrypted then they have made a mistake. This is an easy mistake to make though if you bank on your LAN being truly private. However, on the other side of the coin...lots of traffic is unencrypted by design(NFS 1x,2x,3x, and 4x unless you use krb5p, and iscsi).

Great, so now I have an encrypted volume that I can't read unless I can compromise the HSM that stores the keys.

If you have the access to the encrypted volume, then you'll also have access to the key the moment the volume is unlocked and the key is stored in memory.

Because the bureaucracy makes implementing such measures unreasonably difficult. Implementing any kind of new system, even one related to security takes months, even in a simple case and it might takes years for the system to be fully realized. I've worked in federal contracting and have seem stuff like this happen. The whole process is glacial.

They don't seem to have any problem with adding new data sources to their growing pile of data and new data centers to house it, so they can implement proper security controls as well.

Reply on news.ycombinator.com