Hacker News Reader

Comment by Narkov | Hacker News Reader

Why aren't these attacks constrained by normal corporate firewalls? How does a random server on a navy ship start contacting baddie.china.com without raising red flags?

View on HN

Effectively nothing can be constrained by a whitelisting firewall if you have a sufficiently bored actor. You can smuggle data through a variety of benign looking protocols, things that wouldn't matter in the least generally. Your average server contacts hundreds of different public NTP servers, binary repositories, domain name servers every day. If the keys to the kingdom are a 32 byte ECDSA private key, you've lost if you think you can protect this from reaching the outside world.

A method that wouldn't show up on any firewall in the world is simply to delay or drop certain SYN packets. Even if you only intended to transmit a bit at a time through this, any unauthenticated host on the internet could use this without raising any suspicion or even printing log lines in most environments. As soon are you're making an assumption that you're trying to prevent what's inside from getting out things become substantially closer to impossible than anybody would like.

Firewalls in high security environments aren't just port/protocol based. You lock everything down - source ip/port and destination ip/port. You should know where it is coming from and where it is going to.

Navy ships don't upload via Dropbox.

Certainly true, since Dropbox doesn't work on Windows XP anymore.

In the parent I described a system which would be able to communicate through those restrictions to another compromised host (remember we're assuming everything is compromised for the sake of this article, which actually seems like a good assumption now).

Networks where security is taken seriously implement data diodes, and this attack vector is mitigated.

> remember we're assuming everything is compromised

I think Bloomberg (and all related) web servers displaying the article are compromised and they're leaving out critical facts the point the finger elsewhere.

Who's saying the firewall isn't compromised too? ;)

Right so all the stars need to align for it to go unnoticed - compromised server, firewall and other alerting/monitoring tools.

I would have thought one single unexpected packet in these high security environments would raise significant alarm bells and any anomaly would be found very quickly.

Only if you’re lucky. Priority is checking boxes and meeting audit requirements.

If you’re running an IDS on a big 100 Gb datacenter network, you’re literally processing millions of events. Very few places would notice such a thing unless they were investigating something related, and the ones with the capability are going to be for static workloads as getting anything done will be slow and painful.

I've worked on systems deployed in the financial sector in high risk environments.

This sort of monitoring doesn't happen in the real world.

We had something similar where anything outside "normal" generated a ticket. It was disabled after 1 week because the support teams where getting more then 5000+ tickets each day. And this was after filtering etc....

Now this does not make it impossible, just very complex. In a more "controlled" environment such as a naval ship, i could see this actually working better, especially if the system is supposed to talk to very few external systems.

It does. I've deployed systems that would not only notify staff when novel packets were observed but immediately isolate anomalous hardware through a combination of powerdown and network fabric reconfiguration.

The amount of false positives a system like that would generate would rapidly render such a system entirely unusable.

Not in a secure environment... where you are supposed to control the hardware, the software, and the network absolutely.

The only way to create such an environment is to totally disconnect it from the outside world -- I'm talking even power source, phones, internet, all of it has to be disconnected or else I can exfil data all day long and nobody would ever know.

Yes, but eventually you have to get something done.

Security engineering is about tolerable failure modes. - Dan Geer (2014)

He was the "first employee and architect @ Kraken (2011-2015)". That might explain why Kraken spews out 502s all the time.

Dear snarky anonymous coward, as stated I left in 2015. I think you will find referenced issues occurred subsequent to that date under very different technical leadership.

Intrusion Detection Systems are basic network security 101 type stuff. I'd be surprised if anything that was really "high risk" didn't use an IDS.

Intrusion detection involves connections coming from the outside. These attacks originate inside the network, from the compromised equipment.

Except on extremely controlled networks, this would be very hard to detect. It gets even worse when you consider that the Chinese had/have a distributed network of compromised machines. Imagine using a Google edge server as a dead drop...

An IDS is perfectly capable of flagging outgoing or internal traffic.

There's a big difference between "using an IDS" and "a few unintended/unexpected packets are noticed and properly followed up on".

Presumably it contacts somewhere ubiquitous like AWS or Cloudflare.

I suppose the hardware on the navy ship is communicating with a server that is also compromised, and so on and so forth.

Reply on news.ycombinator.com