Hacker News Reader

Comment by pandapower2 | Hacker News Reader

Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

Even more interesting is how the FBI knew they'd been infiltrated before they themselves did? (There's the obvious conspiracy style accusation in that they were already in there poking around... but that doesn't seem to ring true in this regard)

If the FBI wasn't then NSA definitely was and then told the FBI.

Same way any criminal investigator uncovers stolen goods.

For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow.

So even if it's someone with valid access, it would be investigated immediately.

Which tools do you use? I have been looking for something that does this.

In the Marriot hack post-mortem, they shared that one of the tools they used (which successfully identified the attack) was IBM Guardium.

> Accenture told Marriott's IT staff that one of their security products, a database monitoring system called IBM Guardium, had detected an anomaly on the Starwood guest reservation database

https://www.zdnet.com/article/marriott-ceo-shares-post-morte...

I'm guessing snort or one on the similar products.

Proper audit logs that are regularly checked.

Assuming the exfiltration can be differentiated from normal behavior!

Seeing large amounts of encrypted traffic leaving via a DNS tunnel during non-standard business hours for instance would be an example of such an anomaly. It's not always that easy to detect however.

Didn't Sony pick up exfiltration through exceptional data flows?

Sony was hacked 19 times in two weeks. There was a lot they didn't pick up on due to the difficulties involved with that.

Simply storing netflow data and graphing it would show it at a glance. Use a machine setup as a transparent bridge with only physical login if you are paranoid about the netflow data being modified.

Hiding on a box is easy. Hiding on the wire is hard.

Why do you assume this was an unauthorized person?

Fair point.

Reply on news.ycombinator.com