Hacker News Reader

Comment by dijit | Hacker News Reader

The note makes it seem like the attackers got access to their internal network; but the (admittedly little) information I have on the subject indicates that the perforce server was hosted on the internet with username/password access (not cert based authentication as is recommended by Helix these days).

I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the pandemic and just opened it for the whole internet.

CI runners (usually Jenkins) require a perforce user to function and those users often have very simple passwords, this is compounded by the fact that perforce itself does not have any backoff for brute force attempts.

Perforce assumes that it's being hosted in a secure environment.

The note indicates HR documents were stolen, but I have not seen any evidence of that, it is most likely posturing.

View on HN

This may be a stupid question, but isn't it standard practice to require that employees use VPN? Why would they expose servers to the internet?

An employee could have got hacked, or defected

They’re the ones getting screwed over the most here imo

Perhaps, but I’d say it’s quite hard to do this effectively when you’re using sass products. Even if you’re self hosting, and have dozens or hundreds of WFH employees, what’s the alternative?

No access for anyone while you scale your VPN? Just wait while everyone pulls and pushes gigs of data over the VPN to perforce, you didn’t need that video meeting after all?

You’ll get a big fat nope to that when you try to do it; this is a pretty tough challenge you’re trivialising here.

Google “zero trust” as an alternative; clearly they didn’t do that properly either, but I can at least understand why they didn’t just demand everyone use a VPN.

Trivial VPN use cases like people who d/l source code and have then occasional 5 person video meeting and this use case are not the same thing.

I've worked at two companies so far and at both SaaS things like mail, chat, videoconferencing were accessible without a VPN, but git repos, CI, development servers, basically anything self-hosted is behind a VPN. So you won't stream video for your video calls over the VPN, but the source code, logs, builds, etc. are protected by VPN.

A lot of places are skipping that because they dont have self hosted servers but is allready hosting everything in "the cloud". Like for a simplified example, if you are using google docs + gmail it does not really make sense to force the employees throught a VPN first.

The companies that do it well implement something like google's beyondcorp, the bad just uses direct authentication.

At least not unusual for many companies but there are proponents of a different philosophy [1].

The idea is that drawing a clear line between outside and inside became futile and you are much better off with an approach that recognizes that fact. Their somewhat provocative slogan is: "The perimeter is dead".

For those working at FAANG: Do you have a corporate VPN? Do you use it? Do you need it for your daily work?

[1] https://www.usenix.org/system/files/login/articles/login_dec...

At Google: No. https://cloud.google.com/beyondcorp/

When I was at Microsoft, you still needed a VPN to connect to your dev machine and write code, but more and more internal services were moving to a zero-trust model that didn't require a VPN. Not sure if they've gotten there 100%, but it felt like the clear direction.

Apple uses a VPN. Most stuff needed to get work done (version control, e-mail, bug tracker) is behind it.

Well, Apple is not exactly know for being first movers in tech. I'm sure they'll refine the approach in a few years.

Yea, your threat model needs to include machines that have legitimate access to your corporate network, either by being on it physically or through VPN. If you only have defense at the perimeter, you are vulnerable to insiders, such as employees who are about to rage quit and want to do damage on the way out.

> I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the pandemic and just opened it for the whole internet.

I would expect access to source code to be strictly from a VPN with controlled IPs, people shouldn't be accessing such sensitive information directly from their IPs, exactly because it makes it very hard to control access.

There is one caveat there: when everyone comes from the same IP (the VPN server's IP) it makes it difficult to determine (from regular HTTP server logs) who accessed what (e.g., when you think that there may be an attacker on your network).

That's (generally) not how a corporate VPN works.

Each client that connects to the VPN gets it's own IP, just the same as every PC plugged into the physical corp net gets it's own IP. When you access an internal service, it's no different to a desktop on the LAN accessing it in terms of ability to identity the end user.

Corpo VPN doesn’t do NAT usually.

Reply on news.ycombinator.com