Hacker News Reader

Comment by htrp | Hacker News Reader

TLDR. A Peoplesoft (Oracle HR) instance was compromised which allowed movement into GovCloud (AWS)

PeopleSoft 0-day.

Just goes to show that the wall of IT bureaucracy does nothing. I'm sure they had an ATO, a several-hundred-page SBOM, compliance audits, etc.

It doesn't do nothing. It does make things somewhat harder to attack.

There was a time, 25-ish years ago, where exploits were thrown about like candy at a parade. The procedures you mention, along with other things, have made zero-days like these more valuable than gold.

> It doesn't do nothing.

Yeah, it's called regulatory capture.

Treating security as an accounting exercise has never stopped a 0-day. Better software tools and practices have.

The attackers exfil'd 3TB of data, which obviously included PII, from AWS servers. They should've had DLP, active monitoring, countermeasures, using a security vendor (you can set this up for AWS services using CloudTrail, CloudWatch Logs, etc). You're supposed to have that for sensitive government or military work, and it should have (at least) caught that much traffic going to a rando external IP, blocked and flagged.

If they did have it set up, then somebody wasn't doing their job. If they didn't have it set up, they didn't comply (which is also not doing their job). I see this all the time. The security analysts send tickets to people when they see major issues and nobody is held accountable for inaction. Management asleep at the wheel (which is also their cover, can't be blamed for what you made sure you never knew about).

The FBI had some very smart people. The current regime/administration's number 1 priority is to eliminate anyone competent in order to replace them with loyalists. Stuff is only going to get worse.

> The FBI had some very smart people.

They trusted Oracle. I'm not sure I believe you.

That's almost always a decision made by mismanagers.

I’m skeptical that multiple terabytes of data were exfiltrated quietly. I’m struggling to see this as anything other than a bluff.

I'm less skeptical after seeing it happen to IDScan and terrabytes of government-issued IDs being exfiltrated quietly.

Still skeptical, but the FBI's vendors are just as vulnerable to 0-days as Hertz's vendors.

If it was compressed prior to exfiltration it would be much smaller than the original data. I would expect this is mostly human readable text and a fairly high compression ratio. Agree it would still be large but 2 TB at 7:1 ratio drops to 285 GB. I don't know how much these servers are doing with data but I'd suspect sneaking out 10 GB/day over a month or 20GB/day over 2 weeks isn't going to trip up much. The CPU hog for the original compression might, but if you batch out the process in chunks (like a good data engineer), you probably wont trip many thresholds outside of expected use. Just a theory on how I might sneak that much data out of somewhere that has eyes on it, I don't know many details except what's in the article.

Na, they just linked it up to the VLAN that carries the netflix traffic and no one noticed because it wasn't even a drop.

Now, I made that totally up, but this is how things go. They'll watch one area like a hawk only to leave another glaringly wide door open.

What is even worse is there are a lot of horrifically inefficient apps out there calling way too much data for no reason and suddenly a hack of an entire database gets lost as noise in relation to all the traffic on the servers and networks.

Anomaly detection is getting better. A small delta can still trigger it. Wether a human reviewed it is another story. But the post mortem will reveal all the signs in hindsight.

Imagine the AWS bill

Reply on news.ycombinator.com