Attackers May Still Be Breaking into US Networks Without SolarWinds, CISA says (gcn.com) 38
On Friday, America's Cybersecurity and Infrastructure Security Agency revealed that the "threat actor" behind the massive breach of U.S. networks through compromised SolarWinds software also used password guessing and password spraying attacks, according to ZDNet.
And they may still be breaching federal networks, reports GCN: "Specifically, we are investigating incidents in which activity indicating abuse of Security Assertion Markup Language (SAML) tokens consistent with this adversary's behavior is present, yet where impacted SolarWinds instances have not been identified," according to updated guidance published Jan 6. "CISA is continuing to work to confirm initial access vectors and identify any changes to the tactics, techniques, and procedures (TTPs)." SAML tokens having a 24-hour validity period or not containing multi-factor authentication details where expected are examples of these red flags.
As more about the SolarWinds Orion breach has surfaced, analysts and lawmakers have repeatedly commented on how difficult it will be to remove hackers from the government's networks because their access is probably no longer predicated on flaws in SolarWinds Orion, an IT management software. CISA's new guidance appears to confirm that suspicion, stating Microsoft, which is helping the federal government investigate the hack, reported the hackers are tampering with the trust protocols in Azure/Microsoft 365.
"Microsoft reported that the actor has added new federation trusts to existing on premises infrastructure," according to the agency's guidance. "Where this technique is used, it is possible that authentication can occur outside of an organization's known infrastructure and may not be visible to the legitimate system owner." In cases where administrative level credentials were compromised, organizations should conduct a "full reconstruction of identity and trust services," CISA said.
Microsoft published a query to help identify this type of activity.
And they may still be breaching federal networks, reports GCN: "Specifically, we are investigating incidents in which activity indicating abuse of Security Assertion Markup Language (SAML) tokens consistent with this adversary's behavior is present, yet where impacted SolarWinds instances have not been identified," according to updated guidance published Jan 6. "CISA is continuing to work to confirm initial access vectors and identify any changes to the tactics, techniques, and procedures (TTPs)." SAML tokens having a 24-hour validity period or not containing multi-factor authentication details where expected are examples of these red flags.
As more about the SolarWinds Orion breach has surfaced, analysts and lawmakers have repeatedly commented on how difficult it will be to remove hackers from the government's networks because their access is probably no longer predicated on flaws in SolarWinds Orion, an IT management software. CISA's new guidance appears to confirm that suspicion, stating Microsoft, which is helping the federal government investigate the hack, reported the hackers are tampering with the trust protocols in Azure/Microsoft 365.
"Microsoft reported that the actor has added new federation trusts to existing on premises infrastructure," according to the agency's guidance. "Where this technique is used, it is possible that authentication can occur outside of an organization's known infrastructure and may not be visible to the legitimate system owner." In cases where administrative level credentials were compromised, organizations should conduct a "full reconstruction of identity and trust services," CISA said.
Microsoft published a query to help identify this type of activity.
how come we never hear of... (Score:1)
Re:how come we never hear of... (Score:5, Informative)
People from France and the UK sometimes break into US computers, but it's a lot riskier because those countries have an extradition treaty with the US. See for example [go.com]. Although sometimes politics gets in the way [bbc.com].
Re: (Score:2)
Re: (Score:1)
Re: how come we never hear of... (Score:2)
Re: (Score:1)
Re: (Score:2)
Thats not what i asked. Im just wondering why the stories about America being a victim seem to outnumber everybody else by a factor of 100 which is strange.
Those figures dont seem right.
The US has a freedom of information act and a history of free release of public information so officials don't have as much of an incentive to hide things. Most of those other countries have a much stronger tradition of state secrecy. The UKs "Official Secrets Act" [wikipedia.org] is famously oppressive. Also the attackers seem to have been Russian with a specific aim of attacking the US so they likely concentrated on that. Any IT infrastructure which in some way trusted Solarwinds should be reinstalled which probably mea
Re: (Score:1)
Re: (Score:1)
>> The Freedom of Information Act
> Stop talking nonsense, the UK, Fr, Ca, Au, and half of Europe
What do you imagine the Freedom of Information Act is called in the UK? France?
> Lets face it if the UK got attacked and somebody attacked the power grid, you cant hide that.
If the power grid were taken down you couldn't hide the fact that something went wrong with the power. That's true. Are you under the impression that Solarwinds is a solar and wind power grid or something? Is that comment in a
Re: (Score:1)
What do you imagine the Freedom of Information Act is called in the UK? France?
They're called, respectively:
So I guess that means you can't Google.
Re: (Score:1)
Re: (Score:1)
Re:how come we never hear of... (Score:5, Insightful)
Several reasons:-
1. Advanced Technology
The US spends more on research and development than any other nation. Stealth and advanced weapons technology is years ahead of anyone else; drug research, computing, aviation, you name it... So breaking in to that data would enable another nation to jump-start their own programs. We know that China has been stealing IP for years.
2. Counter Intelligence
The Snowden leaks confirmed a well-known secret: the US spends more on foreign intelligence gathering than any other nation. This requires agents, handlers, techniques and - in many cases - the ability to penetrate the security of other nations. Data on all of this will be stored in say State Department systems and might help a foreign actor to purge agents embedded in their governments, if they can be identified. To see an example of how effective getting such intelligence would be, look what happened in Saudi Arabia in 2017 - massive purge of "disloyalists" from the government.
3. Long Term Disruption
Look at the impact that the corrupted centrifuges had on the Iranian Nuclear program, brought about by the development and deployment of Stuxnet... The ability for a foreign actor to get in to US infrastructure would be particularly helpful, given the size and power of the US and the influence the US has on the world stage. Disrupting the US government has the effect of forcing US security services to "look inward" - and while that is happening, the threat actor is free to cause mayhem elsewhere.
For a case in point - look at this breach itself. CISA was "all over" the election infrastructure, protecting the integrity of the 2020 election became their number one goal, which meant they may have taken their eyes off other targets and dropped the ball...
Although there are undoubtedly more examples we could use, I hope the above three illustrations show that, in many cases, the US represents the "biggest target" in the world today. Now, the tools and techniques used to penetrate computer systems are highly sought after. You will come across references to "zero day exploits", for example. The thing about a "zero day exploit" is that it is a vulnerability that has not previously been detected and not previously been exploited. What that means is that if you are a hostile adversary and want to penetrate the security of western governments, who are you going to attack? If you limit your consideration to one of the "Five Eyes" nations: the US, Canada, Great Britain, Australia and New Zealand, then if you go after any nation other than the US, the risk you take is that your target may detect your zero-day exploit and alert the other 4 members of Five Eyes to the threat.
So given that you have to treat each exploit like a "one time" pass, you are almost certainly always going to go for the biggest prize each time. Which, invariably, is going to be a US computer system somewhere.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
I don't know, but maybe they have different secrecy laws? Maybe as a matter of policy they don't disclose breaches in those countries?
Re: (Score:3)
Maybe as a matter of policy they don't disclose breaches in those countries?
This. You find a bug, you don't rip it out. Because this alerts your adversary to the fact that they have been found out. And that they need to change their methodology. Making them harder to catch.
The whole "Oh noes! We've been hacked!" is political posturing.
Re: (Score:2)
Re: how come we never hear of... (Score:1)
Thats not what i asked. Im just wondering why the stories about America being a victim seem to outnumber everybody else by a factor of 100
So you compared to all the other stories in all the papers in all the languages in all the countries, to determine this.
Re: (Score:1)
Re: (Score:2)
Perhaps because the US is a large target, and you were looking at news written in English. The combination of those two might suffice. A secondary consideration might be that you pay more attention to attacks that happen relatively locally.
There may be additional reasons, but those alone would probably suffice.
Re: (Score:1)
Re: (Score:1)
Re: (Score:3)
breaking into networks from France, or UK, or USA basically any other country ?
1. Because the Russians and the Chinese have it as a matter of policy to never release anything on the subject. We learn years if not decades later about successful hacks like this one: https://www.wired.com/2004/03/... [wired.com]
2. We "attribute" any hack by anyone to the Russians to promote our forever war and regime change agenda.
They for the time being are simply ignoring us despite the regime-change-o-meter being somewhere around 10. If Biden tries to crank it one more notch to 11, they will go for the final
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
2. We "attribute" any hack by anyone to the Russians to promote our forever war and regime change agenda.
Really? Name one Russian government we've helped install. For that matter any puppet Russian government we've helped overthrow? Cuba so far is still standing.
How is this news? (Score:2)
Most network security is still utter crap these days. After all it has to be cheap. Actual (expensive) experts never get hired or if they get hired, they are not listened to.
Not a small task (Score:1)
Re: (Score:2)
When the hack came out I commented that the information seems to be full of shit: https://www.fagain.co.uk/node/... [fagain.co.uk]
Namely, the Russian software "captured" in the process was 2+ years old. That means either:
Case A: Someone has gotten their mitts on old Russian trophy tank and have taken it for a ride. +/- some domestically produced ammunition.
Case B: All key networks of Western Governments and military have been hacked at a level which gives "God A
all digtal forms of news are comprmised. (Score:2)
Make no mistake, if you operate in the digital realm alone you are a fool.
No biggie (Score:2)
It's only the con artist's benefactor in Russia. They're helping to look [youtube.com] for all those "missing" votes [youtube.com]. This is why you haven't heard him say one word about this hack. Wouldn't want to annoy the place you'll be fleeing to.
Azure/Microsoft 365 trust protocols (Score:1)
Re: (Score:2)
Yeah. Since Microsoft was almost split up. And the eventual settlement was supervised by Judge Kollar-Kotelly. A judge sitting on the Foreign Intelligence Surveillance Court [wikipedia.org]. In other words, someone cleared to know where all the back doors in Windows were. And in a position to side track any examination of the "wrong" binaries.
no kidding (Score:2)
No kidding, how anyone could seriously believe once SolarWinds was patched, the breach is over ?
Gov and Security experts said these people were smart and sophisticated, so even I thought the first thing they would do is plant 1 or more backdoors in systems they cared about. Then they would move on from the initial breach.
So the real fix is probably to wipe and reinstall all the systems attached to the internal network. Otherwise you will be looking and hundreds of systems for a very long time and still mi