What's new
Fantasy Football - Footballguys Forums

Welcome to Our Forums. Once you've registered and logged in, you're primed to talk football, among other topics, with the sharpest and most experienced fantasy players on the internet.

US Treasury & DHS Hacked by Foreign Government (1 Viewer)

GroveDiesel

GroveDiesel

Footballguy
Link to Twitter thread that links to articles.

 Dec 13 (Reuters) - A sophisticated hacking group backed by a foreign government stole information from the U.S. Treasury Department and a U.S. agency responsible for deciding policy around the internet and telecommunications, according to people familiar with the matter.
Click to expand...
And with Trump having fired the entire leadership team of the Cybersecurity Infrastructure Protection Agency, the group that should be spearheading getting things locked down and tracked down has no actual Head and a bunch of untested guys now trying to figure this all out. What a disaster.

 
Last edited by a moderator:
Not surprised AT ALL by this....this was coming when the "layoffs" were announced...I'm surprised it took this long...disgusting.

And rest assured, there is more that has either happened and we don't know yet or is planned for the not too distant future.

 
This is a huge hack and involves vulnerabilities in all Solarwinds Orion products. So no one really knows which companies have actually been exploited but CISA (the same agency that had its director, Krebs, get fired a month ago) released a directive to disconnect and power down all solarwinds products immediately.

Interesting Twitter thread:

https://twitter.com/kimzetter/status/1338389130951061504?s=21

 
Last edited by a moderator:
This has Putin written all over it.  He is mad Trump didn't win the election.  I wouldn't be surprised if Trump fired everyone to leave the hole open for Putin's hackers.  Who knows what kind of leverage they have over us now.

 
Punxsutawney Phil said:
This has Putin written all over it.  He is mad Trump didn't win the election.  I wouldn't be surprised if Trump fired everyone to leave the hole open for Putin's hackers.  Who knows what kind of leverage they have over us now.
Click to expand...
More likely that they’re closing up and leaving before the new administration takes over. Sounds like they’ve been in there for awhile.

 
The Commish said:
Not surprised AT ALL by this....this was coming when the "layoffs" were announced...I'm surprised it took this long...disgusting.

And rest assured, there is more that has either happened and we don't know yet or is planned for the not too distant future.
Click to expand...


I know nothing about this stuff - and I know you do. So I'm asking this question to honestly get your knowledge - not be snarky.

The tweet thread that shader linked states that the backdoor was put in this software back in March - before it went out to customers (like the US Gov). So did the layoffs really affect it? Was this maybe why they were all fired?

 
Punxsutawney Phil said:
This has Putin written all over it.  He is mad Trump didn't win the election.  I wouldn't be surprised if Trump fired everyone to leave the hole open for Putin's hackers.  Who knows what kind of leverage they have over us now.
Click to expand...
It's certainly possible that Putin and Russia are behind it.  The Washington Post has already fingered Russia.  But it appears that the hacks are all pre-election.  Usually hackers are in there a long time before they are discovered, and the vulnerabilities are from the Spring of 2020.

 
whoknew said:
The Commish said:
Not surprised AT ALL by this....this was coming when the "layoffs" were announced...I'm surprised it took this long...disgusting.

And rest assured, there is more that has either happened and we don't know yet or is planned for the not too distant future.
Click to expand...


I know nothing about this stuff - and I know you do. So I'm asking this question to honestly get your knowledge - not be snarky.

The tweet thread that shader linked states that the backdoor was put in this software back in March - before it went out to customers (like the US Gov). So did the layoffs really affect it? Was this maybe why they were all fired?
Click to expand...
Poor wording on my part....I wasn't trying to draw a correlation between the two.  I wasn't trying to suggest that because of the layoffs this happened.  It was going to happen regardless and I have no insider knowledge to say they hadn't started working on this before the layoffs.  I don't think it's reasonable to assume that Russia was waiting on a green light to start their nonsense.  I'm confident they were working this well before the layoffs.  They have entire portions of their "government" working on these kinds of things all day every day.  

All that said, I think it would be a hugely generous interpretation to suggest this administration fired people because of this for a multitude of reasons, but the primary ones being:

1.  If they were fired for this that means the administration knew they weren't doing a good job.  That's good, right?  Until we realize the fired people were NOT replaced and they weren't replaced KNOWING that attacks were being attempted.  Who'd want to make that argument?

2.  Our government officials are REALLY inept in the ways of technology...in a staggering way.  It's really bad....like really really bad.  Beatrice bad.  So I don't think this admin would understand enough about this to do #1.  The most logical reason for that action is that someone there said something mean about Trump or shed light on how bad we were with cyber security, so they got fired.  That's how a majority of the firings have gone under this admin.  I see no evidence to say that isn't true here.

Did the layoffs affect it?  Perhaps?  Tough to say without being in the day to day work.  What I am pretty confident in believing is they didn't help at all.  I'd probably have a different opinion had they replaced the people fired.  But I don't know for sure if they'd have been able to stop it had they not been fired.  

 
The Commish said:
Poor wording on my part....I wasn't trying to draw a correlation between the two.  I wasn't trying to suggest that because of the layoffs this happened.  It was going to happen regardless and I have no insider knowledge to say they hadn't started working on this before the layoffs.  I don't think it's reasonable to assume that Russia was waiting on a green light to start their nonsense.  I'm confident they were working this well before the layoffs.  They have entire portions of their "government" working on these kinds of things all day every day.  

All that said, I think it would be a hugely generous interpretation to suggest this administration fired people because of this for a multitude of reasons, but the primary ones being:

1.  If they were fired for this that means the administration knew they weren't doing a good job.  That's good, right?  Until we realize the fired people were NOT replaced and they weren't replaced KNOWING that attacks were being attempted.  Who'd want to make that argument?

2.  Our government officials are REALLY inept in the ways of technology...in a staggering way.  It's really bad....like really really bad.  Beatrice bad.  So I don't think this admin would understand enough about this to do #1.  The most logical reason for that action is that someone there said something mean about Trump or shed light on how bad we were with cyber security, so they got fired.  That's how a majority of the firings have gone under this admin.  I see no evidence to say that isn't true here.

Did the layoffs affect it?  Perhaps?  Tough to say without being in the day to day work.  What I am pretty confident in believing is they didn't help at all.  I'd probably have a different opinion had they replaced the people fired.  But I don't know for sure if they'd have been able to stop it had they not been fired.  
Click to expand...
Well, since Krebs and his leadership team were all fired right after officially stating that there was NO evidence of widespread voter fraud and that all of the election systems were secure, I think the general assumption is that they were fired for not following the company line. 

 
GroveDiesel said:
Well, since Krebs and his leadership team were all fired right after officially stating that there was NO evidence of widespread voter fraud and that all of the election systems were secure, I think the general assumption is that they were fired for not following the company line. 
Click to expand...
If that's the case, then yeah...sorry, I don't tend to follow all the buffoonery in this administration all that close and these "firings" have been happening all the time so I guess I lost track.

 
shader said:
This is a huge hack and involves vulnerabilities in all Solarwinds Orion products. So no one really knows which companies have actually been exploited but CISA (the same agency that had its director, Krebs, get fired a month ago) released a directive to disconnect and power down all solarwinds products immediately.

Interesting Twitter thread:

https://twitter.com/kimzetter/status/1338389130951061504?s=21
Click to expand...
"Huge" is an understatement 

 
Last edited by a moderator:
Of course it's a huge problem.  It's been a huge problem for a long time...even prior to Trump.  Our politicians are woefully ignorant of technology.  They continue to be convinced the next world war is going to be "boots on the ground" kind of stuff.  It's not.  It's going to be in the cyber world.  How little our politicians know about this stuff is pathetic.  Even to the common person, it's understood that our power grids are incredibly vulnerable, yet we pay little attention to fixing that issue.  

 
It's going to be really weird 50 years from now when the history books state that this hack was the most significant thing to happen in Trump's presidency.

 
The Commish said:
Of course it's a huge problem.  It's been a huge problem for a long time...even prior to Trump.  Our politicians are woefully ignorant of technology.  They continue to be convinced the next world war is going to be "boots on the ground" kind of stuff.  It's not.  It's going to be in the cyber world.  How little our politicians know about this stuff is pathetic.  Even to the common person, it's understood that our power grids are incredibly vulnerable, yet we pay little attention to fixing that issue.  
Click to expand...
Yup.  These same people will be like Lloyd Christmas getting robbed too "I never even saw it coming!"  No, of course you didn't, you were too busy trying to find a bigger flag to fly over your RV.  

 
Mr. Ham said:
What’s amazing about this is the hackers used malware to get in, but then with unfettered access to systems were able to gain legitimate credentials and install no one knows what, and access no one knows what. This cuts across Fortune 500, Telecom, and government. This is very, very bad. A competent administration would be speaking in no uncertain terms: If you do this to us, we will retaliate economically and militarily. 

We have to assume that systems across most of our corporate and military infrastructure are completely and totally compromised. Corporate, government, military secrets. R&D. Details regarding how to exploit and disrupt critical infrastructure, communications, and supply chains. Data about American citizens and how to exploit and game markets. Material that could be used for blackmail. Essentially, Russia has what it needs to assemble a blueprint to disrupt and disable much of our country from the inside. 

Every system needs to be scrubbed, every credential scrutinized and reset before we’re assured they’re out of the house. Recovery will take months. Hell, just the forensics may take that, across thousands of organizations.
Click to expand...
No we don't...most corporations are light years ahead of our government in security terms.  Many specific companies have dragged the government along in this field.  Any meaningful military intel isn't connected to anything any foreign government can get to.  If they get information it's because someone internal put something some place they shouldn't have.  

 
Mr. Ham said:
Badly worded. I meant some (mainly Windows based) systems. Not all systems. 
Click to expand...
Even then, what I say is true...it can absolutely run amuck in government environments who don't keep up with patching and the like, but the most important systems like the ones you listed are very well tended to.

 
Mr. Ham said:
Good to know. I’m in IT, but (obviously) security is not my forte. 
Click to expand...
For example....all the military related things you mentioned are in three basic parts of the country on completely sealed off networks that you have to be IN the building(s) to get on.  So unless someone is going all Austin Powers and infiltrating these places, those things are fine.  I can't speak to the individual companies from which these secrets come, but I have to believe they are tightly guarded at those places as well.  There are plenty of places where hacks like this can easily run wild within the federal government and they could probably do a good job at being enough of a PITA that things just shut down.  Denial of service sorts of things would grind Washington to a hault IMO.  

 
Mr. Ham said:
Startling parallels between this hack and COVID. Experts have been warning for years that both were inevitable and gave recommendations and formed programs that through denial, incompetence, and malice were scuttled or left untended. The degree to which this may have been an inside job doesn’t matter. It falls on the shoulders of those who failed to act. There is no excuse, none, for failing to protect our government systems, industries, and critical infrastructure. If the buck doesn’t stop for this, then it stops for nothing. This is gross dereliction of responsibility, and an act of war by Russia as impactful as if they’d sent planes into skyscrapers.
Click to expand...
Of course no one knows right now, but this could end up being worse than covid in terms of it's impact on day-to-day life. It was a massive hack. 

The question is what will Russia do with the power they now have.  Is it so much power than to use it is equivalent to using a nuke?  If so, maybe the MAD aspect of it keeps them from moving forward.  

 
The Commish said:
Even then, what I say is true...it can absolutely run amuck in government environments who don't keep up with patching and the like, but the most important systems like the ones you listed are very well tended to.
Click to expand...
Yes many corporations are well tended to, but all it takes is one security hole.  The Target hack was, if memory serves, a dial-home feature of their AC unit.

The Solarwinds thing is so big because it compromises systems regardless of how well done their security is.  All it takes is one hole in a network.  

 
shader said:
Yes many corporations are well tended to, but all it takes is one security hole.  The Target hack was, if memory serves, a dial-home feature of their AC unit.

The Solarwinds thing is so big because it compromises systems regardless of how well done their security is.  All it takes is one hole in a network.  
Click to expand...
Target's was pure neglect.  They used login credentials from an HVAC that had access to their systems.  Target was woefully careless. Solarwinds is definitely a new approach.  I don't think I've seen an attempt to hack software updates.  It's pretty clever.  This is why it's crucial to have companies with a cyber security group who can review patch updates.  Any company worth their salt goes through this step and it's often why patches that were slated for march aren't rolled out until july/august etc.  

 
Last edited by a moderator:
Mr. Ham said:
If you had to speculate a top 5 list of what Russia got out of this, what’s that list?
Click to expand...
I haven't followed it closely.  I know solarwinds is a network monitoring platform, so off the top of my head, they'd probably have access to any/all communications going across the networks their software was installed on.  The only information useful to them is that which isn't encrypted though.  So even if they're on the networks and sniffing around, if it's encrypted, then there's no real dangerous information collected.  Problem is, many companies don't encrypt internally (yes, even today this is true...it's mind boggling, but it's true).  In those cases, you'd be able to collect any/all information going across those networks.  It's unclear to me, how they'd get that data OUT of those environments, but they could certainly collect it and probably even store it on the hardware where the software was installed.  Then they'd need to figure out a way to get it off the servers...each of those solutions would be dependent on the specific company's circumstances.  

 
The Commish said:
Target's was pure neglect.  They used login credentials from an HVAC that had access to their systems.  Target was woefully careless. Solarwinds is definitely a new approach.  I don't think I've seen an attempt to hack software updates.  It's pretty clever.  This is why it's crucial to have companies with a cyber security group who can review patch updates.  Any company worth their salt goes through this step and it's often why patches that were slated for march aren't rolled out until july/august etc.  
Click to expand...
Pretty detailed release today on this hack.

https://us-cert.cisa.gov/ncas/alerts/aa20-352a

 
shader said:
Pretty detailed release today on this hack.

https://us-cert.cisa.gov/ncas/alerts/aa20-352a
Click to expand...
Thanks for this...to be clear, this isn't the Target breach, but the current solarwinds breach.  This is the first thing that caught my eye.

SolarWinds Orion is an enterprise network management software suite that includes performance and application monitoring and network configuration management along with several different types of analyzing tools. SolarWinds Orion is used to monitor and manage on-premise and hosted infrastructures. To provide SolarWinds Orion with the necessary visibility into this diverse set of technologies, it is common for network administrators to configure SolarWinds Orion with pervasive privileges, making it a valuable target for adversary activity.

The threat actor has been observed leveraging a software supply chain compromise of SolarWinds Orion products[2] (see Appendix A). The adversary added a malicious version of the binary solarwinds.orion.core.businesslayer.dll into the SolarWinds software lifecycle, which was then signed by the legitimate SolarWinds code signing certificate. This binary, once installed, calls out to a victim-specific avsvmcloud[.]com domain using a protocol designed to mimic legitimate SolarWinds protocol traffic. After the initial check-in, the adversary can use the Domain Name System (DNS) response to selectively send back new domains or IP addresses for interactive command and control (C2) traffic. Consequently, entities that observe traffic from their SolarWinds Orion devices to avsvmcloud[.]com should not immediately conclude that the adversary leveraged the SolarWinds Orion backdoor. Instead, additional investigation is needed into whether the SolarWinds Orion device engaged in further unexplained communications. If additional Canonical Name record (CNAME) resolutions associated with the avsvmcloud[.]com domain are observed, possible additional adversary action leveraging the back door has occurred.

Based on coordinated actions by multiple private sector partners, as of December 15, 2020, avsvmcloud[.]com resolves to 20.140.0[.]1, which is an IP address on the Microsoft blocklist. This negates any future use of the implants and would have caused communications with this domain to cease. In the case of infections where the attacker has already moved C2 past the initial beacon, infection will likely continue notwithstanding this action.

SolarWinds Orion typically leverages a significant number of highly privileged accounts and access to perform normal business functions. Successful compromise of one of these systems can therefore enable further action and privileges in any environment where these accounts are trusted.
Click to expand...
The bold is essential an investigative hack to give them server names, IP addresses etc.  It's an exploratory hack to see what they could get.  IF a company is not encrypting these in their network traffic they COULD be usable in efforts to hack those companies.  So now some hacker somewhere has information about servers at company X, now they have to figure out how to get into company X and start poking around.  This is like a "phase 1" part of a major hack.  The second bolded part is the most immediate threat which is just standard common, "don't do dumb #### with your network 101" stuff.  But this approach answers my earlier question about how they'd get the information of the server...if they know the IP and how to get to it, it's relatively easy to get to the server to get a file off it.

While not a full anti-forensic technique, the adversary is heavily leveraging compromised or spoofed tokens for accounts for lateral movement. This will frustrate commonly used detection techniques in many environments. Since valid, but unauthorized, security tokens and accounts are utilized, detecting this activity will require the maturity to identify actions that are outside of a user’s normal duties. For example, it is unlikely that an account associated with the HR department would need to access the cyber threat intelligence database.
Click to expand...
This is the other part that sticks out to me.  It doesn't appear to be looking to get at "root" or "admin" credentials.  It's a "get what I can get" kind of approach.  This would tell me that further work in the environments would need to be done to get any of the really "good" information.  It's a good way to move around in the company without being detected unless someone is looking at audit logs and saying "hey, why is Joe's access database trying to get into HR/Payroll".  Again, companies worth their salt have most of that completely locked down from an id/passwd perspective and are on remote segments of their networks.  

User Impersonation

The adversary’s initial objectives, as understood today, appear to be to collect information from victim environments. One of the principal ways the adversary is accomplishing this objective is by compromising the Security Assertion Markup Language (SAML) signing certificate using their escalated Active Directory privileges. Once this is accomplished, the adversary creates unauthorized but valid tokens and presents them to services that trust SAML tokens from the environment. These tokens can then be used to access resources in hosted environments, such as email, for data exfiltration via authorized application programming interfaces (APIs).

CISA has observed in its incident response work adversaries targeting email accounts belonging to key personnel, including IT and incident response personnel.

These are some key functions and systems that commonly use SAML.

Hosted email services

Hosted business intelligence applications

Travel systems

Timecard systems

File storage services (such as SharePoint)
Click to expand...
This is probably the part that is the most concerning though.  Above I mentioned the encryption of the network.  If they are successful in identifying the SAML servers and compromise them, all bets are off.  There's really not an easy way to do this though.  It would be rather obvious that this was on the server as there has to be a physical token on that server.  Look at timestamps of where those files are and look at the entries and you can tell quickly if they've been able to put a dup in.  There's more there, but I've got some work to do...those are my high level thoughts for as far as I've read.

 
Mr. Ham said:
Good to know. I’m in IT, but (obviously) security is not my forte. Basing on articles I’ve been reading last couple of days.

I’m seeing red (beyond the pun of it being Russia.) We need to articulate what the stakes are and our response will be for these kinds of attacks.
Click to expand...
What do you want that response to be?  Do you want POTUS (whoever it is at the time, past/present/future) to announce "Russia, if you hack our systems, we will drop bombs on Moscow"?  Would you prefer the response be to let Russia know via back channels "we will shut down your energy grid"?  What makes you think we aren't attempting the exact same hacks into Russia and China right now?

 
Anyone remember when we told the Soviet’s we weren’t using U-2s to take pictures of them?  Then they shot one down.  Crazy times, am I right?

 
The General said:
Crazy this isn’t the top story everywhere.
Click to expand...
How did Russia get in?

They were invited:

Donald J. Trump @realDonaldTrump · Jul 9, 2017

Putin & I discussed forming an impenetrable Cyber Security unit so that election hacking, & many other negative things, will be guarded..

 
  • Sad
Reactions: JAA
Sinn Fein said:
How did Russia get in?

They were invited:

Donald J. Trump @realDonaldTrump · Jul 9, 2017

Putin & I discussed forming an impenetrable Cyber Security unit so that election hacking, & many other negative things, will be guarded..
Click to expand...
Trump still hasn’t said a peep about this right?

I know he’s checked out completely on the job since his beatdown but I would at least expect his usual redirection on failures to someone else. 

 
  • Sad
Reactions: JAA
The General said:
Trump still hasn’t said a peep about this right?

I know he’s checked out completely on the job since his beatdown but I would at least expect his usual redirection on failures to someone else. 
Click to expand...
He actually hasn’t held a single Cabinet meeting since May. He checked out a long time ago.

 
The General said:
Trump still hasn’t said a peep about this right?

I know he’s checked out completely on the job since his beatdown but I would at least expect his usual redirection on failures to someone else. 
Click to expand...
I mean, even POMPEO is fingering Russia. Some scoff the russia, russia, russia thing, but Trump's silence here is about as telling as it gets.

Speaking on the "Mark Levin Show", Pompeo said there was "a significant effort to use a piece of third-party software to essentially embed code inside US government systems," according to the BBC.

"We can say pretty clearly that it was the Russians that engaged in this activity," Pompeo said, NBC reported. "I can't say much more as we're still unpacking precisely what it is, and I'm sure some of it will remain classified."

"This was a very significant effort, and I think it's the case that now we can say pretty clearly that it was the Russians that engaged in this activity," he added.
Click to expand...

 
  • Smile
Reactions: JAA
Seems POTUS is too busy complaining about an election he clearly list and pumping up Space Force as great to talk about this hack or Covid.

 
  • Sad
Reactions: JAA
@Trump - The Cyber Hack is far greater in the Fake News Media than in actuality. I have been fully briefed and everything is well under control. Russia, Russia, Russia is the priority chant when anything happens because Lamestream is, for mostly financial reasons, petrified of........discussing the possibility that it may be China (it may!). There could also have been a hit on our ridiculous voting machines during the election, which is now obvious that I won big, making it an even more corrupted embarrassment for the USA. @DNI_Ratcliffe @SecPompeo

--

Sigh. One more month of this clown. Can't come soon enough.

 
Agreed.  This poisoning of the wells needs stop as soon as possible.  It's like Jesus Christ what country is he working for here? 

 
Last edited by a moderator:
whoknew said:
@Trump - The Cyber Hack is far greater in the Fake News Media than in actuality. I have been fully briefed and everything is well under control. Russia, Russia, Russia is the priority chant when anything happens because Lamestream is, for mostly financial reasons, petrified of........discussing the possibility that it may be China (it may!). There could also have been a hit on our ridiculous voting machines during the election, which is now obvious that I won big, making it an even more corrupted embarrassment for the USA. @DNI_Ratcliffe @SecPompeo

--

Sigh. One more month of this clown. Can't come soon enough.
Click to expand...
Way to completely undermine every official with a job to do.  Unbelievable. 

 
You must log in or register to reply here.

Similar threads

MTskibum
US cybersecurity firm FireEye hit by 'state-sponsored' attack
Replies
2
Views
325
top dog
top dog
GordonGekko
Operation Fast & Furious Scandal: Obama Administration's ATF Sent Guns To Drug Cartels (5/27/22 20:22 PST)
Replies
7
Views
533
Max Power
Max Power
GordonGekko
Votes Over "Inclusion" - Transgender Women Must Register For US Selective Service (Draft), But Not Transgender Men (10/11/22 18:47 PST)
Replies
4
Views
435
FairWarning
FairWarning

Users who are viewing this thread

Total: 2 (members: 0, guests: 2)
Top