Sensitive I.T. systems connected to the public internet...
Discussion
Was just wanting to ask any I.T. bods out there as to why sensitive I.T. systems are connected to the global internet?
It this a correct assumption given that how we keep hearing of how certain systems are able to be hacked, in the world of cyber crime?
Would a system be immune from cyber crime if it were simply not attached to the global internet?
It this a correct assumption given that how we keep hearing of how certain systems are able to be hacked, in the world of cyber crime?
Would a system be immune from cyber crime if it were simply not attached to the global internet?
So when we hear of all this international cyber crime originating from China, Russia and vice versa from the USA towards China etc.... its not really groups of people sitting in dark room within those countries performing the 'attack' in the safety of their geographic location. .... Its more a case that governments are providing 'agents' to actually be on site of the LAN of any particular intended hack/attack ?
Most are remote afaik.
To cock up a Bank for example, or anything which interacts with the customer, you don't really need to 'get in' you just need to disrupt the connection to / access of the customer i.e ddos or something similar.
If you wanted to properly mess something up, getting on site would give you much more ability, however many places have many many backups, parallel running systems at different locations etc. I know very little about all this stuff, but its pretty impressive whats possible if a firm spends the cash.
eta: as mentioned, the thing of leaving usb sticks in the hope someone takes it on site and plugs it in is simple but effective.
To cock up a Bank for example, or anything which interacts with the customer, you don't really need to 'get in' you just need to disrupt the connection to / access of the customer i.e ddos or something similar.
If you wanted to properly mess something up, getting on site would give you much more ability, however many places have many many backups, parallel running systems at different locations etc. I know very little about all this stuff, but its pretty impressive whats possible if a firm spends the cash.
eta: as mentioned, the thing of leaving usb sticks in the hope someone takes it on site and plugs it in is simple but effective.
Depends what you call sensitive
I had some interaction with a large UK Power company years ago, they ran our very old (90s) legacy software on a machine with no remote access, took about a month to get clearance, then a day to go there , a few hours to get through security, all to do a 20 minute job on a piece of software!
It was so old all the staff that created it had left the company as well!
I had some interaction with a large UK Power company years ago, they ran our very old (90s) legacy software on a machine with no remote access, took about a month to get clearance, then a day to go there , a few hours to get through security, all to do a 20 minute job on a piece of software!
It was so old all the staff that created it had left the company as well!
It can be quite difficult to provide true isolation for installations in remote locations and hence use of the public internet is sometimes the most cost-effective / pragmatic solution. Typical examples that come to mind are things like pipeline monitoring, water pumping stations, electrical sub-stations etc. Short of installing a dedicated network connection or using GSM / Line of Site there isn't many more options.
Ultimately it comes down to a strength in depth approach and sadly many companies just don't grasp how far they need to go. Many of the companies I work with will actively provide physical measures (in addition to software measures) to prevent access.
In many of the cases it's true that the weak link is existing personnel with access e.g. plugging in USB drives, opening up emails they shouldn't, giving away login credentials inadvertently etc.
There's a big drive by the UK government and UK HSE regarding cyber security of industrial control systems, although they haven't explicitly stated the current situation I strongly suspect there's a large number of attacks/incidents that go unreported.
Ultimately it comes down to a strength in depth approach and sadly many companies just don't grasp how far they need to go. Many of the companies I work with will actively provide physical measures (in addition to software measures) to prevent access.
In many of the cases it's true that the weak link is existing personnel with access e.g. plugging in USB drives, opening up emails they shouldn't, giving away login credentials inadvertently etc.
There's a big drive by the UK government and UK HSE regarding cyber security of industrial control systems, although they haven't explicitly stated the current situation I strongly suspect there's a large number of attacks/incidents that go unreported.
Atomic12C said:
So when we hear of all this international cyber crime originating from China, Russia and vice versa from the USA towards China etc.... its not really groups of people sitting in dark room within those countries performing the 'attack' in the safety of their geographic location. .... Its more a case that governments are providing 'agents' to actually be on site of the LAN of any particular intended hack/attack ?
It's a total mix. If you look at logs of intrusion attempts you wouldn't typically be looking for China or Russia as they'd sensible just rent a server somewhere a little less obvious and work from there.Also there's assumption that people "attack" a bit like when you see people in films breaking through firewalls, it's often the opposite, you're sent an email, it has a legitimate looking link or attachment that you click, it downloads a little bit of software that connects out to their infrastructure then they're in.
On this subject I notice that the likes of Russia, China and the USA are furiously working towards getting a functional/usable quantum computer up and running, whereby they will be able to 'jump over' all current encryptions used by the internet.
With this in mind, how brittle is the safety of nuclear power stations, missile codes, military I.T. systems, government systems etc. etc. ?
If, as it is being said, it 'should' always be the case that an agent is required on site to leave or use a USB or direct access to a system then the secondary 'hard' security may need to be 'buffed up', but is that likely to be enough?
(I may be demonstrating my lack of knowledge in the field of I.T. here.... so if any of this is just plain garbage then feel free to correct me)
With this in mind, how brittle is the safety of nuclear power stations, missile codes, military I.T. systems, government systems etc. etc. ?
If, as it is being said, it 'should' always be the case that an agent is required on site to leave or use a USB or direct access to a system then the secondary 'hard' security may need to be 'buffed up', but is that likely to be enough?
(I may be demonstrating my lack of knowledge in the field of I.T. here.... so if any of this is just plain garbage then feel free to correct me)
if you have the statement 'your entire network is only as secure as your most stupid user' at the front of your mind you will start to understand what situation we are in.
Social engineering is still, by far, the most effective way of gaining access.
Find a few old keys, put them on a keyring, get a 32gb usb stick, load it with autorun malware, drop it in the employee car park. Wait for mark to pick it up and put it in his terminal to see what is on it.
more extreme is the Raspberry Pi wifi drop boxes which are completely self contained that will just keep collecting packets until it has enough to work out the password - these can be thrown onto roofs, buried in the ground etc.
Lastly, and the most frightening of all, i know of at least 2 sensitive Government agencies that still use windows XP - an OS that has not been supported by MS since 2014. No Patches for 2 years = well documented vulnerabilities that a 14 y/o could exploit.
Social engineering is still, by far, the most effective way of gaining access.
Find a few old keys, put them on a keyring, get a 32gb usb stick, load it with autorun malware, drop it in the employee car park. Wait for mark to pick it up and put it in his terminal to see what is on it.
more extreme is the Raspberry Pi wifi drop boxes which are completely self contained that will just keep collecting packets until it has enough to work out the password - these can be thrown onto roofs, buried in the ground etc.
Lastly, and the most frightening of all, i know of at least 2 sensitive Government agencies that still use windows XP - an OS that has not been supported by MS since 2014. No Patches for 2 years = well documented vulnerabilities that a 14 y/o could exploit.
A good starting point about a very big very famous recent "hack"
https://krebsonsecurity.com/2014/02/target-hackers...
Of course if a three letter government agency wants you stuff you're probably screwed but a lot of it is just common sense.
For example, you've come here and you've logged in using a username and password but did you notice there's no padlock?
That means your username and password are sent over the internet in plain text.
Do you use your username or password on any other websites that might be a little more sensitive than Pistonheads?
Do you have any idea how the sites you use store your data? Is it encrypted? Is it visible to employees it doesn't need to be?
The point I'm making is that some hacks are massively massively smart in how they're done, but the vast majority are done by either getting your target to do all the work for you, or because they've done something daft and made it really easy i.e. Talk Talk and the 15 year old schoolboy.
https://krebsonsecurity.com/2014/02/target-hackers...
Of course if a three letter government agency wants you stuff you're probably screwed but a lot of it is just common sense.
For example, you've come here and you've logged in using a username and password but did you notice there's no padlock?
That means your username and password are sent over the internet in plain text.
Do you use your username or password on any other websites that might be a little more sensitive than Pistonheads?
Do you have any idea how the sites you use store your data? Is it encrypted? Is it visible to employees it doesn't need to be?
The point I'm making is that some hacks are massively massively smart in how they're done, but the vast majority are done by either getting your target to do all the work for you, or because they've done something daft and made it really easy i.e. Talk Talk and the 15 year old schoolboy.
Atomic12C said:
Was just wanting to ask any I.T. bods out there as to why sensitive I.T. systems are connected to the global internet?
It this a correct assumption given that how we keep hearing of how certain systems are able to be hacked, in the world of cyber crime?
Would a system be immune from cyber crime if it were simply not attached to the global internet?
If the hackers want to get in, they will. No system is hack proof, but you can get pretty close or to a point where it requires considerable effort to get into a system in some way.It this a correct assumption given that how we keep hearing of how certain systems are able to be hacked, in the world of cyber crime?
Would a system be immune from cyber crime if it were simply not attached to the global internet?
Depending on how much desire there is to get in which broadly relates to the value of the target, they will use various means to do so. It's not uncommon in some countries for kidnapping to occur to force an employee to give hackers access inside the network etc Criminals/ state actors/ hacktivists are generally always a step ahead of security professionals. Often some of my customers in the past have taken a risk stance of ensuring they are more secure than their competitors - let the attacker find an easier target, least path of resistance principle.
There are software controls to deal with 'malicious insiders' and ways of removing administrative or root privileges from systems, so that even if those 'superuser' accounts are compromised it does not mean they have access to every system, access to data, can install further malicious software etc.
Most large organisations take a risk based approach and spend more time securing public facing systems. Yes government systems are still running XP- and to put that into context that is not the oldest OS used in government or critical infrastructure by a long way!- but there are multiple layers of security software /controls to mitigate some (not all) of the risks. We are not talking Antivirus/Antimalware here - more system hardening, sandboxing, policy based controls, ability to deprecate admin rights and accounts, policy based networking at the host level, device controls etc. Lots you can do if required and you have budget. Layers of network, proxy traffic, user authentication, privilege access controls to throw at the problem if you have the budget.
That's why the biggest risks in the next few years is with devices/ wearables/ Internet of Things. The more 'things' are connected to the internet, the more risk there is from attack. Hijacking webcams, CCTV systems is fairly easy and recent Denial of service attacks ( look up MIRAI botnet) used 10's of thousands of webcams to launch attacks on various computer networks.
What i would be more worried about today is Ransomware- the drive encryption method is very reliable and in the corporate world we hear of 70% plus of companies paying out to the criminals to get their data back. It's a great business model and it's not unsurprising to realise that the large criminal gangs (some of whom were drug cartels in the past) have put their considerable business brains into cybercrime.
There is some recent ransomware that attacks a host - and then pops up a message to say IF you install their software on 2 or more other machines - they will decrypt your infected system for free. Neat eh? Get a normal user to spread your crimeware for you and increase your income opportunities.
IT Security is wide topic- staff need awareness- all staff not just IT, systems need securing, risk analysis should be done across all systems, systems and their logs need monitoring, backup systems are fundamental to security etc The list goes on and on. User behavioural analytics are now being used to spot anomalous behaviour of a user and/or their accounts to highlight potential issues and security events. Big Data systems are just coming online to do predictive threat analysis and highlight risks for corporations from their customers and employees. The level of data collection and processing we are talking about would blow most people's minds even within the industry but it's going to make a big difference soon.
What everyone will see soon- even down to a personal level - is cyber crime insurance. Premiums will rise, of that there is no doubt. I'm trying to work out which insurance company who provides this is worth investing in as they will make a LOT of money in the future.
I've been involved in 'post breach' projects to help secure systems that have been hacked for many years now - and the ingenuity used by criminals is staggering. But as said above, most threats will be targeted at normal employees in a business - usually over a phishing email attempt or social engineering - rather than go direct for the C level execs etc. Humans are always the weakest link that will be exploited. Often the problem is between the chair and the keyboard and not IT
For small companies, the first rule of security in my mind is Backup. Backup everything. At least twice. Keep data offsite. Verify backup data often and do test restores. If systems get hacked/encrypted/ infected and rendered unusable, wipe the system and restore from backup. This is the MINIMUM every organisation should get to but it's scary how badly this is done, or how low a priority it is within some businesses.
SO to answer your question -it's more and more difficult to justify not connecting devices/systems to the internet because there are huge benefits but some systems will always stay isolated.
I won't go into the details of what I do for a living but if I were tasked to get high-level access to a company's systems...
Do a search and harvest of all employee names on LinkedIn, Facebook and Google+ that correspond to the company email address or website URL. This will get you a reasonable supply of employee names. It's a simple as this: https://www.google.co.uk/?gfe_rd=cr&ei=OnRaWMe...
Then I'd probably hunt for some kind of web access to email or any other remote system which requires authentication (ways and means to make this a trivial task but, yeah, not going to go into THAT much detail). Once I have a nice interface that allows me to throw usernames and passwords at it, I'll format the list of names I gleaned to firstname.surname@domain.com, f.surname@domain.com fsurname@domain.com and a few other common formats for email addresses. A lot of places will have lockout policies on too many failed passwords but that doesn't mean you can't try a combination with breaks every hour. Even throwing the huge list of possible of addresses and using Password1 may expose a user who doesn't take security too seriously.
Once you're into their email, you're into a goldmine of information. The absolute worse case is that you end up with a tonne of legitimate email addresses, which is more names and a greater, more specific library of names to test against. The best result would be to find carelessly emailed credentials, which will usually also detail the service they can be used against.
Once you have a few sets of valid credentials, you start working on remote access. Finding a single-factor VPN would be wonderful here and I'm only going to stick to that as an example. Use your sets of known credentials and you'll hopefully at some point establish a VPN connection to the internal network. Handy.
Once on the network, have a little hunt for exploitable hosts. You'll be looking for any old operating systems or stuff which hasn't been patched for major vulnerabilities. Find your host and start attacking it for local Administrator credentials. Nine times out of ten, the local Administrator password policy won't have been changed and you can hammer the sh*t of it in attempts to get the password. Assuming you can bust a local Administrator account open with a wordlist attack, you can then get on to the machine and try to access the next goldmine.
This is where things get interesting. It won't be too hard, once you have local Administrator rights, to get a list of domain users of that system and their hashed passwords. You can take a handy copy of that hashdump and then you can work on cracking it. Without going into the tedious details of rainbow tables, there are not unreasonable chances of being able to crack one of these hashed passwords fairly quickly.
Best case scenario is that you get the credentials for a member of IT staff who has some elevated rights. A domain admin would be nice and once I have that, it's game over; I have my hand deep in your guts and I'm wiggling my fingers.
All of the above is one simple path, without using any spooky 1337 h4><0ring techniques which people imagine.
Two things are pretty amazing about this:
1. That particular path to full-control is achievable for more companies and organisations than you'd like to believe.
2. A strong password policy or 2FA/MFA would defeat it.
You won't ever be protected from every single attack vector but when people are lazy and look for the path of least resistance, most people will prefer a walk in a park to an assault on Fort Knox.
Do a search and harvest of all employee names on LinkedIn, Facebook and Google+ that correspond to the company email address or website URL. This will get you a reasonable supply of employee names. It's a simple as this: https://www.google.co.uk/?gfe_rd=cr&ei=OnRaWMe...
Then I'd probably hunt for some kind of web access to email or any other remote system which requires authentication (ways and means to make this a trivial task but, yeah, not going to go into THAT much detail). Once I have a nice interface that allows me to throw usernames and passwords at it, I'll format the list of names I gleaned to firstname.surname@domain.com, f.surname@domain.com fsurname@domain.com and a few other common formats for email addresses. A lot of places will have lockout policies on too many failed passwords but that doesn't mean you can't try a combination with breaks every hour. Even throwing the huge list of possible of addresses and using Password1 may expose a user who doesn't take security too seriously.
Once you're into their email, you're into a goldmine of information. The absolute worse case is that you end up with a tonne of legitimate email addresses, which is more names and a greater, more specific library of names to test against. The best result would be to find carelessly emailed credentials, which will usually also detail the service they can be used against.
Once you have a few sets of valid credentials, you start working on remote access. Finding a single-factor VPN would be wonderful here and I'm only going to stick to that as an example. Use your sets of known credentials and you'll hopefully at some point establish a VPN connection to the internal network. Handy.
Once on the network, have a little hunt for exploitable hosts. You'll be looking for any old operating systems or stuff which hasn't been patched for major vulnerabilities. Find your host and start attacking it for local Administrator credentials. Nine times out of ten, the local Administrator password policy won't have been changed and you can hammer the sh*t of it in attempts to get the password. Assuming you can bust a local Administrator account open with a wordlist attack, you can then get on to the machine and try to access the next goldmine.
This is where things get interesting. It won't be too hard, once you have local Administrator rights, to get a list of domain users of that system and their hashed passwords. You can take a handy copy of that hashdump and then you can work on cracking it. Without going into the tedious details of rainbow tables, there are not unreasonable chances of being able to crack one of these hashed passwords fairly quickly.
Best case scenario is that you get the credentials for a member of IT staff who has some elevated rights. A domain admin would be nice and once I have that, it's game over; I have my hand deep in your guts and I'm wiggling my fingers.
All of the above is one simple path, without using any spooky 1337 h4><0ring techniques which people imagine.
Two things are pretty amazing about this:
1. That particular path to full-control is achievable for more companies and organisations than you'd like to believe.
2. A strong password policy or 2FA/MFA would defeat it.
You won't ever be protected from every single attack vector but when people are lazy and look for the path of least resistance, most people will prefer a walk in a park to an assault on Fort Knox.
Atomic12C said:
Fascinating stuff !
I may need to have a word with our I.T. guys
Just for peace of mind and ensure we have sensible security and I.T. policy.
I'd expect them to welcome any interest.I may need to have a word with our I.T. guys
Just for peace of mind and ensure we have sensible security and I.T. policy.
The thing we IT folks hate, well me anyway, is when people think security is an IT thing and is all done by shiny boxes.
In reality it's a mix of people, process, and technology and ideally you need all three done properly.
We just use control systems that are so old, the programmers are all dead !
Seriously, the reactor control systems don't use any recognisable networking protocols and only have simple hdlc connections outside of the room they are locked in and the operating system is so basic (designed in the early 70's) that you can't do anything much anyway.
And on top of all this, the computer systems that control the reactor have no real direct safety role, that's done by a pure hardware system with absolutely no programmable logic in it at all (magnetic flux laddic units and relays).
But in the future, programmable reactor safety systems (that are more likely to be used) look less and less attractive.
Actually, it's probably the grid that is more of a target as a country wide blackout would take ngc about 4 days to restart.
Seriously, the reactor control systems don't use any recognisable networking protocols and only have simple hdlc connections outside of the room they are locked in and the operating system is so basic (designed in the early 70's) that you can't do anything much anyway.
And on top of all this, the computer systems that control the reactor have no real direct safety role, that's done by a pure hardware system with absolutely no programmable logic in it at all (magnetic flux laddic units and relays).
But in the future, programmable reactor safety systems (that are more likely to be used) look less and less attractive.
Actually, it's probably the grid that is more of a target as a country wide blackout would take ngc about 4 days to restart.
Trouble is countries are now building in the back doors directly into the chips/firmware on logic boards just waiting to be enabled by the attacker.
Huawei, ZTE comes to mind is a company with an apparent Chinese Military background they and many other state organizations do also, lots of enterprise and government UK entities use their products for routing and security.
Huawei, ZTE comes to mind is a company with an apparent Chinese Military background they and many other state organizations do also, lots of enterprise and government UK entities use their products for routing and security.
Edited by souper on Thursday 22 December 10:21
Also worth bearing in mind that you don't always need access to a secure system to cause harm. Unless everything that supports its function has been built with standalone survivability in mind then there will be a method of attack - usually something as simple as messing with the HVAC systems and cooking the hardware.
Current trends seem to be taking two angles:
1) Attacks which are large enough to compromise the availability of entire ISPs
2) Highly sophisticated attacks that target specific functionality within the targeted appliance...by hitting something else in the same stack/leg.
...and as other people have mentioned....people. People are a pain in the arse when it comes to security. You make something foolproof and within ten minutes a new and improved idiot will appear and **** it up.
Security of all aspects is a boardroom level issue and must be driven from the very top of any organisation...there MUST be a competent, knowledgeable individual on the board who can articulate the risks for the business heads whilst maintaining a clear understanding and working relationship with the IT Security teams.
Don't even get me started on DLP, Digital Footprints and contractors...
Current trends seem to be taking two angles:
1) Attacks which are large enough to compromise the availability of entire ISPs
2) Highly sophisticated attacks that target specific functionality within the targeted appliance...by hitting something else in the same stack/leg.
...and as other people have mentioned....people. People are a pain in the arse when it comes to security. You make something foolproof and within ten minutes a new and improved idiot will appear and **** it up.
Security of all aspects is a boardroom level issue and must be driven from the very top of any organisation...there MUST be a competent, knowledgeable individual on the board who can articulate the risks for the business heads whilst maintaining a clear understanding and working relationship with the IT Security teams.
Don't even get me started on DLP, Digital Footprints and contractors...
Gassing Station | The Lounge | Top of Page | What's New | My Stuff