[HN Gopher] Spies Jumped from One Network to Another via Wi-Fi i...
       ___________________________________________________________________
        
       Spies Jumped from One Network to Another via Wi-Fi in an
       Unprecedented Hack
        
       Author : impish9208
       Score  : 84 points
       Date   : 2024-11-22 12:11 UTC (1 days ago)
        
 (HTM) web link (www.wired.com)
 (TXT) w3m dump (www.wired.com)
        
       | brudgers wrote:
       | If your threat model includes nation states, you are outgunned.
       | 
       | A nation state can probably _buy_ the building across the street
       | if that 's the value of hacking your system.
       | 
       | Of course there are almost certainly cheaper options,but that's
       | the level of time and budget you are up against...teams of
       | motivated and well resourced experienced professionals working
       | against you full time.
        
         | hulitu wrote:
         | > If your threat model includes nation states, you are
         | outgunned.
         | 
         | If basic security is not implemented, you have bigger problems.
         | (backdoors in Cisco, Fortinet, Palo Alto Networks, skipping
         | tests - Cloudstrike)
        
           | brudgers wrote:
           | Like I said, there are almost certainly cheaper options. It
           | would be unprofessional for intelligence professionals to do
           | things to hard way.
           | 
           | You are outgunned.
        
         | rangestransform wrote:
         | We should still try our best to secure everything against
         | nation state actors, so that people who really need it
         | (journalists, dissidents, security researchers, etc.) can blend
         | into the crowd with regular consumer grade devices
        
         | rapjr9 wrote:
         | But then the source code of the nation states is hacked and
         | anyone can pull off nation state style attacks:
         | 
         | https://en.wikipedia.org/wiki/Vault_7
         | 
         | The nation states still have a money/people/breaking+entering
         | advantage, but the cyberattack code is now something everyone
         | has to protect against. Also some companies are important
         | enough that they have to protect against nation state attacks,
         | like pipeline operators, chemical plant operators, utilities,
         | and telecom companies:
         | 
         | https://www.nytimes.com/2024/11/22/us/politics/chinese-hack-...
         | 
         | And criminals won't hestitate to use your family to blackmail
         | you, so all the families of people with critical jobs need to
         | be protect also, and their friends families, and...basically
         | everybody.
        
           | mu53 wrote:
           | You say criminals, but I think you meant intelligence
           | agencies
        
             | westmeal wrote:
             | Pretty much the same thing.
        
             | ElevenLathe wrote:
             | A distinction without a difference.
        
               | ajb wrote:
               | In this context, the difference is that intelligence
               | agencies have a bigger budget: the cited hack does not
               | show that an ordinary criminal budget would be
               | sufficient.
        
         | Toutouxc wrote:
         | If your threat model includes states. The states being nation
         | states or not is irrelevant.
        
         | fulafel wrote:
         | The nation state as a threat model adversary is kind of a weird
         | abstraction. Does it include intrusive questions eg about
         | social media asked by a border agent on your next trip abroad?
         | Does it include getting your web browsing traffic collected up
         | by the nine eyes spooks? Or does it mean a rich country is
         | marshaling all its resources in a manhattan project grade
         | effort to target you personally?
         | 
         | In any case as in all things defense, you assume your adversary
         | is to some extent rational and making attacks harder (more
         | expensive, risky, opportunity cost, etc) improves the equation
         | for you.
        
         | impossiblefork wrote:
         | If you can't secure computers against state attackers, then you
         | have to stop using computers and to simply talk in places where
         | there are not phones, computers etc.
         | 
         | If you're afraid about directional microphones out in the woods
         | there are countermeasures for that too, but security is very
         | possible even against the very most well-funded attackers.
         | 
         | Furthermore, I don't think even internet-connected secure
         | computers are so hard that they can't be built. Limit what you
         | do, so that you can write the program short enough that you can
         | afford to have theoretical guarantees-- maybe write it to run
         | on a computer with Harvard architecture to avoid buffer
         | overflows, and you can probably build one on an FPGA, even as a
         | hobbyist.
         | 
         | State attackers aren't magic.
        
           | chgs wrote:
           | Until state attackers pick up your developers kids and bring
           | them home from school, and then nicely ask him to put in a
           | back door.
        
             | impossiblefork wrote:
             | But how would they know how the developer is? This is the
             | neat part of not putting things where people can find them
             | out.
             | 
             | Also, if you really keep it short, you can always check
             | that he hasn't by reading it. You could also just never
             | update it, and it let become ancient and well-tested.
        
               | Spooky23 wrote:
               | Lots of espionage and surveillance within government and
               | contractors.
               | 
               | Lots of body shop contractors are fake people anyway.
               | Pretty easy to imagine placing a compromised person in a
               | low sensitivity area, then moving laterally.
        
               | impossiblefork wrote:
               | But why you hire consultants to solve core security
               | problems?
               | 
               | Furthermore, surely it would just be one guy who knows OS
               | and FPGA stuff and another guy to check it?
               | 
               | What I'm arguing for is that a sensible solution to
               | security problems is to avoid complexity, so that things
               | can be obviously secure.
               | 
               | Carefully defined interfaces designed to be clear,
               | impossible to misinterpret and which are designed to be
               | parsed and implemented without doing anything requiring
               | some kind of fiddly parsing that can lead difficulties,
               | and small enough that someone can implement them in an
               | afternoon; and then you combine that with a machine
               | inherently robust to things like buffer overflows such as
               | Harvard architecture type things, and it's easy even for
               | a single engineer to program something like that up on an
               | FPGA.
        
               | Spooky23 wrote:
               | You don't.
               | 
               | You hire them for other lower priority roles, but they
               | are inside the firewall. Most large organizations have an
               | immature zero trust environment.
               | 
               | Look at the Microsoft PKI breach. The adversary was able
               | to compromise certificate services in a corporate dev
               | environment and parlay that in accessing US government
               | mailboxes in a supposedly isolated cloud tenant.
               | Microsoft has a world class security practice. The
               | average Fortune 1000 is toast.
        
               | stackskipton wrote:
               | Microsoft PKI was because they were not doing world class
               | security practice. For some reason, consumer environment
               | could sign corporate environment logins. Also, they
               | acquired some company and instead of issuing them new
               | hardware to ensure it wasn't compromised, they just let
               | them onto their network.
               | 
               | When you read the report, it was very clear that
               | Microsoft wasn't doing "World Class Security Practice",
               | they were taking shortcuts like everyone else does.
        
           | Yeul wrote:
           | I read once that when America refurbishes an embassy
           | somewhere in the world they bring in their own construction
           | company. Otherwise you end up with mics in the walls.
           | 
           | Used to think the Chinese were paranoid with their bans on
           | iPhones and Tesla's...
        
             | impossiblefork wrote:
             | Yeah, that seems completely unavoidable otherwise.
             | 
             | I've always seen it as pretty strange to carry around other
             | people's computers or using external services-- so I've
             | always seen things like phones, Google Maps, etc. as things
             | that it is strange that any country that isn't the US
             | allows people to use.
             | 
             | I don't think one absolutely needs to make everything
             | oneself, but I can't imagine that it's sensible that
             | everybody use external services, so that so much
             | information ends up in one place.
        
             | Nab443 wrote:
             | iPhones and Teslas would be overkill anyway:
             | https://www.cryptomuseum.com/covert/bugs/thing/
        
             | sgarland wrote:
             | Kind of. They're required (or agree to?) to use local labor
             | at least in part, but there American companies that manage
             | the construction. My grandfather (a U.S. citizen) does
             | security inspections for embassy construction, verifying
             | that it's built to plan, that all materials are traceable
             | to point of origin, etc.
        
         | ris wrote:
         | > A nation state can probably buy the building across the
         | street if that's the value of hacking your system.
         | 
         | So make them spend that money.
         | 
         | Or, more likely, convince them to refocus on a cheaper target.
        
       | transpute wrote:
       | WiFi security can be improved by per-device passwords,
       | https://github.com/spr-networks/super
        
         | telgareith wrote:
         | Or just enable "WPA-enterprise" and have it rotate keys. Then
         | you not only have device certificates, you also have per user
         | authentication. And if somebody missed it- rotating keys. They
         | can change faster than they can be cracked. Then you can also
         | layer VPNs ontop of that...
         | 
         | All of which are standard, well known, and proven solutions.
         | 
         | What does that repo offer? With 400 stars, I doubt anybody has
         | given it serious attention.
        
           | sigmoid10 wrote:
           | You make it sound like you just have to flip a switch in your
           | router's settings to enable it, but that is very far from the
           | truth. For that to work you need a RADIUS server to handle
           | credentials, a certificate authority if you want any useful
           | kind of authenticity checks, a process for distributing said
           | certificates and finally you need to configure all your
           | access points. This is something that companies can (and
           | should) have, but for home users it is overkill. Since this
           | repo specifically targets home users, I suspect there is a
           | place for this among enthusiasts who can't or don't want to
           | go all the way on their home network.
        
             | rurban wrote:
             | No radius server needed, the builtin kernel module for wifi
             | access points can do that easily.
        
               | BenjiWiebe wrote:
               | Do you mean hostapd? I'm not aware of any builtin
               | kernel/modules doing AP stuff.
        
               | rurban wrote:
               | Right, hostapd. It has the radius functionality builtin
               | you'd need for proper wifi enterprise functionality
        
               | ewuhic wrote:
               | Getting hostapd to work is ass in itself.
        
               | rurban wrote:
               | Yes, but much easier than with a full radius server
        
               | LinuxBender wrote:
               | FWIW one can front-end OpenLDAP or AD with Radius. Once
               | the translation layer is in place then it's more about
               | teaching IT how to manage particular fields in LDAP/AD.
        
               | transpute wrote:
               | From repo at start of thread: screenshots for adding
               | router users and managing network segments,
               | https://apps.apple.com/us/app/secure-programmable-
               | router/id6.... Router image runs Linux and hostapd.
        
       | LorenDB wrote:
       | https://archive.ph/cKrq8
        
       | sharpshadow wrote:
       | "Microsoft warned of a vulnerability in Windows' print spooler"
       | 
       | How much I hated just seeing this process. Print related tasks
       | should never run when not needed.
        
       ___________________________________________________________________
       (page generated 2024-11-23 23:02 UTC)