dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Nov 23, 2021 10:04:19 GMT
Basically, to keep all of the confusing techbod acronyms off the Random Musings thread.
Feel free to leverage your IT-related synergies here! Preferably in TLM* form.
Today, I have to fix a Cisco Firepower device that our "network engineer" has installed. Without really knowing what he was doing. Because I didn't already have enough to do trying to coral a recalcitrant dev team to actually fix the issues from last month's pen tests which they just don't want to give the time to. It's all good fun.
*TLM = Three Letter Mnemonic, instead of the more common TLA (acronym!).
|
|
|
|
Post by Danno on Nov 23, 2021 10:11:05 GMT
From what I understand of IT outfits, this should have an acronym of its own |
|
Deleted
Deleted Member
Posts: 0
|
Post by Deleted on Nov 23, 2021 10:21:58 GMT
Basically, to keep all of the confusing techbod acronyms off the Random Musings thread. Feel free to leverage your IT-related synergies here! Preferably in TLM* form. Today, I have to fix a Cisco Firepower device that our "network engineer" has installed. Without really knowing what he was doing. Because I didn't already have enough to do trying to coral a recalcitrant dev team to actually fix the issues from last month's pen tests which they just don't want to give the time to. It's all good fun. *TLM = Three Letter Mnemonic, instead of the more common TLA (acronym!). Funnily enough I've got the head of our dev team wanting to discuss the issues from last month's pen tests that they are trying to wriggle out from. My answers will be "do I look like InfoSec? Ask them...". I'm done with sorting out every other bugger's work for them. |
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Nov 23, 2021 10:22:01 GMT
From what I understand of IT outfits, this should have an acronym of its own I think it's just "dev team", usually.  |
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Nov 23, 2021 10:26:04 GMT
Funnily enough I've got the head of our dev team wanting to discuss the issues from last month's pen tests that they are trying to wriggle out from. My answers will be "do I look like InfoSec? Ask them...". I'm done with sorting out every other bugger's work for them. I am InfoSec and I wish I could be done with sorting out every other bugger's work for them. I understand that people are busy but they wrote the code with the big fucking holes in it. They need to fix it. I am this far (gestures) away from escalating it up to the superiors, tbh. |
|
Deleted
Deleted Member
Posts: 0
|
Post by Deleted on Nov 23, 2021 10:30:07 GMT
Funnily enough I've got the head of our dev team wanting to discuss the issues from last month's pen tests that they are trying to wriggle out from. My answers will be "do I look like InfoSec? Ask them...". I'm done with sorting out every other bugger's work for them. I am InfoSec and I wish I could be done with sorting out every other bugger's work for them. I understand that people are busy but they wrote the code with the big fucking holes in it. They need to fix it. I am this far (gestures) away from escalating it up to the superiors, tbh. Yeah I can relate. I've passed on a load of issues to the Devs and they seem to want me to explain how to fix each and every one of them. That's not going to happen. They need to get online and Google if they don't understand. Just too lazy to look into anything this lot. I've found I'm sort of the InfoSec PM at the moment. I've 20 years of neglect to "fix". If nothing else its a (crap) job for life. Oh and I was a developer for a lot of years, so I know these lot are being lazy buggers. |
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Nov 23, 2021 10:49:27 GMT
I am InfoSec and I wish I could be done with sorting out every other bugger's work for them. I understand that people are busy but they wrote the code with the big fucking holes in it. They need to fix it. I am this far (gestures) away from escalating it up to the superiors, tbh. Yeah I can relate. I've passed on a load of issues to the Devs and they seem to want me to explain how to fix each and every one of them. That's not going to happen. They need to get online and Google if they don't understand. Just too lazy to look into anything this lot. I've found I'm sort of the InfoSec PM at the moment. I've 20 years of neglect to "fix". If nothing else its a (crap) job for life. Oh and I was a developer for a lot of years, so I know these lot are being lazy buggers. Blimey. That definitely seems like their job and not yours! Ours know what to do (which is a good job, because I knew little about coding and was never a dev!), they're just "too busy" to do the work. For about 2 years now. Which has led to things like this: The implications of this are potentially staggering (Oh Hi GDPR breach!) but they're still "too busy". It's time for the big boots, I think. |
|
hedben
Junior Member
Formerly: hedben2013
Posts: 2,206
|
Post by hedben on Nov 23, 2021 11:38:14 GMT
I don't know much about your individual situations or company structure, but in my experience, if devs are reluctant to spend time on security fixes, it's probably not them you need to convince - it's whoever's getting them to prioritise the "value add" work instead.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Nov 23, 2021 11:53:18 GMT
I don't know much about your individual situations or company structure, but in my experience, if devs are reluctant to spend time on security fixes, it's probably not them you need to convince - it's whoever's getting them to prioritise the "value add" work instead. "It's complicated (TM)." |
|
|
|
Post by khanivor on Nov 23, 2021 16:40:13 GMT
/homernerds.gif
|
|
|
|
Post by Zomoniac on Nov 23, 2021 21:22:30 GMT
Wouldn’t it be a Three Letter Initialism? Not sure how effective a Three Letter Mnemonic would be.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 13, 2021 11:46:33 GMT
So, nothing quite like an industry wide, major problem vulnerability discovery to get the non-techy management wailing.
I have been asked approximately 457 times this morning already what we're doing about log4j.
I might have to set up an autoresponder.
If you're wondering if this affects your systems, then yes, chances are it does. And your suppliers, too. Sigh. Happy Xmas from Apache.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 13, 2021 11:49:13 GMT
|
|
Deleted
Deleted Member
Posts: 0
|
Post by Deleted on Dec 13, 2021 11:51:15 GMT
I'm a Google cloud engineer. I type code and click on things and stuff happens.
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,661
|
Post by Bongo Heracles on Dec 13, 2021 11:55:06 GMT
I was in a meeting until 10pm on friday and im just finishing a 3hr meeting about it as we speak. Our attack surface is hilariously big.
I mean, it affects fucking minecraft, so I was updating the java version installed on the girls laptop on saturday.
|
|
|
|
Post by dfunked on Dec 13, 2021 12:00:25 GMT
It's suspiciously quiet at my place apart from a couple of emails from vendors.
Fills me with a little dread I have to say.
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,661
|
Post by Bongo Heracles on Dec 13, 2021 12:05:13 GMT
The problem is, its an API that will never be explicitly called out in a design so we dont know how vulnerable we are until a site wide qualys scan finished on tuesday.
Like if you use splunk to mangle your data, it uses log4j but that isnt called out in any documentation. Repeat x1000.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 13, 2021 12:19:11 GMT
Indeed.
Apparently, the best thing you can do at the moment is control external access for your apps, because it needs an external connection to be successfully exploited.
Our list of Vendors and attack surface is also massive. We've already taken steps to check the important stuff and are really lucky that our main application doesn't use it, but that doesn't stop the Group Head of IT demanding updates every ten minutes.
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,661
|
Post by Bongo Heracles on Dec 13, 2021 12:34:29 GMT
the quick win to stop a few arseholes twitching is to check with networks. We definitely don't allow LDAP to transit outbound, so a lot of the mischief these little scamps can cause is mitigated just by that. We have a few controls that should stop a lot of monkey business but it's still not ideal not knowing how badly you're exposed, though.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 13, 2021 12:39:58 GMT
Indeed. We have a deny all firewall rule for our server subnet with very strictly controlled ACLs allowed to authorised destinations only. Which should hopefully mitigate most issues.
Our client workstations go via Forcepoint... who have yet to confirm if they are affected.
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,661
|
Post by Bongo Heracles on Dec 14, 2021 17:47:18 GMT
Wow, I am not enjoying this. Fucking hell.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 14, 2021 17:53:23 GMT
Wow, I am not enjoying this. Fucking hell. Yeah, fully empathise. Dunno if you have seen but there's a big list of callback domains that you can blacklist (eg, IPS/IDS, Firewall, SIEM etc) here: https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8 Greynoise are creating a list of known exploiters by IP and FQDN too. |
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,661
|
Post by Bongo Heracles on Dec 14, 2021 17:57:46 GMT
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 14, 2021 18:07:30 GMT
Nice, I'll run that into the scripts. Cheers.  |
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Dec 14, 2021 18:38:53 GMT
Also, 15k servers? Fuck me. Sorry, fella.
I'm at 300 checked with a couple of hundred to go. Don't even know I'm born.
|
|
Psiloc
Junior Member
Posts: 1,567
|
Post by Psiloc on Dec 15, 2021 10:56:53 GMT
We posted on Twitter.
We posted on Facebook.
We posted on our forum.
We sent emails directly to all of our signed up contacts.
We're not fucking affected by log4j.
Every five minutes a new ticket:
"Over the weekend our IT department were made aware of a vulnerability known as log4j software vulnerability and would like to seek assurances that..."
|
|
Psiloc
Junior Member
Posts: 1,567
|
Post by Psiloc on Dec 15, 2021 11:16:34 GMT
11:10
"Log4j exploit. I.T have asked me to contact you to find out if our version if xxx is vulnerable and if it is what mitgations are being put in place. Thanks"
The answer is literally written twice in big letters on every page of the website they use to raise tickets.
You guys seem like you work for bigger companies. What's the best way to impart timely information like this? This fucking middle manager thing where raising a ticket or sending an email or waiting in a queue on the phone is their go-to solution rather than spending 5 seconds looking around the screen they're already on. It's completely baffling to me, how do these people get anything done
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,661
|
Post by Bongo Heracles on Dec 15, 2021 11:27:09 GMT
I work in an internal security team so during capers like this we spin up a SIM (serious incident management) and its someone else's problem to talk to people. We dont have external stakeholder clients, as such, so we dont have other businesses ringing up every five minutes asking whagwan.
One thing I would say is that you sound very confident that nothing is affected by this but what did you do to confirm it? The vulnerability is literally everywhere.
|
|
Psiloc
Junior Member
Posts: 1,567
|
Post by Psiloc on Dec 15, 2021 12:03:36 GMT
I'm just a mouthpiece on this one but we provide off-the-shelf software that simply doesn't use Apache or Java in any way and certainly doesn't use the log4j library. The advantage of being in a smaller company I guess means it's easy to keep track of what we use.
If you think we're missing something obvious let me know and I'll take credit for it
|
|
|
|
Post by dfunked on Dec 15, 2021 12:18:38 GMT
I guess different ways of looking at it. Most of us seem to be approaching it from an overall internal infra perspective rather than looking at one specific product, and yeah, it's surprising just how far reaching it is...
|
|
