The issue is with companies having absolutely garbage security practices.
They used social engineering to stay ahead of detection.
My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.
And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.
It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services."
Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
Of course, this is complicated and a big part of the reason cloud is so successful is that the engineers capable of doing complicated stuff are hired by the cloud providers. My pet theory is that FAANG pay so high salaries to prevent competition and home-grown solutions as much as possible by attracting the top x% of the talent pool.
Do you have examples of firewalls that support this and setup guides? I'm using pfSense but haven't come across anything that would flag traffic in this manner. There is snort I guess? Just curious. Always looking to improve my own protection :)
For any rule of the firewall, which may match any kind of traffic, you may set the rule to update a counter. The values of the counters will accumulate the total quantity of data transferred until the counters are reset (periodically), and you may choose to store the values in a log for later inspection or you can use a shell script to interrogate the firewall periodically and compare the counter values with thresholds and send alerts when they are exceeded.
As long as the firewall rules include the option for a "count" or similar action, which I believe to be available in all of them, then you can use the firewall to monitor the amount of data that passes through the network.
Even when a firewall does not provide the length of the packets, just counting the number of packets is enough to estimate the maximum amount of data that might have been transferred, because you know the maximum packet sizes on your interfaces.
Note, this is a $6 figure firewall, so it doesn't compare to something like pfSense.
Security shouldn't be exempt from ROI concerns, that's bizarre.
Governments should regulate more, to make good security have a positive ROI.
Or introduce criminal liability, I suppose.
They're basically the ones watching alert dashboards like suricata all day, investigating issues and trying to isolate systems that have been compromised.
So they're the operational part of an IT security department. Sometimes they're also called CSIRT.
Dataflow analysis can be provided by for example Cisco Smart Network Application (SNA). A system that displays an overview of the network topology including detailed monitoring information for devices and traffic.
There's not a single scenario where a traffic this size to an internal buildbot machine to/from a single unknown resident IP is legit.
I've taken multiple cellphone connections and sorta merged their connections using a hacky workaround in windows to force it to happen even without a proper setting for it. (Note: Not a bridge. Merged. Sorta.)
Just setup each phone as a shared access point through multiple usb ports and let er rip. After doing what I was mentioning though that is.
It's rather simple too, but I don't know how best to explain how it works. BUT I can tell you what I did.
I disable and re-enable each connection one after the other back and forth multiple times until they all are send and receiving data at the same time. This seems to work best when there is already an active connection going. I would use this for Steam downloads a lot.
And yes, all my files I send and receive this way would come and go proper and working. I was doing this back when cell speeds were more like 3mbit/second out in the rural areas. That kind of thing. So getting 10mbit out in the boonies was like living in the city all of a sudden.
they would use a terrestrial connection but the National Broadband Network in Australia is arguably incomplete (putting aside the parts that are supposed to be complete are often very crap). One of my workmates lives 25 mins drive from the WA capital city CBD and has just recently bought Starlink because he couldn't get fast enough or reliable enough internet speeds at home for WFH purposes (Ms Teams is bad but not THAT BAD)
Yeah, Canada is pretty bad too when it comes to having the last mile rolled out to every last town and village. We have tower based internet for those usually. If you are really out in the boonies, you might have something based on Xplornet's tech. Having starlink is only a new thing recently; and that's apparently touch and go for people as well.
Ironically, if you don't play video games at all, Cellular is the best kind of connection you can get out there in some places. Otherwise, get a dish and point it at the nearest tower. It's still basically a giant wifi connection at that point, so the latency will not be the best; but it's far better than Xplornet or cellular ever will be on that front. The only thing better than tower, is a proper line going to the house.
One of my old homes was supposed to have said line installed to that town as part of a province wide thing going on at the time. Sasktel was supposed to get EVERYONE connected with cable and internet...
That never happened. They stuck to the cities and bigger towns close to the backbone, and that was it. They then sold access to companies putting up towers and said "that's a wrap".
That said... they had to contend with the rail lines to get past them on multiple occasions, and that gets expensive.
Unfortunately the NBN organisation itself is a massive boondoggle (see also Australian politics for the last 10+ years) and their idea of 'coverage' often could be beaten handily by a pigeon and some string.
So people pay through the nose for alternatives like Telstra mobile broadband or starlink and given the current neoliberal firesale gov I'd say that's an intentional outcome...
https://unitiwireless.com/internet/fixed-wireless-residentia...
To name a few
NBN is a backup. I get maybe 18mbps from that connection on a good day.
https://t.me/minsaudebr/54?single
In the channel they posted lots of specs and design documents from the iPhone X. So technically it could also have been a vendor in the supply chain (as of now).
They announced a leak at the time, but deleted the torrent files in their posts/comments a couple times and I was too late to verify.
(I'm in European time zone, they are in Brazil).
As it turns out, they got access to huawei, apple, nvidia, samsung, microsoft bing/maps/notes and probably (unconfirmed) vodafone, lge, impresa, mercadolibre and others.
They actively infiltrate organizations with Windows monoculture that never updates, most exploits they seem to have used were running on _really_ outdated systems that are targeting enterprise monoculture as well, like atlassian software, and pretty much everything with an ADS integration.
As I commented previously, it's likely that the SOCs (Security Operations Center) are part of this, too, because _if the certification_ of the targeted organizations isn't utter BS, then they must have caught an incident like this.
A server transferring more than 200GB to a single IP? C'mon, firewalls of the 90s detected that.
They also shamed okta in response to their blog post a lot for having wrong security in place, aka publicly accessible slack channels that have more than ~9k members, where even AWS secrets are posted regularly.
I mean, attack scenarios like this are bound to happen when management decides it's cheaper to hire an external SOC with VPN access for everything. As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change.
Better laws have to be written to enforce the incentive, because clearly, even Microsoft was too late to catch them in the act.
This is what you get for being "cloud native" and there's no way to prevent it. Infrastructure out of your control has to be treated as such, everyone in cybersec was talking about the dangers of using AWS and hire SOCs and external support teams from India for decades already, and nobody listened.