News for hackers. Stuff that matters.

A comment on Sysadmins see evidence that they have been hacked by GCHQ [video]. Parent comment

Re:Sysadmins see evidence that they have been hacked by GCHQ... by atmosx on Monday September 15, 2014 @01:19AM (#8317399)
IMHO it can be done, using UNIX-based operating systems and standard open source software, if the infrastructure designer takes security seriously and is committed and knowledgeable.

It's NOT the system administrator's work to secure the network. The ISP/minor IT company should have a security engineer to overview the network, although some sys-admins are extremely skilled when it comes to security.

There are so many security layers that can be implemented on a Linux/BSD server that makes the machine virtually un-hackable and IF anyone enters, all bells and whistles could start cheering.

Examples: GRsecurity[1], IPTables[2], Snort[3], chroots (or jails), VPNs, malware scanners (clamav, spamassassin), encryption and what-not.

To me securing linux desktops, especially simple ones (e.g. window manager + basic programs... almost like thin clients) is easy. Securing Windows XP/7/8/etc is extremely tricky BUT can be done.

Once you do all that, I'm 100% that you're going to be one hell of a target for anyone. And you really don't trust your team you can always hire people to test your network's security and improve it.

The most important thing though is having a strict general user policy: What users can and can not do must be crystal clear with no exception. When a 'tiger team' finds a secure network, they usually target the people not the infrastructure.

[1] GRsecurity: https://grsecurity.net/

[2] http://www.netfilter.org/projects/iptables/

[3] https://www.snort.org/

[ Parent | on HN ]
Re:Sysadmins see evidence that they have been hacked by GCHQ... by erkkie on Monday September 15, 2014 @03:14AM (#8317622)
While not necessarily technically impossible, it's not plausible due to the asymmetric nature of blanket defense vs a targeted attack. It will always be difficult to protect against motivated targeted attacks.
[ Parent | on HN ]
Re:Sysadmins see evidence that they have been hacked by GCHQ... by bashinator on Monday September 15, 2014 @05:58PM (#8321774)
How would anything you recommend protect you against an attacker who could (for example) have 3G transmitting keyloggers installed in your last shipment of laptops?
[ Parent | on HN ]
Re:Sysadmins see evidence that they have been hacked by GCHQ... by atmosx on Tuesday September 16, 2014 @12:36AM (#8323031)
You choose your hardware carefully and if paranoid enough, you perform statefull packet inspection on your OpenBSD transparent router to know possibly what's the reason/content for every connection. Once you tag those that are standard, you start narrowing things. Again policy is what matters, if you allow torrents you are making your job extremely difficult.

I know easier said than done. Writing firewall rules/ confug reporting tools for every computer in the internal part of a network is hard too, that's why almost no one does it.

[ Parent | on HN ]
Re:Sysadmins see evidence that they have been hacked by GCHQ... by bashinator on Tuesday September 16, 2014 @01:39PM (#8325773)
3G keyloggers. Data egress is completely bypassing your network. (There are pwnie express boxes that include a 3G data link for bypassing target networks when sending results back.) I guess you could add physical scans for unauthorized radio transmitters to your security routine. Opsec is hard.
[ Parent | on HN ]
Re:Sysadmins see evidence that they have been hacked by GCHQ... by atmosx on Wednesday September 17, 2014 @04:37AM (#8329084)
Sure, but that's a physical attack: You need someone to install the 3G Keylogger to your machinery.

I was talking on a keyboard-only level, but even that can be largely mitigate with proper policies IMHO.

That said, an insider is an achilles heel for every security scheme out there (e.g. Snowden).

[ Parent | on HN ]
Re:Sysadmins see evidence that they have been hacked by GCHQ... by lawnchair_larry on Monday September 15, 2014 @02:05AM (#8317481)
Haha, no. Just no.
[ Parent | on HN ]