CyberArk Threat Research

A quick Google search has confirmed that Microsoft has confirmed at least the Russia part: https://www.cyberark.com/resources/blog/apt29s-attack-on-microsoft-tra… It's very hard to argue that when you give 100,000 people access to materials that are inherently worth billions, none of them are stealing those materials. Google has enough leakers to conservative media of all places that you should suspect that at least one Googler is exfiltrating data to China, Russia, or India.

This is false in some scenarios. Dumping browser credential vaults as well as extracting from active memory have both become de facto standard post-exploitation behaviors. References are many: https://kylemistele.medium.com/stealing-saved-browser-passwords-your-n… https://isc.sans.edu/diary/Use+Your+Browser+Internal+Password+Vault...… https://www.cyberark.com/resources/threat-research-blog/extracting-cle… https://www.bleepingcomputer.com/news/security/redline-malware-shows-w…

Companies have software to manage this for you. We utilize https://www.cyberark.com/products/machine-identity-security/

>Agent forwarding forwards the keys insecurely. If you can launch an agent-forwarded connection, then the HSM is already irrelevant. No? ssh-agent works fine with keys that are not exportable from the HSM. By the very definition it's not possible for anything to export the key, ssh-agent or otherwise. >yes, but messing up your terminal is not an RCE It has been, and can be again. https://www.cyberark.com/resources/threat-research-blog/dont-trust-thi…

Cyberark [1] and delinea [2] are definitely leading enterprise solution right now. Okta too has an offering in this space but I haven't seen it used widely yet. But there are quite some solutions in market at this point that are in growing trend. You would find teleport [3], strongdm [4] in high growth companies where as Adaptive.live [5], Idemium.io [6] and now hoop.dev in the early stage to series B. [1] https://www.cyberark.com/ [2] https://delinea.com/thycotic [3] https://delinea.com/thycotic [4] https://www.strongdm.com/ [5] https://adaptive.live/ [6] https://idemeum.com/

More difficult, but if you can capture an IR image of the user, it can be fed in directly if you have a device designed to spoof a USB webcam. A really interesting writeup from last year: https://www.cyberark.com/resources/threat-research-blog/bypassing-wind…

CyberArk PAS: https://www.cyberark.com/products/privileged-account-security-solution…

> re: seccomp This thread has a good answer: https://news.ycombinator.com/item?id=16976392 > "containers do not contain" Is sort of troll bait. They do contain. That is why everyone is using them. Sure, there will be exploits to break out of them, just like with VMs, and even CPU bugs now. Here is a good example of someone who broke out of a container on the play-with-docker.com site using a custom kernel module [1]. This allowed a container escape but you could say this was a bug since that wasn't the intent. So, you'd patch it. So, I get the joke in that people are extremely creative and will find ways around everything. [1] https://www.cyberark.com/threat-research-blog/how-i-hacked-play-with-d…

This completely fails to mention the security issues with Jenkins, as well. https://www.cyberark.com/threat-research-blog/tripping-the-jenkins-mai…

Previous discussion: https://news.ycombinator.com/item?id=16868564 As was brought up in the previous thread, though only briefly mentioned in the linked article, domain fronting is used by malware as well. It was allegedly exploited by Russian state-sponsored hacking group APT29.[0][1] It's unfortunate that it can't be used to help avoid censorship either now, but it was never an intended feature. As the article quotes, other CDNs such as Cloudfront also do not support domain fronting. [0]: https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_fron… [1]: https://www.cyberark.com/threat-research-blog/red-team-insights-https-…

I cannot find a first-party source of why and when Google is shutting down domain fronting, but it makes sense from a cybersecurity perspective. Domain fronting is widely used by malware [1, 2] to evade network-based detection. [1] https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_fron… [2] https://www.cyberark.com/threat-research-blog/red-team-insights-https-…

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authenticate across every service that uses SAML 2.0 protocol ..." [0]. > In a golden SAML attack, attackers can gain access to any application that supports SAML authentication (e.g. Azure, AWS, vSphere, etc.) with any privileges they desire and be any user on the targeted application (even one that is non-existent in the application in some cases). Vulnerabilities like this one really do give up the proverbial "keys to the kingdom" and provide an attacker with pretty much everything they need to really ruin your day. Now, this particular attack isn't real practical as it requires things like the "token-signing private key". You don't need domain admin although you do need access to the ADFS account and if an attacker has access to that, well, you're probably already screwed (or well on your way). The point is that SAML is still shiny and new and there will almost certainly be additional flaws found in the future -- flaws which may very well compromise you completely. It's certainly a nice solution to a big problem and, as I said, will make a lot of people's…