Breach of F5 requires “emergency action” from BIG-IP users, feds warn

Jump to latest Follow Reply
Muted (0)
Sort by date Sort by votes
E

EricM2

Ars Centurion
375
Subscriptor
  • #10
    Oh look spaces said:
    I believe Vodafone use F5.. Interesting that their entire UK data network (broadband and mobile) with 18M customers went down yesterday for about 3 hours.

    Their netblock just went offline, apparently due to BGP.

    Massive hack or jr dev vibe coding live. Who knows these days?
    Click to expand...
    Installing another firewall in front of their F5's?
     
    Upvote
    39 (39 / 0)
    Fatesrider

    Fatesrider

    Ars Legatus Legionis
    25,484
    Subscriptor
  • #11
    F5, a Seattle-based maker of networking software, disclosed the breach on Wednesday. F5 said a “sophisticated” threat group working for an undisclosed nation-state government had surreptitiously and persistently dwelled in its network over a “long-term.” Security researchers who have responded to similar intrusions in the past took the language to mean the hackers were inside the F5 network for years.
    Click to expand...
    For years, huh? Seems to me this kind of discovery is more and more common. It's ALMOST as if these companies set up things, and then don't look in the right directions to detect intrusions ever again. There's always some blind spot where people think, "Naw, they'd never be able to do that!", and ultimately, that's where they find out how wrong that assumption was.

    Once again, the weak link is Dave, but corporate policy or perhaps security training and education, played a role, too.

    Howsoever it's parsed, it's just another day that ends in a Y. After all, people catch fish every day. This is just a bigger one than normal.
     
    Upvote
    28 (36 / -8)
    A

    akial

    Wise, Aged Ars Veteran
    102
  • #12
    Fatesrider said:
    For years, huh? Seems to me this kind of discovery is more and more common. It's ALMOST as if these companies set up things, and then don't look in the right directions to detect intrusions ever again. There's always some blind spot where people think, "Naw, they'd never be able to do that!", and ultimately, that's where they find out how wrong that assumption was.

    Once again, the weak link is Dave, but corporate policy or perhaps security training and education, played a role, too.

    Howsoever it's parsed, it's just another day that ends in a Y. After all, people catch fish every day. This is just a bigger one than normal.
    Click to expand...
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
     
    Upvote
    136 (138 / -2)
    L

    Leaping Gnome

    Ars Tribunus Angusticlavius
    9,503
    Subscriptor
  • #13
    When are we going to start treat cyber attacks as actual attacks? And when are we going to start holding these companies accountable? I hope all of their customers sue them or they get fined so big they go under. Maybe then security will become an actual priority for vendors and not just checkbox lip service. And they must have known about this for a while and not alerted their customers if they were ready to show that multiple other companies had already done audits and certifications about the breach.
     
    Upvote
    73 (79 / -6)
    F

    Frodo Douchebaggins

    Ars Legatus Legionis
    12,175
    Subscriptor
  • #15
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...

    I can tell you pretty confidently, based on my n=1 experience, that saying "The man with a golden parachute telling the people he saddled with backpacks full of plutonium not to worry doesn't actually stop them from worrying" isn't helpful.
     
    Upvote
    65 (65 / 0)
    D

    dzid

    Ars Centurion
    3,373
    Subscriptor
  • #18
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...
    What if he never does? It's money well spent. Yeah, I know that's not going to fly with the execs, but it's still true.
     
    Upvote
    11 (16 / -5)
    B

    Bigdoinks

    Ars Scholae Palatinae
    1,019
  • #19
    CISA has ordered all federal agencies it oversees to immediately take inventory of all BIG-IP devices in networks they run or in networks that outside providers run on their behalf.
    Click to expand...
    Uh oh, hopefully Trump and Republicans didn't fire all the people responsible for implementing these fixes, right?
    ...Right?
     
    Upvote
    82 (88 / -6)
    P

    plugh

    Ars Scholae Palatinae
    603
    Subscriptor++
  • #21
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...
    I don't know if it will work, but I'd try focusing on the risk. What will it cost the company if we're breached while we're not looking? What if we're breached and we don't find out until our customers tell us? Maybe discuss it while a risk management person happens to be within earshot...
     
    Upvote
    26 (26 / 0)
    dcook32p

    dcook32p

    Ars Scholae Palatinae
    1,095
  • #25
    druid318 said:
    According to their website they discovered this breach in AUGUST, and are just now bothering to inform customers.
    Click to expand...
    According to a Bleeping Computer article, it's due to the government asking them to hold off.

    "F5 notes that it delayed the public disclosure of the incident at the U.S. government's request, presumably to allow enough time to secure critical systems."
     
    Upvote
    99 (99 / 0)
    F

    Frodo Douchebaggins

    Ars Legatus Legionis
    12,175
    Subscriptor
  • #26
    dcook32p said:
    According to a Bleeping Computer article, it's due to the government asking them to hold off.

    "F5 notes that it delayed the public disclosure of the incident at the U.S. government's request, presumably to allow enough time to secure critical systems."
    Click to expand...

    or, less charitably, to allow them time to finish what they were doing in there…
     
    Upvote
    56 (59 / -3)
    O

    Old_Fogie_Late_Bloomer

    Ars Tribunus Angusticlavius
    7,897
  • #29
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...
    "Our defense has to be perfect. 'Their' offense only has to be lucky."

    Or maybe "There are tons of smart people at [COMPANY] too. It only takes one mistake or overlooked threat vector to end up like them."
     
    Upvote
    25 (26 / -1)
    J

    JustPassingThru

    Seniorius Lurkius
    10
  • #30
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...
    Ask your exec if they have home insurance, life insurance, disability insurance, auto insurance, boat/yacht/aircraft insurance or any other other insurance. Be sure to keep mentioning insurance after each example. If they say yes to one or more then build your argument from there, starting with why are you paying for insurance if you are never going to need it! If he says no to all then he's either lying, such a risk taker that you have no hope or so wealthy that . He might be self bonded for some insurance but probably not all.
     
    Upvote
    57 (58 / -1)
    Post content hidden for low score. Show…
    Post content hidden for low score. Show…
    M

    multimediavt

    Ars Scholae Palatinae
    1,275
  • #36
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...
    Remind them the same things can be said about internal legal and accounting resources. Most of the time there aren't irregularities that warrant the high salaries of a J.D. or C.P.A., but when the fit hits the shan they sure are good to have around, aren't they?
     
    Upvote
    30 (30 / 0)
    T

    Tracking turtle

    Smack-Fu Master, in training
    67
  • #37
    akial said:
    Its tough to argue that you should budget someone auditing stuff routinely when he doesnt find any problems ever. You can say "what if one day he does find a problem" and the exec can say "what if he never does and we spent all these resources for nothing".

    Ive tried all kinds of responses to that, but never found anything that works reliably. To them I seem paranoid and not respectful of the bottom line. I can link a hundred articles like this and theyll just scoff and say "pfft they probably suck, not like THIS outfit!!!"
    Click to expand...
    Well, why buy insurance if you never have a theft, fire, accident, medical emergency, ... ? Because if you don't buy it, and something bad happens, you will suffer a lot more. Same goes for security.
     
    Upvote
    25 (25 / 0)
    S

    stormcrash

    Ars Legatus Legionis
    11,184
  • #38
    o Shade o said:
    The government contracts experts from private enterprise because they don't have experts.
    Click to expand...
    That's just what the republicans and big business want you to think. They want you to think the only "economical" solution is to constantly pay them exorbitant contacting fees instead of maintaining internal expertise.
     
    Upvote
    54 (58 / -4)
    R

    ricerocket

    Wise, Aged Ars Veteran
    143
  • #40
    JustPassingThru said:
    Ask your exec if they have home insurance, life insurance, disability insurance, auto insurance, boat/yacht/aircraft insurance or any other other insurance. Be sure to keep mentioning insurance after each example. If they say yes to one or more then build your argument from there, starting with why are you paying for insurance if you are never going to need it! If he says no to all then he's either lying, such a risk taker that you have no hope or so wealthy that . He might be self bonded for some insurance but probably not all.
    Click to expand...
    It's easy to say but in reality for most companies, cyber security is an afterthought. It's a budget that constantly needs to be fought for. If a type of insurance is not required will people get it? Most likely not.

    And the company could've done all their part right, but there's still so many scenarios where there is no control.
     
    Upvote
    10 (12 / -2)
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply