As pointed out in our previous post about Twitter, the attack has been successful because the least privilege principle has been completely neglected. More recent information confirms this analysis. Reuters points out that more than one thousand employees could use tools and privileges to manipulate user accounts, change their settings and grant rights on account to others. Also some contractors own the same privileges. According to Reuters<\/p>\n\n\n\n
\u201cThat sounds like there are too many people with access\u201d<\/p><\/blockquote>\n\n\n\n
said Edward Amoroso, former chief security officer at AT&T. Responsibilities among the staff should have been split up, with access rights limited to those responsibilities and more than one person required to agree to make the most sensitive account changes.<\/p>\n\n\n\n
\u201cIn order to do cyber security right, you can\u2019t forget the boring stuff.\u201d<\/p><\/blockquote>\n\n\n\n
A first comment is that you cannot forget the boring stuff but you can automate it. This is a fundamental step.
A further comment confirms that too many people shared the privileges.
Former Cisco Systems Chief Security Officer John Stewart said companies with broad access need to adopt a long series of mitigations and \u201cultimately ensuring that the most powerful authorized people are only doing what they are supposed to be doing.\u201d
However, the other interesting observation is that most of the accesses to tools to manipulate the user accounts was logged. But there was no tool to analyze the logs and produce some alerts about suspicious operations using the tools. Furthermore, it is not clear whether the logs where properly protected to prevent manipulations by powerful users with a large number of privileges. Even assuming that logs were properly protected, the lack of a real time analysis to produce alerts implies these logs can only be used for a forensic analysis rather than to detect and prevent insider attacks.
A final observation is that the Twitter attack shows the fragility of important social networks that can be easily manipulated to influence the results of elections and referendums. Security experts are concerned because there is too much work to do and too little time to strengthen Twitter before the campaign for the next presidential U.S. election, with potential domestic inference and from other countries. This is particularly worrisome because, in the same days, a report from UK parliament\u2019s intelligence and security committee said ministers in effect turned a blind eye on the attempts to interfere with the 2016 Brexit referendum. Maybe after the one for critical infrastructures, the EU should define a new NIS directive for social networks.
Link
https:\/\/www.reuters.com\/article\/us-twitter-cyber-access-exclusive\/exclusive-more-than-1000-people-at-twitter-had-ability-to-aid-hack-of-accounts-idUSKCN24O34E<\/a>
https:\/\/www.theguardian.com\/world\/2020\/jul\/21\/russia-report-reveals-uk-government-failed-to-address-kremlin-interference-scottish-referendum-brexit<\/a><\/p>","protected":false},"excerpt":{"rendered":"As pointed out in our previous post about Twitter, the attack has been successful because the least privilege principle has been completely neglected. More recent information confirms this analysis. Reuters points out that more than one thousand employees could use tools and privileges to manipulate user accounts, change their settings and grant rights on account […]<\/p>","protected":false},"author":1,"featured_media":2980,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"yoast_head":"\n
The least privilege has been really forgotten together with other things - Haruspex<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.haruspexsecurity.com\/it\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The least privilege has been really forgotten together with other things - Haruspex\" \/>\n<meta property=\"og:description\" content=\"As pointed out in our previous post about Twitter, the attack has been successful because the least privilege principle has been completely neglected. More recent information confirms this analysis. Reuters points out that more than one thousand employees could use tools and privileges to manipulate user accounts, change their settings and grant rights on account […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.haruspexsecurity.com\/it\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\" \/>\n<meta property=\"og:site_name\" content=\"Haruspex\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-29T09:55:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-07-29T09:55:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png\" \/>\n\t<meta property=\"og:image:width\" content=\"940\" \/>\n\t<meta property=\"og:image:height\" content=\"788\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1\"},\"headline\":\"The least privilege has been really forgotten together with other things\",\"datePublished\":\"2020-07-29T09:55:33+00:00\",\"dateModified\":\"2020-07-29T09:55:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\"},\"wordCount\":451,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png\",\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\",\"url\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\",\"name\":\"The least privilege has been really forgotten together with other things - Haruspex\",\"isPartOf\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png\",\"datePublished\":\"2020-07-29T09:55:33+00:00\",\"dateModified\":\"2020-07-29T09:55:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage\",\"url\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png\",\"contentUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png\",\"width\":940,\"height\":788},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.haruspexsecurity.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The least privilege has been really forgotten together with other things\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#website\",\"url\":\"https:\/\/www.haruspexsecurity.com\/\",\"name\":\"Haruspex\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.haruspexsecurity.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\",\"name\":\"Haruspex\",\"url\":\"https:\/\/www.haruspexsecurity.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png\",\"contentUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png\",\"width\":6920,\"height\":1858,\"caption\":\"Haruspex\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g\",\"caption\":\"admin\"},\"url\":\"https:\/\/www.haruspexsecurity.com\/it\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The least privilege has been really forgotten together with other things - Haruspex","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.haruspexsecurity.com\/it\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/","og_locale":"it_IT","og_type":"article","og_title":"The least privilege has been really forgotten together with other things - Haruspex","og_description":"As pointed out in our previous post about Twitter, the attack has been successful because the least privilege principle has been completely neglected. More recent information confirms this analysis. Reuters points out that more than one thousand employees could use tools and privileges to manipulate user accounts, change their settings and grant rights on account […]","og_url":"https:\/\/www.haruspexsecurity.com\/it\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/","og_site_name":"Haruspex","article_published_time":"2020-07-29T09:55:33+00:00","article_modified_time":"2020-07-29T09:55:37+00:00","og_image":[{"width":940,"height":788,"url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Scritto da":"admin","Tempo di lettura stimato":"2 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#article","isPartOf":{"@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/"},"author":{"name":"admin","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1"},"headline":"The least privilege has been really forgotten together with other things","datePublished":"2020-07-29T09:55:33+00:00","dateModified":"2020-07-29T09:55:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/"},"wordCount":451,"commentCount":0,"publisher":{"@id":"https:\/\/www.haruspexsecurity.com\/#organization"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage"},"thumbnailUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png","inLanguage":"it-IT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/","url":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/","name":"The least privilege has been really forgotten together with other things - Haruspex","isPartOf":{"@id":"https:\/\/www.haruspexsecurity.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage"},"thumbnailUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png","datePublished":"2020-07-29T09:55:33+00:00","dateModified":"2020-07-29T09:55:37+00:00","breadcrumb":{"@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#primaryimage","url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png","contentUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/The-least-privilege-has-been-really-forgotten-together-with-other-things.png","width":940,"height":788},{"@type":"BreadcrumbList","@id":"https:\/\/www.haruspexsecurity.com\/the-least-privilege-has-been-really-forgotten-together-with-other-things\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.haruspexsecurity.com\/"},{"@type":"ListItem","position":2,"name":"The least privilege has been really forgotten together with other things"}]},{"@type":"WebSite","@id":"https:\/\/www.haruspexsecurity.com\/#website","url":"https:\/\/www.haruspexsecurity.com\/","name":"Haruspex","description":"","publisher":{"@id":"https:\/\/www.haruspexsecurity.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.haruspexsecurity.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.haruspexsecurity.com\/#organization","name":"Haruspex","url":"https:\/\/www.haruspexsecurity.com\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png","contentUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png","width":6920,"height":1858,"caption":"Haruspex"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1","name":"admin","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g","caption":"admin"},"url":"https:\/\/www.haruspexsecurity.com\/it\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2979"}],"collection":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/comments?post=2979"}],"version-history":[{"count":1,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2979\/revisions"}],"predecessor-version":[{"id":2981,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2979\/revisions\/2981"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/media\/2980"}],"wp:attachment":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/media?parent=2979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/categories?post=2979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/tags?post=2979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}