Winnti: Hackers attacking the heart of German industry

Winnti: Hackers attacking the heart of German industry(br24.de)

257 points by hakantan 6 years ago | 148 comments

lnsru 6 years ago |

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared folder. PostIt tickets on the table works good enough for others. Talking about bugs is impossible since nobody knows what’s fixed and what’s not, the bugs have date in the best case. Everything else is done in Excel sheets using in house written scripts. They usually end in a mess since some people use German regional settings and other English ones. That’s state-of-art situation in very rich and big company today. I don’t see any possible changes in future. Old boy club fights all the time against proposed improvements. You can forgot topics like information security, phishing, being silent about work topics outside the office. Hackers are known from the American movies only.

On the other hand I also worked in opposite unhealthy paranoid environment. I was hired to design Ethernet camera, but Wireshark usage in their office was prohibited. Packet analysis was seen as the worst thing in the company. I quit after few months trying to explain, that I need to analyze the packets during design phase. I think, it’s very normal, that other countries abuse illiteracy of German industry.

paganel 6 years ago | |

The state of the German IT industry outside of a few select places (Berlin, mostly) is what makes me very pessimistic about the future of its car industry.

They (meaning the big 3: VW, BMW and Mercedes) apparently still think that building the best engines/transmissions and being the best at putting them all together is all it takes in order to make a modern car, unfortunately I think EVs will be more about software and the way said software can best manage the car's power resources. From far away Tesla looks like it's doing quite a nice job with its EV software, the Germans, not so much.

If it matters I've never worked in Germany but as an IT person/programmer living in Europe I've followed the German IT industry pretty constantly as Germany is one of the best countries in terms of quality of life (I know it's not perfect, but it sure beats my Eastern European country). Unfortunately for me its backwards IT industry (again, as seen from the outside) keeps me away from it.

PinguTS 6 years ago | | |

Funfact: more than 30% value in a car is software, which is highly interconnected via various type of networks namely, LIN, CAN, MOST, FlexRay, Ethernet. Most current premium cars have more than 10 of those networks and around 100 to 130 ECUs that talk to each other.

So much about: they don't know about software.

BTW: The difference between IT and automotive aka embedded is that embedded should work even without DevOps. Well, IT we know.

fibers 6 years ago | | |

This explains why one of the major tier 1 suppliers has an absolutely horrendous workflow in processing financial data. We do a lot of business with them and when processing invoices sent to them, almost every division outside of Germany accepts invoices by email, but for one of the central German plants, they only accept invoices by mail to a foreign PO Box, so we're effectively giving a discount due to international shipping per each shipment/invoice can get high. As far as I can tell this seems more like an IT issue rather than a financial one (very large firms are geniuses in pushing out which vendors to pay, but if this was a universal case then every international plant would only accept invoices by mail)

odiroot 6 years ago | | |

> The state of the German IT industry outside of a few select places (Berlin, mostly)

If Berlin IT industry is a golden standard I'm really not very hopeful for Germany.

trabant00 6 years ago | | |

> VW, BMW and Mercedes) apparently still think that building the best engines/transmissions and being the best at putting them all together

That stopped being true at least 10 years ago. In 2019 I would bet on a Renault engine every time (so does Mercedes btw :P)

ChuckNorris89 6 years ago | |

Germany's tech illiteracy is a self-inflicted consequence of its pitiful salaries in this field, treating IT like a cost center that has to be outsourced to wherever is cheaper and companies' tradition of rewarding management incompetence over technical competence.

Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London.

You reap what you sow.

adrianN 6 years ago | | |

I don't think that's the case. I believe the problem is that large German companies tend to be hardware companies. They're used to development cycles that take years and extremely conservative in adopting new methods. Management and company culture is not used to dealing with fast changing development methods (where fast is anything that changes more often than once a decade). Rigid processes for compliance with external regulations over time where adopted for internal rules as well, making any change a bureaucratic nightmare.

Salary for developers really isn't that much of an issue. In Berlin for example a developer gets two or three times the median salary easily. That's enough for attracting people who are talented enough to choose, e.g. git and JIRA over whatever crusty system of shared folders and zip files or IBM crap you'd see for projects in many companies.

DangerousPie 6 years ago | | |

Based on what I have heard from friends in London and Germany salaries are actually a lot better in Germany. Especially once you account for cost of living.

southerndrift 6 years ago | | |

To add to this: The CDU (conservative party) turned back the decision to role out a fiber network across Germany that would have been constructed from the 80ies until the millenium [1]. If you actively burn your fields, then there is nothing to reap.

[1] https://www.heise.de/newsticker/meldung/Missing-Link-Der-Kam...

mehdix 6 years ago | | |

> companies' tradition of rewarding management incompetence over technical competence

I witnessed this and moved out of the large rich corporate to a small startup to keep my sanity.

mschuster91 6 years ago | | |

> treating IT like a cost center that has to be outsourced to wherever is cheaper

As if outsourcing wasn't a common trend across Western companies "thanks" to globalization and the utter dominance of US-american neoliberalism.

> and companies' tradition of rewarding management incompetence over technical competence

Again, quite common - the "old" Soziale Marktwirtschaft moguls with decades-long visions would not let today's next-quarter-only shit fly for long.

> Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London.

Care to have a source for SV and London? People avoid SV/USA due to the current President and London due to the Brexit uncertainity - in fact, whoever can flees from the UK before Johnson drives everything into the ground. Only correct point is Switzerland but that's not surprising since their wages run way, way higher than Germanys across the board...

kriro 6 years ago | |

I think there's a pretty big gap between "software first" companies and engineering driven ones (car companies, "Maschinenbau" etc.). Sometimes the cultural gap is pretty shocking to me. I made a career decision to avoid engineering driven companies for software related jobs because the situations are usually similar to your scenario.

rollulus 6 years ago | |

That's not just in Germany. The €3bn Dutch energy company I've worked for was glued together with a shared network drive. It was effectively their poor man's event bus. Pure anarchy, a house of cards of excel sheets and legacy software writing to and consuming from it. Controlling serious infrastructure like the major power plants of the 18th largest economy of the world in 2012 [1]. The result of IT managers who failed to see how the world was changing and came and go, to do things like "agile transformations" instead. I've learned valuable but painful lessons there.

[1]: https://en.wikipedia.org/wiki/Economy_of_the_Netherlands

sveme 6 years ago | |

In my major German company, mostly living off hardware, we seem to be at least living with a decent stack (though mostly using the MS copycats of Slack, Jira and Github). Interesting that it seems to be different at other companies. However, describing the automotive companies of being unaware of the need for more software devs is simply false - living in Munich, all the companies are doing is investing in software devs (car media, autonomous driving, electric cars, digital business models, apps, car sharing,...)

ahartmetz 6 years ago | | |

German car companies have absolutely recognized their problem with software several years ago (from what I can see 5-10 years ago), but they are still varying levels of bad at implementing the solution. One of the things they are doing is starting daughter companies that only do software... but still get infected by the awful development and management culture of the parent.

noir_lord 6 years ago | |

England checking in, that all sounds strangely familiar even down to the network shares.

Honestly security at this point is a myth, we can't close the door after the horse bolted as the barn is currently on fire and the horse has been gone so long it's settled down and raised a family.

WouterZ 6 years ago | | |

Thanks for checking in England

L_226 6 years ago | |

We're hiring for software at Stenon, we make a portable soil analysis device for real time agricultural nutrient analysis [0][1]. Based in Potsdam, Brandenburg (30 minutes on the train from Berlin), and yes, we use git :)

[0] - https://stenon.io [1] - https://stenon.io/en/career/

stefan_ 6 years ago | |

This is a recurring flawed observation when young grads enter industry and expect continuous integration, test-driven development and $buzzword framework. What you describe is simply the reality in a vast majority of companies, Germany or elsewhere.

iserlohnmage 6 years ago | |

I did internships at some top companies in the automotive industry. I can only confirm that.

bigred100 6 years ago | |

Aside from localization issues this was how it worked at a very large tech (not software) US company I worked at

maze-le 6 years ago | |

>> Packet analysis was seen as the worst thing in the company

Wow, that is just insane... "We want you to put a nail in that board but, by god do not even think of using a hammer". That must be the worst case of "security" by obscurity I have ever heard. Was this one of the bigger companies or a smaller firm? I wonder what kind of decision making process leads to such policies.

lnsru 6 years ago | | |

A big company doing mainly nice white fridges and yellow construction machinery. But they also do parts for planes. After quitting I heard, they were having some military project and had strict rules for it... Same building, same strict rules for everybody.

iagovar 6 years ago |

This group of german companies founded their own security group [German Cyber Security Organization (DCSO)]. That speaks a lot about their trust in their public services.

The only time I've been involved in a hacking attempt (it was ransomware) the company I work for contacted the CCN-CERT. I wonder if US companies contact NSA/Other gov agencies or deal with it themselves with security companies.

Also, while I understand the care and concern they put into securing their networks, many german companies basically gift their tech to china, like Deutsche Bahn, or being bought and transfered there, like it happend with Kuka. So be it by hacking into your network or "partnering", they'll copy your tech and kick you out of their market sooner or later.

vageli 6 years ago | |

> This group of german companies founded their own security group [German Cyber Security Organization (DCSO)]. That speaks a lot about their trust in their public services.

> The only time I've been involved in a hacking attempt (it was ransomware) the company I work for contacted the CCN-CERT. I wonder if US companies contact NSA/Other gov agencies or deal with it themselves with security companies.

In the US, most large companies that have suffered breaches contact the FBI.

ChuckNorris89 6 years ago | |

Probably because when it comes to anything cyber-related, the German government, like most big companies there, is a dinosaur, greatly inferior to it's British and Swiss counterparts.

TeMPOraL 6 years ago | | |

Germany at least has the CCC, which it sometimes asks for advice and, occasionally, listens to.

hobofan 6 years ago | | |

I'm not sure what the social aspects in Britain and Switzerland are like, but in Germany, working for the BND or other governmental cyber security institutions is frowned upon in the cyber-security circles (at least that's my view from someone not too deep in the field).

bobjordan 6 years ago |

"Modern-day espionage operations have one big advantage: Instead of painstakingly planting agents in companies, digital spies are simply sending prepared emails."

We face this threat in my business - daily fishing attempts or schemes to get employees to open files. It never stops.

This is a primary reason when we started designing our new web app at bomquote.com a few years ago, we first focused on communication tools which reduce our use of email both internally and in our dealings with our customers.

Sure, there will be attempts to hack our app servers, but from my view we can deal with that easier than preventing our accounting admin from clicking on a well crafted email.

mehdix 6 years ago | |

Is there any business out there that does not use email?

mtgx 6 years ago | |

Using U2F security keys is one way to stop phishing if the app you're supposed to log into requires it.

https://krebsonsecurity.com/2018/07/google-security-keys-neu...

tgsovlerkhgsel 6 years ago | | |

Unfortunately "phishing" nowadays is used to describe any kind of social engineering, including all variants of tricking the victim into executing malware on their machine.

U2F won't save you there, it will just make the attack a bit more annoying.

ga-vu 6 years ago |

Is this a good way of tracking an APT? Just from bytecode? Isn't that easy to fake? What if they were tracking Russian hackers instead?

janekm 6 years ago | |

If I'm understanding the article correctly, the hackers are using a easily reversed cypher for storing configuration data for their malware, which was reversed by assuming the presence of the string "C:\Windows\System". In the following decrypted data the name of the respective company targeted was found.

Yes I suppose it would be easily faked if the faker had performed a similar analysis on the malware...

solarkraft 6 years ago |

Good article. I am not so bothered by the effects, I think they complement the article well. I sure like that what may seem like decoration to some readers is actually real - I find it very interesting to find out that they find the malware using nmap.

Now where do I get that script? More detail would of course always be nice.

yorwba 6 years ago | |

Git repo was linked by OP in this [dead] subthread: https://news.ycombinator.com/item?id=20514267

The nmap script was written by ThyssenKrupp's security division and can be found here: https://github.com/TKCERT/winnti-nmap-script/blob/master/win...

jamesmadison66 6 years ago |

pretty decent tech write-up from the German NPR

logari 6 years ago | |

Finally, somebody said it. The English also very good, nay, excellent.

rolltiide 6 years ago |

> Winnti is a highly complex structure that is difficult to penetrate. The term denotes both a sophisticated malware and an actual group of hackers.

Hacking groups are corporations and spread risk away from indictable individuals just as efficiently, with a separation of liability and actions and knowledge

This needs to be understood