Security expert warned SolarWinds in 2019 that anyone could access server
businessinsider.com.au
businessinsider.com.au
[1]: https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/6dd04fe...
(I would go so far as to say that if there was insufficient anti-rollback and they still burned 0-days to get into that build server then they were expending resources trying to either look sophisticated or had some other odd motivation.)
Then let’s say this build server had an unusually high usage of build plugins. And the upgrading of that product was difficult and sometimes troublesome because of these custom plugins and their interdependencies. And so they at some point they missed an upgrade or two on accident, or because upgrading is hard.
Now they are running an build server with several know vulnerabilities. But because that build server isn’t public. It’s really no big deal that it’s a bit out of date. Until it is.
Could it be that there are more companies out there in a kind of similar situation? It would be quite bad of course if such information would become widely know I could imagine.
https://www.cvedetails.com/vulnerability-list/vendor_id-1586...
(Come to think of it, security Cluedo would be quite fun ...)
Days later, the perpetrator released a "manifesto" (and several other documents) all but confirming that it was the work of a lucky amateur.
Moxie (of Signal fame) has a hilarious account of the story in his 2011 Blackhat talk "SSL and the future of authenticity" (starts at around 5:00):
Would it be detected though?
It doesn't matter whether the attacker works for China, Russia, the US, whoever – they are likely sitting in a very secure building owned by a military branch or intelligence agency, absolutely everything they do is closely monitored by their superiors (spy agencies love to spy on their own spies), they aren't allowed to take personal electronic devices into the building and they are physically searched on entry and exit.
Do you think, working in that kind of environment, they'll find it easy to steal their target's bitcoin?
Do you think their superiors will look kindly on agents compromising operations for personal financial gain?
Some complain that the Three Letter Agencies are too soft on the perpetrators – a reprimand, a demotion/paycut, a forced resignation, or termination instead of criminal prosecution – but going soft isn't the same thing as approval. (Also, the agencies themselves don't have authority to prosecute, the most they can do is send a referral to the prosecutor but it is up to the prosecutor to decide whether to proceed.) Given how much emphasis those agencies put on staff reliability, getting caught doing stuff like that is a pretty serious career-limiting move.
I reckon those agencies – and the prosecutors too – care a lot more about employees stealing bitcoin from targets than they do about employees spying on their neighbours or love interests. Bureaucrats always care about money; and thefts are more straightforward cases to prosecute than LOVEINT.
Also: It doesn't fix the problem.
It's not uncommon for a mature industry to face a reckoning around damaging practices that were common when they were nascent industries.
Would you like to live below a dam that was built under a loose and permissive regulatory regime? How about storing sensitive personal data in a datacenter whose owner specifically disclaims liability for it's exposure?
They're not the one's paying for it. The people wanting the building built are. And there's a lot of corruption in that. On top of that, there's a pretty clear housing crisis in big cities.
I'm unsure whether that's the industry to follow.
It's a bad idea to create insurance monopolies.
Unless you are a corrupt regulator, corrupt insurance company exec, or corrupt officer in the industry being targeted.
Then, you can fine tune it to maximize your take and punish the downstream customers.
Like how the American medical system works.
Presumably it could work the way auto insurance works, where you'd be required to carry insurance but you'd have your pick of who supplies it. (Unless I misunderstood and you're opposed to requiring insurance for anything.)
All auto insurance really does is make it so that when some idiot with no money hits you with their car, there will be somebody to pay for the damages.
The problem with doing this for computer security is that if you don't put the liability on the company then there is nothing for the insurance to cover, but if you did then it would bankrupt the insurance company.
Imagine one of the vendor's clients is a pharmaceutical company and the attackers get access to their pre-publication research files. That could be ten billion dollars in damages. For one client. Imagine five of the clients are pharmaceutical companies. The other clients could be financial institutions, cloud providers (who would in turn have their own affected clients), movie studios (and now all of the next year's movies are on The Pirate Bay prior to release), etc. All at the same time, for a single security incident.
And how do you put a price on the sort of national security threat it poses when foreign governments gain access to US government systems? Who do you even compensate for that?
This isn't the sort of problem insurance can fix.
Maybe what we need is something like publicly-funded security audits of popular software.
At the same time it’s almost impossible to put a dollar value on the real cost of a cyber security incident: bad PR, lost and unhappy customers, increased regulatory oversight, a board that’s (understandably) skeptical of your ability to prevent future incidents. And no matter how big of a check you could get an insurance company to write the data still walked out the door. All the money in the world can’t unring that bell.
When your client is the USG and foreign hackers exfiltrate secrets through your platform, I don't the DoD cares that you had insurance.
This is why I got burnt out of infosec.