Hacker News Reader

Comment by MattGaiser | Hacker News Reader

I thought they got access through an update sever with a weak password?

Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?

View on HN

The whole weak password thing was simply a funnily timed thing some guy found. It had absolutely nothing to do with the malicious update, which was the source of this supply chain attack. For some reason a bunch of people online decided that two things happening around the same time means they are related. They are not

Ah ok. So the password was just an easy to understand sideshow. Thank you.

No, “a bunch of people online” decided that if you have jarring security practices in one avenue, it’s totally unsurprising if it turns out that you have other doors wide open too. Which is a completely reasonable assumption.

It can definitely be said that this may be an indicator of a larger security issue at the company. But assuming that issue is the cause for the backdoor, yes that is a leap, and an unfounded one. Correlation != Causation, and it's always unreasonable to assume otherwise.

There had been a weak password on the update server in the past. The compromised update however was introduced via the build system before being signed and distributed

https://www.sec.gov/Archives/edgar/data/0001739942/000162828...

Weak passwords had nothing to do with the hack

See it like stealing from a museum: very easy to break in (weak password -> breaking a window), hard to get out of here with all the paintings unnoticed - and that, on a daily basis.

The amount of effort and different techniques they've put in to remain undetected for months (years?) while infecting a lot of actors is pretty impressive.

Reply on news.ycombinator.com