Hacker News Reader

Comment by dogman144 | Hacker News Reader

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

View on HN

I don't think they ignored it? Says it was addressed. I think it was OK to dispel the implication that the elaborate supply chain attack was allowed in the first place by sloppy pw practices. You don't want that to be the takeaway and then other companies thinking, well our pw management practice is really good so we don't have to worry about being a victim so much

They did ignore it. I think it was over a year actually. I don't feel like looking it up right now but it was also discussed in another submission. Whatever the actual number was it was VERY long.

You don't get this kind of attack because you had an exposed FTP server.

The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal.

They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications.

The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this makes SolarWinds a prime target, one that is worth the efforts taken in this case.

>You don't get this kind of attack because you had an exposed FTP server

This kind of attack needs an entry point, and an exposed FTP server provides the potential for one. Whether it actually was the entry point is a separate matter, willfully ignoring one unlocked door means there's likely to be others.

Initial access is part of the day-to-day these days.

you can't cover all entry points, it's a matter of time for someone to make a mistake. the fact that the adversary showed these extreme levels of proficiency and dedication tells me that the vast majority of companies would have fallen for that. In fact, the backdoor was running for months on targets like Microsoft, gov agencies, security companies like Malwarebytes.

These companies know a thing or two about security.

Today we work with "assume breach" mentality that assumes you are already compromised.

> You don't get this kind of attack because you had an exposed FTP server.

Leaking the extremely weak login credentials to your updateserver, trough a public Github repo, is not exactly a glowing endorsement of how serious security seems to have been taken at Solwarwinds.

With stuff like that being a thing, who knows where else they cut corners/got lazy.

> this makes SolarWinds a prime target, one that is worth the efforts taken in this case.

A prime target, yet apparently could still not be bothered to put in some minimum effort to protect themselves.

> could still not be bothered to put in some minimum effort to protect themselves.

What would have been the minimum effort that would have protected them?

The minimum effort starts at selecting more secure passwords than "company123".

Yeah I mean I’ve read the technical FEYE writeups, and yeah once they had a foothold it got fairly f’ing complex (hope those guys don’t end up in my CI/CD ever, yikes).

That said, foothold for this stuff more often than note comes from keys on public GitHub repos (or things like that: simple misses that are enough to throw the door open).

I hear things like “intern” and “totally unrelated” and it’s the dog whistles of policy/policy enforcement failures of these sorts of initial ways in.

So many sexy hacks start from admin123 passwords unfortunately

Reply on news.ycombinator.com