MOVEit body count closes in on 400 orgs, 20M+ individuals

It's safe to say that headlines and headline writers (usually editors) are some of the biggest contributors to the culture wars and all-up dishonesty in modern discourse.

If you think about it, it was inevitable when incentives became more aligned with quick 'hot takes' and volume over signal/noise ratio.

The darkpattern of our times.

I read "body count 400+ orgs" and thought that so many companies had been put out of business, didn't notice the individuals part too. Not knowing what MOVEit is, I assumed it was some kind of boycott. Kind of surprised that it meant that 400 organizations and possibly 20 million customers data exposed. Definitely bad wording for the headline.

Of course, it's the Register, they try to be clever with every headline.

Body count has different connotations depending on context, but in the sense of "compromised information about a person" I have never come across this usage previously.

I can’t see how anyone is harmed by this usage. Seems more hyperbolic to me, or rather obsessive compulsive, which I say as someone who has struggled with OCD in the past. The impulse to constantly monitor and revise the minutiae of language for the slightest whiff of offense seems unhealthy to me, but maybe that’s just because of my predispositions.

I read it as another derivation of victims with an emphasis on the human impact. I am just guessing but they probably used that wording as so many sites are hacked every week we probably don't associate it with the human suffering in terms of financial, job losses and data leakage leading to more financial losses it can cause especially when so many businesses are exposed by a significant vulnerability. I don't know if Jessica [1] has an account here but their email is listed.

[1] - https://www.theregister.com/Author/Jessica-Lyons-Hardcastle

I was definitely less able to comprehend the title, because it implied a very different context than the actual subject matter.

It would have been much more readable to write "victim count".

Agreed 100% .. The only "body count" we should be getting up in arms about:

https://psr.org/wp-content/uploads/2018/05/body-count.pdf

Agree, but it's The Register, they've always had a pretty unique and mostly humorous writing style. Not to dissimilar to The Economist, but learning slightly more into the humor.

It’s not the clearest title, but it’s taken directly from the original source who seem to assume the reader has been following their reporting on it and know what it means.

Are you carefully analyzing a title from the El Reg?

Would you say it's "problematic"? :)

Funny and "cringey" titles are a staple of the Register since the beginning.

Not hyperbolic, the title is very charged and I had to reread the opening paragraph multiple times to make sure I wasn’t missing who died.

The Register has always had very click bait titles. It’s like The Sun but for tech.

Hyperbolic

I agree.

Imagine that some LLM starts to communicate body counts due to these types of writings.

>SQL injection is super trivial to prevent, right? How are we still falling for this?

Because the bug is super trivial to fix, it's also super trivial to do. Not to mention, the human mind is naturally inclined to not care about trivial stuff, which leads to careless mistakes at many levels and thus Bobby Tables dropped out of school.

Basically all these file transfer solutions are crap, from a quality and security perspective.

Procurement works by ticking off features of a list, possibly comparing prices. Quality and security are hard to quantify, and often cannot really assessed by the purchase managers themselves, so they don't play a major role in purchasing decisions.

Thus, vendors aren't really incentivized to make robust, reliable and secure software, they are incentivized to sell their software.

You could say that about most of the OWASP Top 10. If the discourse is any way to judge, most web developers are more invested in constantly re-litigating JavaScript framework wars than learning the extremely trivial design patterns that would resolve most of their security issues. Speaking as a penetration tester, the things devs will let go to prod while managing the information of millions of customers is enough to make you lose hope in the concept of digital infrastructure.

Unfortunately with security exploits, you're looking for the weakest link in a chain of X million people. All you need is one careless dev/analyst and you get compromised

That aside, a WAF would have stopped this.

Remember back a few weeks ago, when a single compromised Microsoft key allowed anyone to read everyone's mails?

or "Code Red" melting down the whole net for a day and a half with propagation traffic

I'm not saying this is how it happened, but this is why they may be able to say that. When working with similarly sized companies, I am required to encrypt the files (PGP zip) and transmit over a secure encrypted channel (SFTP). Normally, those companies will use a feature of Moveit to automatically do the PGP encryption/decryption.

However, TJX could have written their security policy such that their Moveit server was not allowed to use that feature, so they used a different piece of software to do the encrypt/decrypt outside of Moveit. Thus, hacking the TJX server would only get a bunch of unencrypted reports and encrypted files with personal info in them. Again, I'm not saying this was what actually happened.

The Cl0p group have been doing mass exploitation of globally of MFT products for quite a while, MOVEit is just their latest one.