Hacker News Reader

How can -let's say- Cursor users be sure they were not compromised?

> No malicious usage was detected

Curious to hear about methods used if OK to share, something like STRIDE maybe?

from todesktop's report:

> Completed a review of the logs. Confirming all identified activity was from the researcher (verified by IP Address and user agent).

With privileged access, the attackers can tamper with the evidence for repudiation, so although I'd say "nothing in the logs" is acceptable, not everyone may. These two attack vectors are part of the STRIDE threat modeling approach.

They don’t elaborate on the logging details, but certainly must good systems don’t allow log tampering even for admins.

How confident are you that their log system is resilient, given the state of the rest of their software?

Following that logic it would be literally impossible to trust any part of their infra. They had a bad build container, the rest of their stuff was solid.

Reply on news.ycombinator.com