3 ms·

Isn't this somewhat unprecedented: a major vendor announced their source base has been actively compromised by a malicious party? If so, this is a potentially

Isn't this somewhat unprecedented: a major vendor announced their source base has been actively compromised by a malicious party? If so, this is a potentially industry-changing event.

nostrademons 11y ago
Not really: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora http://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese-servers-seen-as-spy-peril.html http://www.nytimes.com/2014/03/23/world/asia/nsa-breached-ch...
- marshray 11y ago
  Note how information about Operation Aurora always carefully stops just short of saying that any source code was modified. Whereas the NYT story is not a statement from a vendor.
  - nostrademons 11y ago
    Technically, this announcement also stops short of saying that any source code was modified. It just says that they "discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen® devices and to decrypt VPN connections". We all interpret that as a hacker having placed a backdoor there, just as we interpret the Operation Aurora announcement as the Chinese government placing a backdoor in GMail and the NYTimes article as the NSA placing a backdoor in Huawei routers. We are probably not wrong in this assumption. But the same CYA deniability is in all three.
- DCoder 11y ago
  There was also https://lwn.net/Articles/57135/ https://lwn.net/Articles/57135/
  - cypherpunks01 11y ago
    That is a certainly a compromise attempt, but I wouldn't call that 'actively compromised'—looks like a secondary CVS mirror repo was pushed to, and it was noticed "quickly". No damage done there.
nathanb 11y ago
Not sure why you're being downvoted. It's not unprecedented, but I also don't think a lot of the companies that get hit by something like this talk about it so publicly.
- pvg 11y ago
  a major vendor announced their source base [...] That would make it unprecedented, by your own description.

Isn't this somewhat unprecedented: a major vendor announced their source base has been actively compromised by a malicious party? If so, this is a potentially industry-changing event.

nostrademons 11y ago

Not really: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora http://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese-servers-seen-as-spy-peril.html http://www.nytimes.com/2014/03/23/world/asia/nsa-breached-ch...

marshray 11y ago
Note how information about Operation Aurora always carefully stops just short of saying that any source code was modified. Whereas the NYT story is not a statement from a vendor.
- nostrademons 11y ago
  Technically, this announcement also stops short of saying that any source code was modified. It just says that they "discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen® devices and to decrypt VPN connections". We all interpret that as a hacker having placed a backdoor there, just as we interpret the Operation Aurora announcement as the Chinese government placing a backdoor in GMail and the NYTimes article as the NSA placing a backdoor in Huawei routers. We are probably not wrong in this assumption. But the same CYA deniability is in all three.
DCoder 11y ago
There was also https://lwn.net/Articles/57135/ https://lwn.net/Articles/57135/
- cypherpunks01 11y ago
  That is a certainly a compromise attempt, but I wouldn't call that 'actively compromised'—looks like a secondary CVS mirror repo was pushed to, and it was noticed "quickly". No damage done there.

nathanb 11y ago

Not sure why you're being downvoted. It's not unprecedented, but I also don't think a lot of the companies that get hit by something like this talk about it so publicly.

pvg 11y ago
a major vendor announced their source base [...] That would make it unprecedented, by your own description.