4 ms·

Not really. Read the article - the compromise was entirely down to user stupidity - clicking on phishing links and the use of an insecure, outdated web browser.

by smiler 17y ago

Not really. Read the article - the compromise was entirely down to user stupidity - clicking on phishing links and the use of an insecure, outdated web browser. Perforce can be secured, but the administrators clearly chose not to. The article is a joke as well. It cites the fact that all of the source code is on a developers machine - how else are they meant to develop, code and test? It then also cites that the files are stored in plaintext - source code can't be stored one-way encrypted can it! (And there's little point in two-way encryption if the hacker has access to the machine) So in summary, it was not Perforce. It was, as always, human error

simonw 17y ago
"the compromise was entirely down to user stupidity - clicking on phishing links and the use of an insecure, outdated web browser" It was a spear-phishing attack (great name) - you get an e-mail from someone you know suggesting you check out a link. The browser security flaw was a 0-day, so even if you were fully patched you would still be affected. Sure, using IE isn't brilliant, but there are certainly 0-day holes in other browsers. I don't think it's reasonable to blame this attack on user stupidity.
- bruceboughton 17y ago
  Still it's not clear how the SCM vendor is supposed to mitigate against this? If an attacker can inject code onto a machine inside your enterprise (and they obviously can) then you're pretty much screwed whatever you're running (because someone has to be running something that can affect production systems, be they developer, administrator, etc.)
JunkDNA 17y ago
You're right that Perforce has little to do with the actual exploit, but "human error" and "user stupidity" don't explain all of it. First, if you're in a corporate environment, your default browser is often chosen for you, even as a developer. Furthermore, you may not even have sufficient permissions on a Windows box change it. Second, This is not an end-user problem. People are trained to click links. We click lots of them. If you put them in emails, someone is likely to click them. Perhaps they click during a moment of distraction while in a teleconference, working from home with a screaming 2 year old in the background. It happens. As a general rule I am very wary of links placed in emails. But when I get work email from coworkers, especially something work-related, on my work email system, I often just click the link because the odds of it being phishing are incredibly low. I'm certain these weren't exactly "Get VIAG'A cheap" emails. The problem is that nobody is perfect. This does not make them stupid, it makes them human. If your security model relies on everyone being 100% vigilant 100% of the time, it fails. Somehow, systems need to evolve to add some more layers of security to backstop all us unreliable humans.
wedesoft 17y ago
It's high time for a more pervasive use of e-mail encryption and signatures.

by smiler 17y ago

simonw 17y ago

"the compromise was entirely down to user stupidity - clicking on phishing links and the use of an insecure, outdated web browser" It was a spear-phishing attack (great name) - you get an e-mail from someone you know suggesting you check out a link. The browser security flaw was a 0-day, so even if you were fully patched you would still be affected. Sure, using IE isn't brilliant, but there are certainly 0-day holes in other browsers. I don't think it's reasonable to blame this attack on user stupidity.

bruceboughton 17y ago
Still it's not clear how the SCM vendor is supposed to mitigate against this? If an attacker can inject code onto a machine inside your enterprise (and they obviously can) then you're pretty much screwed whatever you're running (because someone has to be running something that can affect production systems, be they developer, administrator, etc.)

JunkDNA 17y ago

You're right that Perforce has little to do with the actual exploit, but "human error" and "user stupidity" don't explain all of it. First, if you're in a corporate environment, your default browser is often chosen for you, even as a developer. Furthermore, you may not even have sufficient permissions on a Windows box change it. Second, This is not an end-user problem. People are trained to click links. We click lots of them. If you put them in emails, someone is likely to click them. Perhaps they click during a moment of distraction while in a teleconference, working from home with a screaming 2 year old in the background. It happens. As a general rule I am very wary of links placed in emails. But when I get work email from coworkers, especially something work-related, on my work email system, I often just click the link because the odds of it being phishing are incredibly low. I'm certain these weren't exactly "Get VIAG'A cheap" emails. The problem is that nobody is perfect. This does not make them stupid, it makes them human. If your security model relies on everyone being 100% vigilant 100% of the time, it fails. Somehow, systems need to evolve to add some more layers of security to backstop all us unreliable humans.

wedesoft 17y ago

It's high time for a more pervasive use of e-mail encryption and signatures.