4 ms·

Hackers breached 3 US antivirus companies, researchers reveal

74 points by furcyd 7y ago

brian_herman__ 7y ago
Anyone know which three us antivirus companies they hacked?
- 24gttghh 7y ago
  Yeah, this article doesn't say a whole lot without that information...
  - phaus 7y ago
    The article is fine. If you read it you would have discovered that the hackers claim to be selling access to three US AV companies. This is a group of attackers that has a history of selling access to large organizations, so there's a good chance that what they are offering is real. It doesn't sound like the hackers have revealed the names of the companies. If they did reveal the names, the value of what they are selling would be significantly lower.
    - 24gttghh 7y ago
      HN Guidelines: Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." I read the article. I was interested in who got hacked, not that someone got hacked.
    - dgzl 7y ago
      > The article is fine. If you read it you would have discovered that... > It doesn't sound like the hackers have revealed the names of the companies. It sounds like the article isn't clearly stating that the hackers haven't revealed the names of the companies, rather requires intuition of the reader to figure out. IMO the journalist should be more clear.
  - NikkiA 7y ago
    There's only really 3 major AV companies that are US based, so it's pretty much a clue in itself.
    - guardiangod 7y ago
      There are _way_ more than 3, okay? Off the top of my head Symantec McAfee FireEye MalwareByte Palo Alto Endgame SentinelOne Cyren CrowdStrike Fortinet And probably a few more that I missed.
      - thedaemon 7y ago
        And yet only 3 of those are recognizable as antivirus companies. You have made OPs point for them.
        urda 7y ago
        I recognize: Symantec McAfee MalwareByte Palo Alto SentinelOne CrowdStrike ... so no that's not true. Don't post things like that.
        thedaemon 7y ago
        You are not the boss of me. You are also a nerd, not a normal person that uses anti-virus software.
        ziddoap 7y ago
        Maybe _you_ only recognize 3.
        thedaemon 7y ago
        I am referring to NORMAL humans, not us super nerds.
- jeromebrock 7y ago
  +1
jammygit 7y ago
So, they are claiming to have done so but did not reveal which ones? The spy in me wonders if this is fake to discourage campaigns to use AV software in the coming elections. The non-spy just worries about my company's AV software.
- OneWordSoln 7y ago
  The inherent problem with AV software is that they require deep system access, thus if they get compromised the system is absolutely screwed. So the question becomes "Is the operating system without AV but with hardening steps implemented more secure than the OS with AV?" Of course, the only real answer to security is OpenBSD ;-) but that's a whole other barrel of worms.
thrower123 7y ago
It'd be nice to know which ones, so I can push back more effectively if anyone tries to force us to use something besides the builtin Windows AV on our development workstations. Running Visual Studio or building npm/bower-based web projects on a machine that has one or, god help you, two or three of these deep-scanning real-time protection clusterflips is like watching paint dry in a monsoon.
stefan_ 7y ago
Haha, is this what it takes to get a fearmongering article into arstechnica? A Wix website and an IDA screenshot that shows.. nothing at all? Like, that IDA view is literally what you get when you open IDA on a binary or compressed file and pretend it's x86 assembly. Empty functions list and a navigation bar that is showing all white data.
- ziddoap 7y ago
  You should try and write a fearmongering article and see if it makes it in! Seriously though, it's not like they ran the story solely because of a screenshot. Other things they likely considered (being a reputable news source [1]) would include the source of the information and historical accuracy of that source, additional source material that was not fit for publication (confidentiality, irrelevent beyond proving accuracy of information, etc.), and other independent verification (reaching out to potential affected companies, communication with the sellers, viewing the advertisement for the material, etc.). On top of that, writing the article in this way allows for expansion and updates as more information is confirmed or comes to light. Welcome to how reputable news companies work. They generally don't make stuff up on the spot based on a screenshot. [1]https://mediabiasfactcheck.com/ars-technica/ https://mediabiasfactcheck.com/ars-technica/
  - stefan_ 7y ago
    You could have googled "AdvIntel" in less time than it took you to write this comment. Seriously though, the results will surprise you.
    - ziddoap 7y ago
      Wow neat! Thanks for the tip, hero

74 points by furcyd 7y ago

brian_herman__ 7y ago

Anyone know which three us antivirus companies they hacked?

24gttghh 7y ago
Yeah, this article doesn't say a whole lot without that information...
- phaus 7y ago
  The article is fine. If you read it you would have discovered that the hackers claim to be selling access to three US AV companies. This is a group of attackers that has a history of selling access to large organizations, so there's a good chance that what they are offering is real. It doesn't sound like the hackers have revealed the names of the companies. If they did reveal the names, the value of what they are selling would be significantly lower.
  - 24gttghh 7y ago
    HN Guidelines: Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." I read the article. I was interested in who got hacked, not that someone got hacked.
  - dgzl 7y ago
    > The article is fine. If you read it you would have discovered that... > It doesn't sound like the hackers have revealed the names of the companies. It sounds like the article isn't clearly stating that the hackers haven't revealed the names of the companies, rather requires intuition of the reader to figure out. IMO the journalist should be more clear.
- NikkiA 7y ago
  There's only really 3 major AV companies that are US based, so it's pretty much a clue in itself.
  - guardiangod 7y ago
    There are _way_ more than 3, okay? Off the top of my head Symantec McAfee FireEye MalwareByte Palo Alto Endgame SentinelOne Cyren CrowdStrike Fortinet And probably a few more that I missed.
    - thedaemon 7y ago
      And yet only 3 of those are recognizable as antivirus companies. You have made OPs point for them.
      - urda 7y ago
        I recognize: Symantec McAfee MalwareByte Palo Alto SentinelOne CrowdStrike ... so no that's not true. Don't post things like that.
        thedaemon 7y ago
        You are not the boss of me. You are also a nerd, not a normal person that uses anti-virus software.
      - ziddoap 7y ago
        Maybe _you_ only recognize 3.
        thedaemon 7y ago
        I am referring to NORMAL humans, not us super nerds.
jeromebrock 7y ago
+1

jammygit 7y ago

So, they are claiming to have done so but did not reveal which ones? The spy in me wonders if this is fake to discourage campaigns to use AV software in the coming elections. The non-spy just worries about my company's AV software.

OneWordSoln 7y ago
The inherent problem with AV software is that they require deep system access, thus if they get compromised the system is absolutely screwed. So the question becomes "Is the operating system without AV but with hardening steps implemented more secure than the OS with AV?" Of course, the only real answer to security is OpenBSD ;-) but that's a whole other barrel of worms.

thrower123 7y ago

It'd be nice to know which ones, so I can push back more effectively if anyone tries to force us to use something besides the builtin Windows AV on our development workstations. Running Visual Studio or building npm/bower-based web projects on a machine that has one or, god help you, two or three of these deep-scanning real-time protection clusterflips is like watching paint dry in a monsoon.

stefan_ 7y ago

Haha, is this what it takes to get a fearmongering article into arstechnica? A Wix website and an IDA screenshot that shows.. nothing at all? Like, that IDA view is literally what you get when you open IDA on a binary or compressed file and pretend it's x86 assembly. Empty functions list and a navigation bar that is showing all white data.

ziddoap 7y ago
You should try and write a fearmongering article and see if it makes it in! Seriously though, it's not like they ran the story solely because of a screenshot. Other things they likely considered (being a reputable news source [1]) would include the source of the information and historical accuracy of that source, additional source material that was not fit for publication (confidentiality, irrelevent beyond proving accuracy of information, etc.), and other independent verification (reaching out to potential affected companies, communication with the sellers, viewing the advertisement for the material, etc.). On top of that, writing the article in this way allows for expansion and updates as more information is confirmed or comes to light. Welcome to how reputable news companies work. They generally don't make stuff up on the spot based on a screenshot. [1]https://mediabiasfactcheck.com/ars-technica/ https://mediabiasfactcheck.com/ars-technica/
- stefan_ 7y ago
  You could have googled "AdvIntel" in less time than it took you to write this comment. Seriously though, the results will surprise you.
  - ziddoap 7y ago
    Wow neat! Thanks for the tip, hero