4 ms·
The article/twitter thread don't offer anything definitive. It could be this leaked password was how their supply chain got compromised, it might not be. Just
by lock-free 6y ago
The article/twitter thread don't offer anything definitive. It could be this leaked password was how their supply chain got compromised, it might not be.
Just anecdotally I'm looking at my own release infrastructure and it would take a bit more work to get compromised binaries to our customers than a leaked secret in a public git repo - and if it was reported that we leaked some key or password that gave the keys of the kingdom away, it would be trivial to change it and verify that we didn't push malware.
This article can explain how malware made it into a download server, maybe. But does it explain the fact the malware was signed? Maybe, but that suggests a bigger fuck up than leaking a password.
- hackerpain 6y agoThere was a case where we were able to gain access to Jira instance belonging to a bug bounty target (not even a Red Team engagement), and the Confluence wiki had every credential the company ever used. They used it as a secure credential storage. Majority of their internal panels didn't have a 2FA and we found internal VPN server credentials too (which didn't have source ip restrictions), so we could freely access tons of data. The bounty we got was around $1000 if I could remember, I think this would motivate a lot of hackers to not go the responsible disclosure way, as the incentives are ridiculously low. But I could access literally everything related to that organization and their clients from that single Github leak (of Jira creds).
- lock-free 6y agoKind of an example of a "bigger fuck up" I was alluding to