3 ms·

>"1, 2, 3, 4, 5, 6... that's the combination I use on my luggage." These people are supposed to be security professionals.

omarhaneef 6y ago
Came here to make this reference and you beat me by a fraction of a second.
chrisco255 6y ago
It's almost like they were paid to be incompetent.
lemonspat 6y ago
'solarwinds123' is gross negligence by any professional, let alone one that offers security/networking services to corporations and agencies
- lvs 6y ago
  If this was in fact the origin of the compromise, I do wonder if there might be legal liability here.
  - cbsmith 6y ago
    It's not, and there is.
- cbsmith 6y ago
  Hey, it's more secure than 'solarwinds1'. ;-)
  - suyula 6y ago
    All good, the system is set to lock out access after 122 attempts.
bluedino 6y ago
Cost cutting is a wonderful thing
mike_d 6y ago
This is indefensible. However, Solarwinds isn't a security company. They build network monitoring/management tools and have a very telco feel. I'm honestly not surprised by this level of incompetence.
- chrisco255 6y ago
  Their software allows network traffic to be monitored for some of the most important government agencies we have: the White House, the Pentagon, Treasury Dept, etc. They're not some retail company. Their tools provide a vector to attack extremely sensitive systems. Network monitoring and management is by definition supposed to be secure, especially for critical systems.
  - cbsmith 6y ago
    Agreed... but having used SolarWinds... I can't believe people use this stuff.
- captn3m0 6y ago
  They have 6 tools listed on their IT Security Downloads: - Access Rights Manager: Manage and audit access rights across your IT infrastructure - Security Event Manager - Improve your security posture and quickly demonstrate compliance with an easy-to-use, affordable SIEM tool - Server Configuration Monitor - Gain visibility into systems changes and easily compare configurations over time with our new change monitoring tool - Patch Manager - Patch management software designed to quickly address software vulnerabilities - Serv-U Managed File Transfer Server - Enhance security and control over file transfers in and outside your organization - Serv-U File Transfer Protocol Server - Simple, affordable, easy-to-use FTP server software While I wouldn't call all of these security sensitive, but considering some of the other tools that they built: - Dameware Remote Support: Remote control and systems management tools in one easy-to-use package - Dameware Remote Everywhere: Deliver the tools IT professionals need in a cloud-based, remote support solution - User Device Tracker: Network device tracking software designed to locate users and devices on your network they definitely count as a security-sensitive vendor.
Bob274927427 6y ago
You'd be surprised how many engineers don't understand security. A few years ago I complained to the DD-WRT developers that they need to serve up with firmware images on HTTPS (They were serving them up on HTTP). Their images are not cryptographically signed and they didn't publish hashes so at the very least they could try to secure the transport and use HTTPS. My request was rejected and they were confused as to why HTTPS was necessary as "it's not like we're doing online banking".

omarhaneef 6y ago

Came here to make this reference and you beat me by a fraction of a second.

chrisco255 6y ago

It's almost like they were paid to be incompetent.

lemonspat 6y ago

'solarwinds123' is gross negligence by any professional, let alone one that offers security/networking services to corporations and agencies

lvs 6y ago
If this was in fact the origin of the compromise, I do wonder if there might be legal liability here.
- cbsmith 6y ago
  It's not, and there is.
cbsmith 6y ago
Hey, it's more secure than 'solarwinds1'. ;-)
- suyula 6y ago
  All good, the system is set to lock out access after 122 attempts.

bluedino 6y ago

Cost cutting is a wonderful thing

mike_d 6y ago

This is indefensible. However, Solarwinds isn't a security company. They build network monitoring/management tools and have a very telco feel. I'm honestly not surprised by this level of incompetence.

chrisco255 6y ago
Their software allows network traffic to be monitored for some of the most important government agencies we have: the White House, the Pentagon, Treasury Dept, etc. They're not some retail company. Their tools provide a vector to attack extremely sensitive systems. Network monitoring and management is by definition supposed to be secure, especially for critical systems.
- cbsmith 6y ago
  Agreed... but having used SolarWinds... I can't believe people use this stuff.
captn3m0 6y ago
They have 6 tools listed on their IT Security Downloads: - Access Rights Manager: Manage and audit access rights across your IT infrastructure - Security Event Manager - Improve your security posture and quickly demonstrate compliance with an easy-to-use, affordable SIEM tool - Server Configuration Monitor - Gain visibility into systems changes and easily compare configurations over time with our new change monitoring tool - Patch Manager - Patch management software designed to quickly address software vulnerabilities - Serv-U Managed File Transfer Server - Enhance security and control over file transfers in and outside your organization - Serv-U File Transfer Protocol Server - Simple, affordable, easy-to-use FTP server software While I wouldn't call all of these security sensitive, but considering some of the other tools that they built: - Dameware Remote Support: Remote control and systems management tools in one easy-to-use package - Dameware Remote Everywhere: Deliver the tools IT professionals need in a cloud-based, remote support solution - User Device Tracker: Network device tracking software designed to locate users and devices on your network they definitely count as a security-sensitive vendor.

Bob274927427 6y ago

You'd be surprised how many engineers don't understand security. A few years ago I complained to the DD-WRT developers that they need to serve up with firmware images on HTTPS (They were serving them up on HTTP). Their images are not cryptographically signed and they didn't publish hashes so at the very least they could try to secure the transport and use HTTPS. My request was rejected and they were confused as to why HTTPS was necessary as "it's not like we're doing online banking".