3 ms·

> SolarWinds is, with high probability, above average and above average is, in absolute terms, abysmal. If what was reported by Reuters is true, SolarWinds had

> SolarWinds is, with high probability, above average and above average is, in absolute terms, abysmal. If what was reported by Reuters is true, SolarWinds had huge holes in its security. None of the companies I've worked for on recent years would keep a FTP server containing critical data on a public network with a guessable password: "A security researcher told Reuters he warned the IT firm SolarWinds in 2019 that its “solarwinds123” password for its update server could be accessed by anyone." https://www.businessinsider.com.au/solarwinds-warned-weak-123-password-could-expose-firm-report-2020-12 https://www.businessinsider.com.au/solarwinds-warned-weak-12...

Veserv 6y ago
That hardly seems out of the norm to be honest. Plenty of companies make comparably trivial mistakes from what I have seen. Plenty of companies accidentally leave things with their default password. They allow untrusted devices onto their networks. They allow employees unrestricted access to all of their documents on their personal computers. Looking at more specific cases, there was this case where a macOS update allowed anybody to log into root without a password [1]. How about this one where Intel AMT allowed anybody to log in with an empty password [2]. Obviously these are different since these are not internal systems, rather they are systems they shipped to all of their customers that can be trivially compromised, but it is still in the general vicinity of "dumb password" and, in my opinion, is even worse from a security design perspective on Apple and Intel's part. If they would add that to their products, how awful must their internal controls be. In any event, I will concede that my analysis of SolarWinds is an educated guess on my part, but it is hardly relevant to my overall points in any event. Even if SolarWinds is the dumbest most incompetent organization ever it does not detract from my other point which is that even the "best" is abysmal, so even if they were doing the best that is practically achieved in a working environment it still would not result in a meaningful difference. So, the problem is not actually that SolarWinds was chosen, it is that nobody else would be able to solve it either which is a far bigger problem. It means you need to come up with a novel solution to an unsolved problem, not just use something already known. [1] https://www.wired.com/story/macos-high-sierra-hack-root/ https://www.wired.com/story/macos-high-sierra-hack-root/ [2] https://arstechnica.com/information-technology/2017/05/the-hijacking-flaw-that-lurked-in-intel-chips-is-worse-than-anyone-thought/ https://arstechnica.com/information-technology/2017/05/the-h...
CuriousSkeptic 6y ago
To be fair if the FTP was only there to transport data that was already public, and the integrity of the data was ensured by other means than the the transport, the password would perhaps not be seen as very important. Still even with that in mind one should perhaps never assume that such things are less important.

Veserv 6y ago

That hardly seems out of the norm to be honest. Plenty of companies make comparably trivial mistakes from what I have seen. Plenty of companies accidentally leave things with their default password. They allow untrusted devices onto their networks. They allow employees unrestricted access to all of their documents on their personal computers. Looking at more specific cases, there was this case where a macOS update allowed anybody to log into root without a password [1]. How about this one where Intel AMT allowed anybody to log in with an empty password [2]. Obviously these are different since these are not internal systems, rather they are systems they shipped to all of their customers that can be trivially compromised, but it is still in the general vicinity of "dumb password" and, in my opinion, is even worse from a security design perspective on Apple and Intel's part. If they would add that to their products, how awful must their internal controls be. In any event, I will concede that my analysis of SolarWinds is an educated guess on my part, but it is hardly relevant to my overall points in any event. Even if SolarWinds is the dumbest most incompetent organization ever it does not detract from my other point which is that even the "best" is abysmal, so even if they were doing the best that is practically achieved in a working environment it still would not result in a meaningful difference. So, the problem is not actually that SolarWinds was chosen, it is that nobody else would be able to solve it either which is a far bigger problem. It means you need to come up with a novel solution to an unsolved problem, not just use something already known. [1] https://www.wired.com/story/macos-high-sierra-hack-root/ https://www.wired.com/story/macos-high-sierra-hack-root/ [2] https://arstechnica.com/information-technology/2017/05/the-hijacking-flaw-that-lurked-in-intel-chips-is-worse-than-anyone-thought/ https://arstechnica.com/information-technology/2017/05/the-h...

CuriousSkeptic 6y ago

To be fair if the FTP was only there to transport data that was already public, and the integrity of the data was ensured by other means than the the transport, the password would perhaps not be seen as very important. Still even with that in mind one should perhaps never assume that such things are less important.