4 ms·

I guess nobody gets pwned by high school kids just screwing around anymore. Every hack is now the "most sophisticated ever" by the "most technologically advance

by qzw 6y ago

I guess nobody gets pwned by high school kids just screwing around anymore. Every hack is now the "most sophisticated ever" by the "most technologically advanced state actor ever" to break the "most secure six-character password ever."

JohnJamesRambo 6y ago
I checked again and their website still looks like something made by an AI using a template. https://www.solarwinds.com/ https://www.solarwinds.com/ We’re Geekbuilt.® Developed by network and systems engineers who know what it takes to manage today's dynamic IT environments, SolarWinds has a deep connection to the IT community. The result? IT management products that are effective, accessible, and easy to use.
- jessaustin 6y ago
  "Accessible" is a good word. Almost invites speculation as to whom they're accessible. More fitting than "secure", anyway.
- 0xy 6y ago
  Solarwinds' former VP of Security posted a blog post entitled "Do Your Vendors Take Security Seriously?" [1] while, according to reports, being totally pwned from floor to ceiling. [1] https://www.solarwindsmsp.com/blog/do-your-vendors-take-security-seriously https://www.solarwindsmsp.com/blog/do-your-vendors-take-secu...
  - deleted 6y ago
    [deleted]
- ThePadawan 6y ago
  > their website still looks like something made by an AI using a template. This is every website of any company selling to enterprise customers. It's incredibly frustrating as a reader. I imagine anytime someone actually answers the question "Yes, but what do you do?", they get fired.
  - foepys 6y ago
    They are vague because they want you to leave your contact details. Then a sales person will call you and gladly tell you everything you want to know and spam you with newsletters and marketing materials until eternity. That's B2B for you.
- grumple 6y ago
  This is the case of the cobbler's children having no shoes, I think. If you're focused on your product, updating your website falls to the last priority (except for the marketing team).
bawolff 6y ago
Well the incentives arent there to blame those meddling kids and their dog. Security companies benefit from having adversaries be big and scary Hacked companies benefit from adversaries being big and scary. Nobody blames you if you get hacked by the russians. Getting hacked by teenagers looks bad. Edit: that said, i feel like i should add, i personally dont feel, based on what we know, that this particular attack was a bunch of kids.
deleted 6y ago
[deleted]
hayst4ck 6y ago
The supply chain compromise does not appear to be sophisticated. The "post installation of compromised software" activity seems to be somewhat sophisticated. https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... No high school kid is doing that.

by qzw 6y ago

JohnJamesRambo 6y ago

I checked again and their website still looks like something made by an AI using a template. https://www.solarwinds.com/ https://www.solarwinds.com/ We’re Geekbuilt.® Developed by network and systems engineers who know what it takes to manage today's dynamic IT environments, SolarWinds has a deep connection to the IT community. The result? IT management products that are effective, accessible, and easy to use.

jessaustin 6y ago
"Accessible" is a good word. Almost invites speculation as to whom they're accessible. More fitting than "secure", anyway.
0xy 6y ago
Solarwinds' former VP of Security posted a blog post entitled "Do Your Vendors Take Security Seriously?" [1] while, according to reports, being totally pwned from floor to ceiling. [1] https://www.solarwindsmsp.com/blog/do-your-vendors-take-security-seriously https://www.solarwindsmsp.com/blog/do-your-vendors-take-secu...
- deleted 6y ago
  [deleted]
ThePadawan 6y ago
> their website still looks like something made by an AI using a template. This is every website of any company selling to enterprise customers. It's incredibly frustrating as a reader. I imagine anytime someone actually answers the question "Yes, but what do you do?", they get fired.
- foepys 6y ago
  They are vague because they want you to leave your contact details. Then a sales person will call you and gladly tell you everything you want to know and spam you with newsletters and marketing materials until eternity. That's B2B for you.
grumple 6y ago
This is the case of the cobbler's children having no shoes, I think. If you're focused on your product, updating your website falls to the last priority (except for the marketing team).

bawolff 6y ago

Well the incentives arent there to blame those meddling kids and their dog. Security companies benefit from having adversaries be big and scary Hacked companies benefit from adversaries being big and scary. Nobody blames you if you get hacked by the russians. Getting hacked by teenagers looks bad. Edit: that said, i feel like i should add, i personally dont feel, based on what we know, that this particular attack was a bunch of kids.

deleted 6y ago

[deleted]

hayst4ck 6y ago

The supply chain compromise does not appear to be sophisticated. The "post installation of compromised software" activity seems to be somewhat sophisticated. https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... No high school kid is doing that.