4 ms·
If the password for your "military grade" secured infastructure is literally "solarwinds123", I wouldn't say it's a sophisticated attack. It's a more complete
by cookiengineer 6y ago
If the password for your "military grade" secured infastructure is literally "solarwinds123", I wouldn't say it's a sophisticated attack.
It's a more complete picture of how much modern businesses value security or pentesting audits. The answer to that is exactly zero effs.
As long as businesses think there is no ROI in security, this will stay the same.
The only thing sophisticated about this was that from code to deployment there wasn't any single audit of anyone. And that's a bad joke by any security measurement.
If any intruder can stay undetected THAT long, I don't wanna know what's up with MSFTs infrastructure. Must be an open door for everyone, and probably still uses the Perl pre-release based pipeline.
- talhah 6y agoInitial compromise may not have been sophisticated or hard to achieve, the post compromise may have been somewhat sophisticated judging from the attackers operational security.
- mjevans 6y agoFrom casual reading alone, easily an order of magnitude, or two or three such orders, more sophisticated than the development and resources seemingly applied by SolarWinds.
- jzer0cool 6y agonot sure how it is mil grade if an infra allows such a password to begin with.
- unionpivo 6y agodepends on which part of the world you are, military grade can mean different things. I would not be surprised to find hair saloons with better security practices than our military.
- Craighead 6y agoYou seem undereducated in the timeline of the attack. Supply chain attack came first.