3 ms·

The attacker in this case new the exact moves to insert a backdoor into .NET software. It wasn't hard to do, requiring no science. But Microsoft's "system of t

The attacker in this case new the exact moves to insert a backdoor into .NET software. It wasn't hard to do, requiring no science. But Microsoft's "system of trust" was undermined. The attacker was even inside Microsoft and Azure. No anti-virus, no "defender", no amount of basic or advanced telemetry caught this. FireEye alone caught it... By accident. The real "elephant in the room" is that software security continues to be marketing theatre. Closed-source software should not be trusted and consumers should not believe that any due diligence has been done to protect them.

jnwatson 6y ago
I wouldn't say they caught it "by accident". They caught it the way that most organizations detect a compromise: they saw some suspicious network traffic and they investigated. They just happen to have among the most sophisticated investigation capability in the world.
- heresie-dabord 6y ago
  From what I have read, the attacker attempted a second vector of infiltration, by e-mail. FireEye caught the second attempt, then noticed the SolarWinds activity.
jorblumesea 6y ago
> is that software security continues to be marketing theatre Overall I tend to agree with your general points, but, this statement. Would you say that seatbelts are "safety theatre" because some people die in car accidents while wearing a seatbelt? I really don't think it's fair to attribute all software security as BS, especially given the resources state actors throw at breaking software. It's like arguing your seatbelts don't work because your 4 door sedan was hit by a bus.
- heresie-dabord 6y ago
  The standard proviso about metaphors being given, I see your point. Seatbelts constitute an effort, seatbelts save lives, testing with dummies and survival results show it. Seatbelts are real security measures. Still, more than 60K people die every year in motor accidents in North America and in the EU. Seatbelts cannot save life in all cases, such as outrageous speeds, but they are a sane measure for most -- if not all -- use-cases of driving. In this compromise, the major purveyor of OS and security products itself was compromised. No company, no $agency did due diligence. Some of these victims are supposed to be in the business of high-assurance and due diligence. None of the systems that we are conditioned to believe to be effective actually worked. And it was a standard use-case for all the victims.

jnwatson 6y ago

I wouldn't say they caught it "by accident". They caught it the way that most organizations detect a compromise: they saw some suspicious network traffic and they investigated. They just happen to have among the most sophisticated investigation capability in the world.

heresie-dabord 6y ago
From what I have read, the attacker attempted a second vector of infiltration, by e-mail. FireEye caught the second attempt, then noticed the SolarWinds activity.

jorblumesea 6y ago

> is that software security continues to be marketing theatre Overall I tend to agree with your general points, but, this statement. Would you say that seatbelts are "safety theatre" because some people die in car accidents while wearing a seatbelt? I really don't think it's fair to attribute all software security as BS, especially given the resources state actors throw at breaking software. It's like arguing your seatbelts don't work because your 4 door sedan was hit by a bus.

heresie-dabord 6y ago
The standard proviso about metaphors being given, I see your point. Seatbelts constitute an effort, seatbelts save lives, testing with dummies and survival results show it. Seatbelts are real security measures. Still, more than 60K people die every year in motor accidents in North America and in the EU. Seatbelts cannot save life in all cases, such as outrageous speeds, but they are a sane measure for most -- if not all -- use-cases of driving. In this compromise, the major purveyor of OS and security products itself was compromised. No company, no $agency did due diligence. Some of these victims are supposed to be in the business of high-assurance and due diligence. None of the systems that we are conditioned to believe to be effective actually worked. And it was a standard use-case for all the victims.