3 ms·

This tweet explains how they might have gotten in (i.e. unpatched ssh servers) https://twitter.com/damienmiller/status/1427195852011937797?s=21 https://twitter

• tyingq 5y ago
  From the picture: https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg&name=medium https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg&name=... "Audit Flags: NO_PCI NO_SOX" Ouch. Also, "IBM 9117-MMD" would be a POWER7+ server that was EOL in December of 2020.
  • oars 5y ago
    What does it mean to have these audit flags enabled in Linux? Auditors can exclude these systems? WTF
    • tyingq 5y ago
      It's not really related to Linux or the OS at all, just some text in /etc/motd or similar. "Audit" in this case is the more generic term relating to the company responsibilities to audit systems with sensitive data. They are saying the system is not subject to governance type controls for either PCI or Sarbanes-Oxley. Which is ironic given what was leaked out of it. And yeah, that probably means they told cybersecurity auditors this system wasn't subject to rules associated with PCI and/or Sarbox.
• gibba999 5y ago
  T-Mobile explicitly excludes out-of-date software from their bug bounty program. Same with CSRF and XSS issues. https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/closing-security-gaps-360054 https://www.telekom.com/en/corporate-responsibility/data-pro... Most such issues are business-as-usual there.