3 ms·
Grammar aside, the TLDR is that most of the Danish energy infrastructure was protected by a particular Zyxel firewall, and they got hacked by a state actor a co
by pnw 3y ago
Grammar aside, the TLDR is that most of the Danish energy infrastructure was protected by a particular Zyxel firewall, and they got hacked by a state actor a couple of weeks after a published vulnerability, and ten days after being warned explicitly to update their firewalls.
Anyone else find it alarming that critical infrastructure is being protected by a fairly low end Taiwanese networking vendor and not a more well known firewall brand?
- aaron695 3y ago[dead]
- MaKey 3y ago> Anyone else find it alarming that critical infrastructure is being protected by a fairly low end Taiwanese networking vendor and not a more well known firewall brand? Like Cisco with their regular CVEs?
- doublerabbit 3y ago> Like Cisco with their regular CVEs? It's why I use QBasic for my firewalls.
- wepple 3y agoCVEs aren’t a significant datapoint… In this case, a single-packet pre-auth root code exec is about as bad as it gets. I don’t recall the last time a major vendor had a doozie like that. Bugs happen, but having them wildly exploitable isn’t inevitable.
- lijok 3y agoYes, like Cisco Having regular CVEs signals only one thing - the product is popular
- userbinator 3y agoI find it more alarming that critical infrastructure isn't completely isolated from the Internet.