News for hackers. Stuff that matters.

A comment on U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise. Parent comment

Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by nrmitchi on Monday December 14, 2020 @12:58PM (#25420766)
SolarWinds is a 21-year-old publicly-traded company.

They're not really "yet another startup".

I also don't think that the departments of the US Government are all going around all willy-nilly dropping tools from "yet another startup" into their core infrastructure.

While your overall point may be valid, it's tough to come to the conclusion that it is applicable here.

[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by falcolas on Monday December 14, 2020 @02:09PM (#25421763)
I believe that you have mis-read their comment - they aren't saying Solar Winds is "yet another startup", they're saying that SolarWinds is incorporating 3rd party technology (the so-called supply chain attack on their build) without vetting it.

And, if we're being honest, those technologies probably are based off startup tech; SolarWinds purchases and incorporates startup companies (such as Vivid Cortex recently).

[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by nrmitchi on Monday December 14, 2020 @02:18PM (#25421893)
That is entirely possible.
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by mcguire on Monday December 14, 2020 @01:27PM (#25421167)
Willy-nilly dropping tools into core infrastructure is largely how government IT works.

Corporate IT, too, from what I've seen.

[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by notabee on Monday December 14, 2020 @02:15PM (#25421843)
That's very true, In my limited experience, they are tools sold to non-technical leadership that are either thrown to technical staff to deal with and implement or require letting yet another vendor have network access to manage. It adds up to a hot mess.
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by mcguire on Monday December 14, 2020 @02:24PM (#25421944)
My favorite comment from a (authentication system) vendor, during a meeting where we were trying to figure out why users were having trouble logging into an internal app: "Do I have a charge code for this?"
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by wglb on Monday December 14, 2020 @02:54PM (#25422359)
No longer publicly traded: https://www.solarwinds.com/company/press-releases/solarwinds...
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by nrmitchi on Monday December 14, 2020 @04:13PM (#25423388)
Went public again Oct 18, 2018: https://www.solarwinds.com/company/press-releases/2018-q4/so...
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by wglb on Tuesday December 15, 2020 @12:45PM (#25432707)
I stand corrected.
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by reaperducer on Monday December 14, 2020 @01:48PM (#25421455)
SolarWinds is a 21-year-old publicly-traded company. They're not really "yet another startup".

Today it is. If we knew when SolarWinds was added to the government systems, his comment might stand.

[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by mgreenleaf on Monday December 14, 2020 @02:10PM (#25421773)
And yesterday's startup is tomorrow's billion dollar company, often with nothing changed except the number of customers.
[ Parent | on HN ]
Re:U.S. Treasury, Commerce Depts. Hacked Through SolarWinds ... by rplnt on Monday December 14, 2020 @02:34PM (#25422103)
Startup or not, government contracts require certain certifications.
[ Parent | on HN ]