SolarWinds leaked FTP credentials through a public GitHub repo since 2018

Re:SolarWinds leaked FTP credentials through a public GitHub... by ceejayoz on Wednesday December 16, 2020 @09:44AM (#25443048)

Any "sophisticated hack" is likely to have some mundane details. This might've given an avenue to start exploring; it doesn't seem likely it's what let them sign binaries by itself, and it doesn't change the cleverness of the steganographic techniques described in the FireEye analysis.

[ Parent | on HN ]

Re:SolarWinds leaked FTP credentials through a public GitHub... by martinald on Wednesday December 16, 2020 @09:49AM (#25443132)

This isn't really a mundane detail though. The fact they have non secure (not even SFTP or FTP over SSL) FTP access open to their main downloads page with a ridiculously insecure password is pretty startling. I can't even understand why they had FTP running like that.

[ Parent | on HN ]

Re:SolarWinds leaked FTP credentials through a public GitHub... by ceejayoz on Wednesday December 16, 2020 @09:54AM (#25443192)

Having worked with large enterprise vendors, it's really not startling to me. Depressing, perhaps.

I'm saying, though, that a hack can be sophisticated even if the initial compromise was something pretty basic like this.

As an example, https://about.fb.com/news/2020/11/bug-bounty-program-10th-an...

> Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our Content Delivery Network (CDN), a global network of servers that deliver content to people accessing our platform around the world, where a subset of our CDN URLs could have been accessible after they were set to expire. After fixing this bug, our internal researchers found a rare scenario where a very sophisticated attacker could have escalated to remote code execution. As always, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty – $80,000.

[ Parent | on HN ]

Re:SolarWinds leaked FTP credentials through a public GitHub... by hackerpain on Wednesday December 16, 2020 @10:05AM (#25443377)

I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact.

How should I report it in your opinion?

[ Parent | on HN ]

Re:SolarWinds leaked FTP credentials through a public GitHub... by mackenzie-gg on Wednesday December 16, 2020 @10:44AM (#25443891)

Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty

[ Parent | on HN ]

Re:SolarWinds leaked FTP credentials through a public GitHub... by hackerpain on Wednesday December 16, 2020 @11:00PM (#25452289)

It's not. They may have a private program, don't know.

[ Parent | on HN ]

Re:SolarWinds leaked FTP credentials through a public GitHub... by ceejayoz on Wednesday December 16, 2020 @10:08AM (#25443421)

Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc.

In the EU, you might be able to report it to a regulator. In Russia, perhaps not.

[ Parent | on HN ]