So we looked further, and what we found, chilled us to our bones: we were staring at the very moment the attacker gained the knowledge they needed.

    At a public conference, where a speaker from the company was talking about infrastructure. During Q&A, the future attacker asked a few very legit, on topic questions, such as what log processing solution the company used, what would the speaker recommend? Do they run LTS, or Stable branches of a particular operating system, or do they roll their own security updates? All perfectly good, innocent questions. I asked similar questions before, too! Questions anyone could have asked.

    Those questions, along with the talk before the Q&A, gave them most of the information they needed. They were able to coax an application to generate a log message that the processing tool would misparse, and everything started with that one, innocent looking message that had an extra comma.