News for hackers. Stuff that matters.

A comment on SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation. Parent comment

Re:SEC notifies SolarWinds CISO and CFO of possible action i... by grun3 on Friday June 30, 2023 @05:59PM (#36542977)
Wasn't the root cause of this attack someone setting a prod system password to 'solarwinds123'? Not very sophisticated nor unforseeable.

Not just any prod system... the one that distributed their trusted updates to their entire customer base I believe.

[ Parent | on HN ]
Re:SEC notifies SolarWinds CISO and CFO of possible action i... by donmcronald on Friday June 30, 2023 @06:41PM (#36543488)
Haha. I didn't follow it. After a bit of searching I had to laugh. They got owned by the 'hunter2' meme and call it a highly sophisticated and unforeseeable attack.
[ Parent | on HN ]
Re:SEC notifies SolarWinds CISO and CFO of possible action i... by mlyle on Friday June 30, 2023 @07:11PM (#36543829)
Well, all the subsequent steps after the initial breach were fairly fancy. But still, not a great posture overall.
[ Parent | on HN ]
Re:SEC notifies SolarWinds CISO and CFO of possible action i... by miguelazo on Friday June 30, 2023 @07:34PM (#36544099)
Exactly... the initial foothold was a joke. And the bottom line is that important management folks were warned about serious issues many times.
[ Parent | on HN ]
Re:SEC notifies SolarWinds CISO and CFO of possible action i... by mac-chaffee on Friday June 30, 2023 @08:37PM (#36544778)
No, that was a separate incident: https://www.theregister.com/2020/12/16/solarwinds_github_pas...

From what I can tell, all we know is that the attackers definitely got into their build system (since the trojan was signed), and we know they moved laterally through exploits in various Microsoft products: https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

[ Parent | on HN ]
Re:SEC notifies SolarWinds CISO and CFO of possible action i... by wharfjumper on Saturday July 01, 2023 @05:50AM (#36548422)
Will we see the SEC issue proceedings against Microsoft?
[ Parent | on HN ]