How An Attacker's Blunder Gave Us a Rare Look Inside Their Day-to-Day Operations

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by s46dxc5r7tv8 on Tuesday September 09, 2025 @12:15PM (#45184165)

Disturbing that they would be proud enough of spying on their users to post this. Threat intelligence is nearly as bad as the threats themselves. From crowdstrike destroying computer systems to this type of spying on their own users, who wants to trust these people? What happened to holding microsoft accountable for the security of their products?

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by Finnucane on Tuesday September 09, 2025 @12:59PM (#45184879)

For some value of 'spying', I guess. This is a product, as noted above, that say, a corporate IT dept. is installing in your company-issued laptop. Which means the customer, that is, not you, is okay with this behavior; it is what they are paying for.

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by cbisnett on Tuesday September 09, 2025 @01:35PM (#45185444)

It’s not that we’re spying on users for fun. We’re analyzing the browser history so determine if the history contains any sites that are associated with malicious activity. We definitely don’t care about your pr0n

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by lostlogin on Tuesday September 09, 2025 @02:14PM (#45186058)

I wouldn’t lead with this in the marketing. It’s entirely disturbing.

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by rcxdude on Tuesday September 09, 2025 @08:34PM (#45191567)

But you are spying on users?

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by jml7c5 on Tuesday September 09, 2025 @10:45PM (#45192556)

You're supposed to spy on an organization's users and machines for the benefit of the organization that has contracted you. That's not what you're doing here. You've taken an adversarial relationship with your (potential) customer, acting to harm them.

Presumably legal, but morally gray.

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by zer00eyz on Wednesday September 10, 2025 @03:41AM (#45194489)

Jesus.

I can rob people one at a time or I can go rob the bank. I can break into your clients one at a time or I can break into your "security" company.

Where is the product that keeps that data, your infrastructure safe? Why arent you selling that. Oh wait there is no such thing as it does not exist.

You are a compromise by a state level actor waiting to happen. In fact if you were compromised by a state level actor it is in your companies best interest to cover it up rather than disclose it (as that would be the end of your organization).

It's the fox guarding the hen house.

At some point were going to find out that a government, China, Russia, India.... used you, or one of your peers doing the same. This is taking off my shoes at the airport levels of stupid and ineffective.

I spend a fair bit of time talking to C-levels. The bulk of them use your services not because they think they are effective but because they know that they can point the finger at you when the shit hits the fan.

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by hunter-gatherer on Tuesday September 09, 2025 @02:05PM (#45185892)

So many of the comments here seem to be completely unaware of what an EDR does. Do none of you all work for companies with managed devices? There isn't anything abnormal here...

I work on a REM team in a SOC for a big finance company all you US people know. An employee can't hardly fart in front of their corporate machine without us knowing about it. How do you all think managed cyber security works?

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by mc32 on Tuesday September 09, 2025 @02:17PM (#45186111)

They might be under the impression that all this activity is looked at by someone for curiosity’s sake -snooping. It isn’t. People only look and discover if there is reason (a critical alert or some legal action). No one goes snooping to see what sites Joe visited this morning for no reason at all.

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by boston_clone on Tuesday September 09, 2025 @02:36PM (#45186519)

> No one goes snooping to see what sites Joe visited this morning for no reason at all.

In fact, I have worked at several organizations in which this type of activity would be a terminable offense.

[ Parent | on HN ]

Re:How An Attacker's Blunder Gave Us a Rare Look Inside Thei... by jamesnorden on Wednesday September 10, 2025 @07:36AM (#45196211)

The point you seem to be (intentionally?) missing is that this wasn't installed by the IT staff in an org to an employee's computer, an user downloaded their software to trial it an they just happened to take a peek on all of his activity based on tenuous evidence at best.

[ Parent | on HN ]