<story><title>SolarWinds hack was &apos;largest and most sophisticated attack&apos; ever: MSFT president</title><url>https://www.reuters.com/article/us-cyber-solarwinds-microsoft-idUSKBN2AF03R</url></story><parent_chain><item><author>nimbius</author><text>Absolutely agree.  Solarwinds focuses a disproportionate amount of effort in ensuring it shows up favorably in Gartner magazine reviews and trade publications.  As a monitoring platform its a monolithic, expensive, slow and rather dated monitoring solution.  Agile does not come to mind, and you certainly wouldnt use it for anything approaching &amp;quot;observability.&amp;quot;&lt;p&gt;But the concerted marketing effort pays dividends.  Solarwinds is almost the only choice for government.  For potential attackers its a big red arrow.  Exploit a rent-seeking company that writes mediocre software and exists mostly to cash in on &amp;quot;best practice&amp;quot; lock-in with government contracts.&lt;p&gt;as far as i know nobodys really addressed the elephant in the room.  Solarwinds is &lt;i&gt;still&lt;/i&gt; a preferred government purchase for monitoring.  every company that was affected by it still uses it (or at least hasnt publically refuted it) and no government official has come forward to admit they will discontinue it.  Solarwinds hasnt offered any remediation or major changes in their development, leadership or code.  just patch, rinse, and repeat and try not to pay too much attention to the issue.</text></item><item><author>jjcm</author><text>Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I&amp;#x27;m missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&lt;/a&gt;</text></item></parent_chain><comment><author>heresie-dabord</author><text>The attacker in this case new the exact moves to insert a backdoor into .NET software. It wasn&amp;#x27;t hard to do, requiring no science.&lt;p&gt;But Microsoft&amp;#x27;s &amp;quot;system of trust&amp;quot; was undermined. The attacker was even inside Microsoft and Azure. No anti-virus, no &amp;quot;defender&amp;quot;, no amount of basic or advanced telemetry caught this.&lt;p&gt;FireEye alone caught it... By accident.&lt;p&gt;The real &amp;quot;elephant in the room&amp;quot; is that software security continues to be marketing theatre. Closed-source software should not be trusted and consumers should not believe that any due diligence has been done to protect them.</text></comment>
<story><title>SolarWinds hack was &apos;largest and most sophisticated attack&apos; ever: MSFT president</title><url>https://www.reuters.com/article/us-cyber-solarwinds-microsoft-idUSKBN2AF03R</url></story><parent_chain><item><author>nimbius</author><text>Absolutely agree.  Solarwinds focuses a disproportionate amount of effort in ensuring it shows up favorably in Gartner magazine reviews and trade publications.  As a monitoring platform its a monolithic, expensive, slow and rather dated monitoring solution.  Agile does not come to mind, and you certainly wouldnt use it for anything approaching &amp;quot;observability.&amp;quot;&lt;p&gt;But the concerted marketing effort pays dividends.  Solarwinds is almost the only choice for government.  For potential attackers its a big red arrow.  Exploit a rent-seeking company that writes mediocre software and exists mostly to cash in on &amp;quot;best practice&amp;quot; lock-in with government contracts.&lt;p&gt;as far as i know nobodys really addressed the elephant in the room.  Solarwinds is &lt;i&gt;still&lt;/i&gt; a preferred government purchase for monitoring.  every company that was affected by it still uses it (or at least hasnt publically refuted it) and no government official has come forward to admit they will discontinue it.  Solarwinds hasnt offered any remediation or major changes in their development, leadership or code.  just patch, rinse, and repeat and try not to pay too much attention to the issue.</text></item><item><author>jjcm</author><text>Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I&amp;#x27;m missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&lt;/a&gt;</text></item></parent_chain><comment><author>unixhero</author><text>Anectodally; I have been a one man army CTO for a period. I could not have managed my Windows servers without Solarwinds. It was an excellent product which did everything I could ever want.</text></comment>