[otterley]

I would very much like to see prevention advice tacked on to analyses like these. It's very interesting to see how the vulnerabilities were exploited, but I think it would be extremely valuable to understand how to prevent future attacks such as this. What were the root causes of the vulnerability, and how can the community prevent similar ones from being created in the future?

(Ideally with some automated tooling, too.)

[mrtesthah]

1. Don’t outsource 18,000 organizations’ security to the same vendor.

2. Don’t homogenize all the platforms.

3. Reproducible builds; in all likelihood the build server was compromised.

[frongpik]

I like comparing this type of unification with margin trading, in this case with 18000:1 leverage: if stocks go up, you get many multiples of the usual profits, but it takes only a tiny dip in the price to wipe out the account balance.

[jeffbee]

The root cause? It's that people buy snake oil from vendors to check boxes on meaningless compliance tests.

[meowface]

It can affect non-snake oil from good vendors who provide useful solutions for meaningful compliance tests, too, though. Or just any popular B2B software provider.

If one of the big 3 superpowers really wants to backdoor your product, then even a top-notch company might fall victim. Hopefully this increased awareness will make it harder to pull off these subtle compromises without it getting caught sooner, though.

[robocat]

Google banned Windows machines from their workforce a decade ago (due to getting hacked by the Chinese).

Has Google relaxed that ban in any way? I.e. does Google believe that Windows 10 is now secure?

What other major corporations or government departments have followed Google’s example since 2010?

[jeffbee]

I think "banned" is an overstatement. There were/are people obligated to use Windows because they need professional EDA tools and suchlike software only available for that platform. And although it's by no means my speciality -- I'm a distributed systems developer, not a Windows sysop -- I was told a few years ago that the general belief was that Windows had the most sound security story of all the operating systems you could put on a laptop. The reputation of Windows is a combination of history and the fact that idiots are likely to use it, so it always looks like the OS people do stupid things with. But if your company culture isn't stupid you can make it work much better.

[TheOperator]

NTFS was a file system built from the ground up for security compliance. Microsoft since about Windows XP SP2 has been taking security increasingly seriously, and they were willing to break a lot of software to enforce UAC in the Vista days and got nothing but hate for it.

Still regarding this specific hack the exploit was hidden in Orion's telemetry, showing that Microsoft's new love of telemetry isn't just privacy invading it's security degrading.

[dboreham]

Quick off the top of my head advice is to build on ephemeral systems a la GH Actions / Circle CI, not on long-lived build machines a la Jenkins.