Hacker News new | ask | show | jobs
by samstave 670 days ago
Some (all) CEOs learned that offering a free month coupon/voucher for Future Security Services to secure your information against a breach like the one that just happened on the platform that's offering you a free voucher to secure your data that sits on the platform that was compromised and leaked your data, is a nifty-clean way to handle such legal inconveniences.

Oh, and some supposed financial penalty is claimed, but never really followed up on to see where that money went, or what it accomplished/paid for - and nobody talks about the amount of money that's made by the Legal-man & Machine-owitz LLP Esq. that handles these situations, in a completely opaque manner (such as how much are the legal teams on both sides of the matter making on the 'scandal')?
1 comments
Jenk 670 days ago
Techies aren't immune either, before we all follow the "blame management" bandwagon for the 2^101-tieth time.

CEOs aren't the reason supply chain attacks are absolutely rife with problems right now. That's entirely on the technical experts who created all of those pinnacle achievements in tech ranging from tech-led orgs and open source community built package ecosystems. Arbitrary code execution in homebrew, scoop, chocolatey, npm, expo, cocoapods, pip... you name it, it's got infected.

The LastPass data breach happened because _the_ alpha-geek in that building got sloppy and kept the keys to prod on their laptop _and_ got phised.

link
sebastiennight 670 days ago
Wait, where can we read more about that? When you say "the keys to prod" do you mean the prod .ENV variables, or something else?
link
Jenk 670 days ago
https://www.theverge.com/2023/2/28/23618353/lastpass-securit...

An employee (dev/sysadmin) had their home device compromised via a supply chain attack, which installed a keylogger and the attacker(s) were able to exfiltrate the credentials to lastpass cloud envs.

link
aftbit 670 days ago
Yeah supply chain stuff is scary and still very open. This ranges from the easy stuff like typo-squatting pip packages or hacktavists changing their npm packages to wreck all computers in Russia up to the advanced backdoors like the xz hack.

Another big still mostly open category is speculative execution data leaks or other "abstraction breaks" like Rowhammer.

At least in theory things like Passkeys and ubiquitous password manager use should eventually start to cut down on simple phishing attacks.

link