SolarWinds Supply Chain Hack

Something like this has happened in the proprietary world: the SolarWinds supply chain attack. IIRC, they were releasing breached versions for about a year, and I think it became known only when the US Government came knocking on SolarWinds door. SolarWinds potentially vetting every employee through HR had zero effect on preventing a supply chain attack.

Related ongoing thread:We've learned nothing from the SolarWinds hack - https://news.ycombinator.com/item?id=38255923 - Nov 2023 (74 comments)

Usually because either them or a high profile customer was hacked with it.

They probably got hacked. This happens to the best companies and nothing much can be done about it. I don't think it's fair to call them "so negligent" yet.

to be fair, many of them could be breached already, u just don't know about it yet. At least with OneLogin there was a disclosure and pressure from the public to improve their opsec.

You mean like the SolarWinds hack that happened a lil while ago?https://www.techtarget.com/whatis/feature/SolarWinds-hack-ex...

This is incorrect you should re-read the post here cause I think you misunderstood the implication. They lacked the logging at the time to know what apps were impacted and the extent to which customers were compromised by this. They are legally obligated to disclose security risks like this which is why they did. You should consider setting a higher bar for your commendations.

You don't wanna get hacked but basically everyone gets hacked, so it's more of a question of "how well does your security and monitoring stand up to hacking?"The big red flag here is that they didn't catch it for so long! How did they not notice?

If we don't know how it got compromised, chances are this attack is still spreading?

that was the issue in the solar winds hack: https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-c...