A Microsoft engineer noticed something was off on a piece of software he worked on. He soon discovered someone was probably trying to gain access to computers all over the world.
  • treadful@lemmy.zipEnglish
    0·
    6 months ago

    I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.

      • treadful@lemmy.zipEnglish
        0·
        6 months ago

        It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.

        And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

        • Possibly linux@lemmy.zipEnglish
          1·
          6 months ago

          There are sysadmins that discover a major vulnerabilities though troubleshooting

          The key is the number of people involved