A Microsoft engineer noticed something was off on a piece of software he worked on. He soon discovered someone was probably trying to gain access to computers all over the world.
I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.
It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.
And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.
I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.
Obviously not impossible to spot, just the best reason for open source software
It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.
And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.
There are sysadmins that discover a major vulnerabilities though troubleshooting
The key is the number of people involved