Hacker News Reader

Comment by vorpalhex | Hacker News Reader

> Our IDEs are standalone tools and bear no relation to TeamCity, other than the fact that we use our own installation of TeamCity to build them.

It sort of seems like a compromised CI pipeline would allow an attacker to do all kinds of interesting things to your distributed binaries...

View on HN

True, but it wasn't JetBrains's CI pipeline that was compromised.

But if they have a vulnerability that SolarWinds has not yet disclosed, they could very well be distributing compromised software.

Yes, but that’s a big if. It’s also simply possible that Solarwinds has their TeamCity admin account password set to ‘password’ and accessible on a public network.

Right, and we don't know, which means we should audit aggressively and assume these things may still be open attack vectors. You don't hang out with the backdoor open waiting for your friend to let you know.

I guess that's why they said that they are auditing aggressively their CI tool.

We should, but we should have assumed CI software was an attack vector since before the solar winds hack. It’s always been a vector. This hack doesn’t change anything.

... actually, SolarWinds used "solarwinds123" on their FTP site.

Which is stored on a publicly-accessible GitHub repository.

(Source: https://www.theregister.com/2020/12/16/solarwinds_github_pas...)

Everything has a vulnerability that Solarwinds hasn't disclosed. What is the logic in focusing on this extremely unique choice? A plan by a government wants to spearfish developers at every enterprise software company to find 1+ ways in to their clients and should have chosen something universal. Without any apparent data, it seems more likely the suspicion is just speculation because it is less common than email clients, legacy browsers, dev-servers, common libraries, etc.

I.e. because no one else found this intruder the crap software that everyone uses must be safe?

Reply on news.ycombinator.com