Hacker News Reader

Whoa. They didn't even block the installs from continuing to happen.

Google must be really confident in their ability to contain threats like this one. In other orgs, this would be a "hair on fire" sev 1 security incident.

View on HN

If a production environment gets contaminated, they just take the whole product behind the barn.

Defense in depth

That only works if you don't casually toss away your layers.

There are a LOT of layers at Google, and they're very liberal about what you can do on your own machine. There are a lot of steps between there and the prod environment, and usually a bunch of auditing too. Once you're in prod, your server also basically can't do anything unexpected - for example, if you want to call out of the datacenter, you have to file a ticket, etc. All of this establishes an audit trail, too.

I presume there are a lot of honeypots too?

Hackers “discover” a password, but infrastructure is watching for that canary to sing, and they know exactly what machine or file was compromised.

Hackers “discover” an internal service with a known vulnerability, but attempting to use the apparent vulnerability (honeypot) triggers security.

Reply on news.ycombinator.com