Again: There's no evidence this was a "supply chain" attack.
In the case of Solar Winds, hackers hacked into Solar Winds, and thus, their customers.
In the current story, there's no evidence they hacked into Constant Contact, but instead, hacked the customer.
In the case of Solar Winds, hackers hacked into Solar Winds, and thus, their customers.
In the current story, there's no evidence they hacked into Constant Contact, but instead, hacked the customer.
https://twitter.com/nicoleperlroth/status/1398670779550556160
There are three possibilities:
1. they hacked Constant Contact and can use any account there
2. they hacked USAID and can use any service for which USAID has an account
3. they hacked just the USAID account at Constant Contact (e.g. from "credential stuffing")
1. they hacked Constant Contact and can use any account there
2. they hacked USAID and can use any service for which USAID has an account
3. they hacked just the USAID account at Constant Contact (e.g. from "credential stuffing")
Possibility #1 would be a supply-chain attack like Solar Winds.
Possibility #2 would be an attack against the US government, like against OPM
Possibility #3 is just a common thing teenager hackers do and is relatively silly
Possibility #2 would be an attack against the US government, like against OPM
Possibility #3 is just a common thing teenager hackers do and is relatively silly
Now the email they sent was rather sophisticated and targeted, according to reports. It's just that the means to do so appear to have been the simplest and most common of all things.
Now, in much the same way that the NYTimes has assumed possibility #1, I'm assuming #3. However, #3 is a bajillion times more common than #1, I think the burden of proof is on those claiming #1.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
