This is my experience as well. A solutions architect is likely to be working directly with customers to achieve what they want with the product which can involve deployment work, integration work, etc. Sometimes this work is found to be repeatable across customers and may be engineered into the product. An architect (in a software or IT context) can have pretty widely varying responsibilities, usually more focused on building product or internal company environments. But solution architects have been fairly consistent in scope of responsibility across the companies I’ve been exposed to
Depends a lot on how many Spring apps out there have the prereqs to be vulnerable. The widespread nature of Log4Shell is what made it “worse” than other RCE vulns. I don’t have a sense of how many vulnerable instances of this one might be out there but the number could be enormous.
OP here. Sorry that it felt that way to you, and curious why? Because it is from a corporate blog? The material answers the question posited in the title, IMO, but curious why it came off as an Ad to you. Mind sharing?
Yeah, that is incredibly frustrating. It seems to me that many of these types of scams target general consumers, piggybacking on legitimate app's names to get a few thousand people to pay a buck or give you some personal info, etc. These instances that target developer tools have the potential to do a different kind of damage to peoples' livelihoods.
Totally. This extension was trying to be stealthy about exfiltrating data...but it wasn’t trying that hard. As noted in the article, the same developer had at least one other extension using the same code to obfuscate and exfiltrate data. Seems like sort of a spray and pray approach
Yep that’s a great point. That deprecation probably contributed to the gap that the malware uploader exploited. People expect an extension called postman, and they find it. Their guard is down and they download the fake one. I don’t know the solution but there has to be a better way for App/extension stores to handle this relatively common scenario.
It was sending off URLs visited by the host machine. Browsing history, essentially, which could be benign except that when your machine is inside a corp network you might be visiting all kinds of internal resources with URLs that shouldn’t be public/with sensitive info included in the resource locator, GET/POST contents, etc
It is a network traffic analysis product. You send it traffic via port mirror and it analyzes for shady behavior. Here’s the main overview of what it is https://www.extrahop.com/products/security/
This approach will likely be most useful for large enterprises that get attacked, since they're more likely to have a buffered packet capture of network traffic. This is still incredibly powerful given that most ransomware-prevention mechanisms are completely useless once the ransomware is already in your system.
Fair enough. Preventing ransomware from getting all the way through is a worthy goal as well. The fewer files they can encrypt, the better. It's hard to stop individual users from download malware onto their own machines, but stopping that malware from moving laterally into network attached storage can mitigate a ton of damage.
The headline refers to a different narrative that comes in about the middle section of the post, where a ransomware attack on a separate healthcare org was successfully thwarted (and thereby didn't make it into any headlines)