Alleged Leak of Samsung Code

[I7guy]

Hackers leak 190GB of alleged Samsung data, source code

The Lapsus$ data extortion group leaked today a huge collection of confidential data they claim to be from Samsung Electronics, the South Korean giant consumer electronics company.

www.bleepingcomputer.com

If true, why don’t tech companies take security seriously?

 

[ApfelKuchen]

Even assuming the leak is genuine, how do you come to the conclusion that companies like Samsung don't take security seriously? They can be incredibly serious and still have an exploitable weakness, whether the weakness is in software/systems or a "trusted" employee or business partner. I don't think there's ever been a 100% effective defense against anything if an attacker is sufficiently determined and has sufficient resources to expend.

 

[Pakaku]

One data breach isn't enough to say tech companies (blanketing all tech companies together, as you seem to put it) don't take security seriously. If they didn't, breaches would be infinitely more common.

Plus we don't know how the data leaked, which could tell a lot about how secure the data was in the first place. Did they phish or guess some passwords, did an insider intentionally put it out there, or did it take far more work from an outsider?

 

[I7guy]

There are some data breaches that are absolutely preventable. Some hacker finds their way into some system not configured correctly by some sysadmin. While obviously I don't know the answer to these questions.
- Did Samsung hire external expertise to assess it's practices
- Were security experts brought in to do penetration testing on their systems
- Are sensitive areas firewalled off properly
- Do Samsung employees receive training in phishing emails and good security practices
- Are multiple authentication methods in place for Samsung employees logging into corporate systems
- Do Samsung systems get patched regularly
- Are Samsung systems hardened properly -- according to industry best practices
- Do Samsung systems undergo periodic review
- Does Samsung follow industry best practices
- Does Samsung have systems and processes in-place to monitor the network

While we may never get the answer on how this leak was accomplished, some leaks, like the infamous RSA leak was brought about by one employee clicking on something they should have known better.

 

[JPack]

Qualcomm source code? Sounds expensive and prize worthy.

 

[satcomer]

Sounds as if an Admins account from home was hacked or a former Admin that was fired sold his credentials to highest bidder! That's how most people get "hacked" or plain imitating a remote Admins account! I was amazed that after one job my remote credentials STILL worked, that amazed me and told a old friend they need to delete former Admins accounts as soon as person leaves!

 

[ApfelKuchen]

There are some data breaches that are absolutely preventable. Some hacker finds their way into some system not configured correctly by some sysadmin. While obviously I don't know the answer to these questions.
- Did Samsung hire external expertise to assess it's practices
- Were security experts brought in to do penetration testing on their systems
- Are sensitive areas firewalled off properly
- Do Samsung employees receive training in phishing emails and good security practices
- Are multiple authentication methods in place for Samsung employees logging into corporate systems
- Do Samsung systems get patched regularly
- Are Samsung systems hardened properly -- according to industry best practices
- Do Samsung systems undergo periodic review
- Does Samsung follow industry best practices
- Does Samsung have systems and processes in-place to monitor the network

While we may never get the answer on how this leak was accomplished, some leaks, like the infamous RSA leak was brought about by one employee clicking on something they should have known better.

All these questions are completely reasonable (and the list is hardly complete). There are most certainly breaches that were 100% preventable. However, there's a difference between asking questions and drawing a conclusion before they are even asked, no less answered. Like they say, "Innocent until proven guilty."