![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
thewayneCitrix is a major player in the computer networking equipment market. And they had a major, sorry, MAJOR software flaw back in October that was exploited bigly. They patched it and announced the patch as fast as they could, and their customers patched as fast as they could.
Which brings us to Xfinity.
From the article: "Citrix disclosed the vulnerability and issued a patch on October 10. Eight days later, researchers reported that the vulnerability, tracked as CVE-2023-4966 and by the name Citrix Bleed, had been under active exploitation since August. Comcast didn’t patch its network until October 23, 13 days after a patch became available and five days after the report of the in-the-wild attacks exploiting it."
Ruh-roh!
Two weeks is far too long for a vulnerability that big to go unpatched. Care to guess what happened? Oh, I forgot. It was in this post's subject line.
To continue the article: "“However, we subsequently discovered that prior to mitigation, between October 16 and October 19, 2023, there was unauthorized access to some of our internal systems that we concluded was a result of this vulnerability,” an accompanying notice stated. “We notified federal law enforcement and conducted an investigation into the nature and scope of the incident. On November 16, 2023, it was determined that information was likely acquired.”
Comcast is still investigating precisely what data the attackers obtained. So far, Monday’s disclosure said, information known to have been taken includes usernames and hashed passwords, names, contact information, the last four digits of social security numbers, dates of birth, and/or secret questions and answers. Xfinity is Comcast’s cable television and Internet division."
Yeah. Free credit monitoring? Thoughts and prayers? There needs to be some executive job loss and demotions. But as this is Comcast, nothing will change.
Completely inexcusable.
Back in the '90s, when the I Love You email virus hit, I learned about it at about 7:15 or so in the morning. We literally unplugged our firewall from the internet as there was no patch for it at the moment. And we had no problems. You can't let shit like this go unchecked, or things like this happen.
https://arstechnica.com/security/2023/12/hack-of-unpatched-comcast-servers-results-in-stolen-personal-data-including-passwords/
Which brings us to Xfinity.
From the article: "Citrix disclosed the vulnerability and issued a patch on October 10. Eight days later, researchers reported that the vulnerability, tracked as CVE-2023-4966 and by the name Citrix Bleed, had been under active exploitation since August. Comcast didn’t patch its network until October 23, 13 days after a patch became available and five days after the report of the in-the-wild attacks exploiting it."
Ruh-roh!
Two weeks is far too long for a vulnerability that big to go unpatched. Care to guess what happened? Oh, I forgot. It was in this post's subject line.
To continue the article: "“However, we subsequently discovered that prior to mitigation, between October 16 and October 19, 2023, there was unauthorized access to some of our internal systems that we concluded was a result of this vulnerability,” an accompanying notice stated. “We notified federal law enforcement and conducted an investigation into the nature and scope of the incident. On November 16, 2023, it was determined that information was likely acquired.”
Comcast is still investigating precisely what data the attackers obtained. So far, Monday’s disclosure said, information known to have been taken includes usernames and hashed passwords, names, contact information, the last four digits of social security numbers, dates of birth, and/or secret questions and answers. Xfinity is Comcast’s cable television and Internet division."
Yeah. Free credit monitoring? Thoughts and prayers? There needs to be some executive job loss and demotions. But as this is Comcast, nothing will change.
Completely inexcusable.
Back in the '90s, when the I Love You email virus hit, I learned about it at about 7:15 or so in the morning. We literally unplugged our firewall from the internet as there was no patch for it at the moment. And we had no problems. You can't let shit like this go unchecked, or things like this happen.
https://arstechnica.com/security/2023/12/hack-of-unpatched-comcast-servers-results-in-stolen-personal-data-including-passwords/
no subject
Date: 2023-12-20 02:51 pm (UTC)no subject
Date: 2023-12-20 08:19 pm (UTC)I was working for the police dept at the time on a 7-5 shift, and every morning the first thing that I did was fire up Slashdot. And it was the #1 story of the day. As soon as I saw what was going on, I went to our network guy's office, showed him the story, and we went into the server room and pulled the plug on the firewall and disconnected us from the city network and the entire outside world. Apparently no one in the city IT dept had similar habits and they got hammered hard. We had a couple of people who opened it, but for some reason it never spread and we never had any late infections pop up. We got really lucky.
no subject
Date: 2023-12-20 08:18 pm (UTC)no subject
Date: 2023-12-20 08:45 pm (UTC)Now, this is what gets me. You probably read my post about Binance getting fined literally BILLIONS of dollars. Granted, they broke actual FTC rules if not laws. Now here Comcast/Xfinity didn't break laws, but as another article that I read it looks like pretty much their ENTIRE user base got leaked! And they'll get fined probably what, tens of millions? That's what, maybe half a day's profit? Fine 'em a billion dollars and see if that'll wake 'em up. It would be nice to see them burned to the ground in fines, but that's not going to happen: the Feds and Congress are too captured by corporate lobbyists.
no subject
Date: 2023-12-20 10:24 pm (UTC)Fine them multiple years' profits and see if they are that callous again.
no subject
Date: 2023-12-20 10:56 pm (UTC)You hear about these big corps being fined 'tens of millions of dollars!' and the CEO holds his breath for ten seconds while looking at his watch and says 'Well, that's over!' I say fine 'em like 5% of their GROSS for the year and see how they like that! Their stock holders might be asking for better governance within the org at that point and be wanting to know why crap like this happens.
no subject
Date: 2023-12-21 06:01 am (UTC)Talk about epic failure. :o :o :o
Hugs, jon
no subject
Date: 2023-12-21 07:54 pm (UTC)Comcast is notorious as a very poor company when it comes to customer service. They're just there to rake in the bucks.
no subject
Date: 2023-12-22 12:47 am (UTC)no subject
Date: 2023-12-26 03:33 am (UTC)COMCAST.
... there's a PROBLEM.
no subject
Date: 2023-12-26 06:59 pm (UTC)Comcast has been a 'We don't care, we don't have to' ISP for a very long time. I can't say that I'm terribly surprised by this.