Quote:
Originally Posted by Ultramaroon
Actually, it says that they've not found any indication during ongoing investigation. They're as careful about keeping their options open as Reuters was about not quite saying there was material damage.
|
That's fair. The solid no indication is on the use of MS products as an attack vector.
As for Solarwinds, the backdoor was programmed to resolve the external IP of the infected client, and shut down if it was communicating from any internal IP, or from any IP owned by Microsoft. So much so that MS took over the registration domain and made it resolve to one of their own IPs in order to prevent new infections with currently known variants. A lot of people seem to have forgotten that and are making some very bad takes / speculation this morning.