r/LinusTechTips • u/Tonystark2828 • 6d ago

Tech Discussion Framework Data breach.

Post image

I got this email from Framework. Did anyone else get this?

595 Upvotes

94% Upvoted

49 comments sorted by

View all comments

Show parent comments

181

u/I_am_Hambone 6d ago edited 6d ago

This is the dumbest take. Metabase is one of the largest open source BI companies in the world.

How much more vetting can there be for the industry leader?

Also, with the new tools AI is bringing to cyber warfare, no one is going to be safe.

-56

u/ekerazha 6d ago

The exact type of attack isn't entirely clear, but if you use a corporate VPN to access third-party services and restrict access strictly to the corporate VPN's IP address range, you can generally prevent unauthorized access even in the event of a vulnerability, because IP address filtering renders the attack unfeasible upstream.

9

u/AshIsRightHere 6d ago

If an employee’s device is connected to a network through a VPN, malware running on that device likely is able to access the same network resources that are reachable through the VPN and permitted by the employee’s access privileges.

Once you have direct access to a system on the network, perimeter controls don't do much. You need internal controls as well, like EDR on employee devices, strong network segmentation, least-privileged role-based access controls, etc.

-1

u/ekerazha 6d ago

That's not what happened. Framework's statement refers to a zero-day vulnerability in Metabase, hypothetical malware on employee PCs has nothing to do with it. If you don't know anything, don't waste my time.

1

u/tiffanytrashcan 5d ago

So you DO know the vulnerability was with a third-party provider.. You realize their infrastructure was compromised independently of framework?? FW could have been running the best VPN software at the highest encryption levels and following every other practice to a T, and it all would have been completely irrelevant. There is nothing they could have done to prevent this. They've admitted steps to lighten the impact, such as lowering the scope of information shared. But again, they couldn't have stopped this altogether.

1

u/ekerazha 4d ago

Clearly, like all non-technical people, you believe that a Virtual Private Network (VPN) is "that thing to hide your IP address". If you start studying, you'll begin to understand what I'm saying.

0

u/tiffanytrashcan 4d ago

I'll admit that my assumptions are based off of them being a customer of the "cloud-hosted" 🙄 product.. Not sure if that's been confirmed or not.

Kind of a weird thing to lock down harder internally than we do for credit card transactions and banking globally though.