That Hack Is the Sound of Inevitability

A massive data breach is a reminder that in all corners of cyberspace, the advantage is with the attackers

- Joshua Brustein

The world has a way of reminding us of our own helplessness. The year 2020 has had more than its share of examples to choose from, but for those who prefer to direct their existential dread toward the inability of anyone to protect their digital data, the recent revelation of one of the most significant cybersecurity attacks in history is an excellent place to start.

This past spring hackers managed to insert malicious code into a software product from an IT provider called SolarWinds Corp. whose client list includes 300,000 institutions. About 18,000 of them were exposed when they downloaded a legitimate update from SolarWinds—which of course is the exact thing you’re supposed to do to keep your defenses fresh. The attackers spent months running free through their victims’ networks before anyone noticed, harvesting secrets, and could also have been inserting other vulnerabilities and doing God knows what else. The U.S. government and independent cybersecurity experts have tied the attack to hackers affiliated with the Russian government, and its victims include the U.S. departments of Commerce, State, and Treasury, Microsoft Corp., and cybersecurity firm FireEye Inc.

But sure, go ahead and mix a few special characters into the password on your email account if it makes you feel better.

In a sense, the SolarWinds attack is far removed from the security concerns of individual users, who are more vulnerable to things like having their computers locked until they cough up a ransom denominated in Bitcoin. It’s not worth thinking too much about hardening yourself against state-sponsored hackers, in the same way you wouldn’t choose a deadbolt for your front door based on how well it would stand up to an intercontinental ballistic missile.