Why security experts were blindsided by the SolarWinds attack

The SolarWinds cyberattack on U.S. government agencies and private organizations was and is frightening in its scale and success. It proved no match for the government agencies charged with defending against such things, and brought into sharp focus the fact that the government’s current model for responding to cyberthreats is lacking. The Senate Intelligence Committee hosted some of the main players in the SolarWinds saga Tuesday for some soul-searching on how the government and private tech companies should work together to stop future attacks. Some of the main themes discussed in the hearing are likely to end up in new cybersecurity legislation this year, a Congressional source told me. SolarWinds is the name of the Texas-based company whose IT management software is used by many government agencies and large corporations. Back in March 2020, the attackers—widely thought to be employed by Russia’s Foreign Intelligence Service—first planted malware in the SolarWinds system that sends updates to all its clients. When government agencies installed the update, they installed the malware, too. The attack was finally reported in December 2020 by the private security firm FireEye, and then only because the firm discovered its own systems had been infected. The SolarWinds attack was novel, in that it targeted both government and private-sector entities, and for its use of a government supplier (SolarWinds) as a Trojan horse to gain access to government agency systems. The white hats (security good guys) were not ready for this roundabout way of attacking. During the hearing, SolarWinds CEO Sudhakar Ramakrishna said the security community knows how to defend against direct attacks on networks and spear-phishing attacks in which hackers pose as a trusted party and try to trick employees of the target company into giving up their network credentials. Security experts have less experience with attacks that exploit a private-sector supplier of software to the government to gain entry. It’s hard for the eventual target organization—in this case government agencies and corporations—to see that kind of attack coming. The attackers attached malware to an update to SolarWinds’ Orion software. When the company’s clients—18,000 of them—installed the update, they also installed the malware. The attackers are thought to have penetrated the systems of 100 private companies and 11 government agencies, including the Departments of State, Energy, Homeland Security, and Treasury, and the National Nuclear Security Administration Read More …

Fry’s is dead, and it’s taking part of Silicon Valley culture with it

Fry’s Electronics is dead. The chain of computer and consumer electronics superstores is closing its 31 remaining stores , thereby joining Circuit City, CompUSA, and my own beloved RadioShack among the once-mighty retailers of technology products that went into decline and finally collapsed. If you live in one of the 41 states that didn’t have a Fry’s, or you don’t consider yourself much of a nerd, this news might mean nothing to you. But for some of us, Fry’s demise—though inevitable—is a shock. (Happily, Micro Center, another venerable chain skewing more to the eastern half of the U.S., is still with us .) Fry’s eventually had locations as eastward as Indiana, but it began in the Bay Area in 1985, where it was cofounded by three brothers whose father had sold his grocery empire (also called Fry’s ) and given them some of the proceeds Read More …

These are the ways self-regulation could fix Big Tech’s worst problems

Governments and observers across the world have repeatedly raised concerns about the monopoly power of Big Tech companies and the role the companies play in disseminating misinformation. In response, Big Tech companies have tried to preempt regulations by regulating themselves . With Facebook’s announcement that its Oversight Board will make a decision about whether former President Donald Trump can regain access to his account after the company suspended it, this and other high-profile moves by technology companies to address misinformation have reignited the debate about what responsible self-regulation by technology companies should look like. Read More …

This ideal résumé template to use if you’re looking for a job in tech

Technology companies are booming despite the pandemic, and technology professionals have never been in higher demand. So now’s the time for software engineers to update their résumés to take advantage of this extraordinary hiring environment. At Leet Resumes , we’ve assessed the résumés of tech professionals from thousands of companies. Here are a few quick tips for making a more effective résumé for the New Year. Purpose : Remember that the purpose of your résumé is to generate interview requests. It’s not your bio, your academic CV, an exhaustive list of everything you’ve done, or even a good representation of the complete you. The purpose of a résumé is to get interviews, and everything that isn’t essential to that goal should be jettisoned. Scannable: Your résumé needs to be scannable. When it comes to your professional summary—the top ⅓ of the page of your résumé—it needs to be easy for the reader to digest in only a few seconds. As a first pass, they’re scanning it as quickly as possible to determine whether or not you belong in the “read more carefully” pile. That means they’re skimming through your résumé at top speed to decide whether to send you along to the next stage, whether that’s a quick Zoom screen or a full interview with the engineering manager. Paragraphs won’t cut it. When résumé readers lose their train of thought in your paragraph or are distracted by complex sentences, they move on. It’s essential that you keep their attention with short words and phrases that attract their interest. Headline: You’ll need a professional headline that sums up your role and level for easy comprehension. This concise statement encapsulates your professional standing in a few words. Great professional headlines include: Passionate Open Source Engineer Top-performing BI Analyst Innovative Machine Learning Expert Successful Front-end Engineer Dedicated DevOps Professional For the HR professional or engineering manager reviewing résumés, this clear professional headline grabs attention and serves as a ready shorthand summation of your career to date. After your professional headline, you’ll share four job titles you’d actually accept for your next role. Read More …

Watch the ‘Perseverance’ rover land on Mars in this just-released video

Since we began sending probes to the surface of Mars, our experience of their landings was a nail-biting silence, punctured only by a NASA Mission Control engineer announcing milestones in the spacecraft progress. That all changed with the Mars 2020 Perseverance rover filming its February 18 landing . Six of the 23 onboard commercial cameras shot high-definition footage of the supersonic descent—dubbed the “ 7 minutes of terror “—and first surface movements. Three cameras trained on the parachute, while another three videoed the descent stage, rover, and approaching ground. Jet Propulsion Laboratory (JPL), the Pasadena, California, facility that built the rover and manages the $2.7 billion mission, premiered its high-resolution video during today’s briefing . This marks the first time we’re able to watch a spacecraft land on another planet. “These images and videos are the stuff of our dreams,” said Mars 2020 entry, descent, and landing (EDL) lead engineer Allen Chen. “I just couldn’t believe my eyes; the images were better than I could have imagined,” JPL’s Adam Nelessen told Fast Company about his initial reaction to the footage. An EDL lead systems engineer, Nelessen focused on the EDL camera technology. “There is a lot that we can learn from the imagery. One of the best engineering outcomes is going to be recording the inflation of the parachute at a high frame rate. We’re going to learn just how well this thin piece of fabric is actually performing.” This is also the first time EDL engineers have seen the landing process unfurl in its entirety, as they were only able to run tests in separate stages on Earth. The footage revealed that the EDL navigation system came to within 16 feet of its landing target. The video also gave a better sense of the debris that kicks up during landing, particularly as NASA looks to land increasingly heavier items on Mars. “We worry about dust and sand confounding radar sensors and making our landing more difficult,” he adds. “So seeing what the dust environment and hazards are like in the area have really good engineering uses for us.” Plus, observing the landing site on approach offers a head start on how to best navigate the area to achieve the science objectives. More raw images of Mars can be found here . High-resolution photo from the descent stage camera of Perseverance being lowered to the Martian surface via the sky-crane mechanism Read More …