Security Firm Bit9 Hacked, Forgot to Use Own Security Software

rated by 0 users
This post has 4 Replies | 0 Followers

Top 10 Contributor
Posts 26,727
Points 1,209,070
Joined: Sep 2007
News Posted: Mon, Feb 11 2013 11:24 AM
In the immortal words of radiohead: “You do it to yourself...and that’s why it really hurts.” Security company Bit9 is surely feeling those words after being hacked late last week when attackers targeted computers within Bit9’s own network that weren’t protected by Bit9’s own software.

In the aftermath, Bit9 CEO Patrick Morley wrote in a blog post:

Due to an operational oversight within Bit9, we failed to install our own product on a handful of computers within our network. As a result, a malicious third party was able to illegally gain temporary access to one of our digital code-signing certificates that they then used to illegitimately sign malware.

Ouch, indeed. Certainly, someone is getting fired over this. Not only is that oversight terribly embarrassing on its own, it compromises Bit9’s brand and reputation to the point that it may affect the company’s bottom line.


For what it’s worth, the issue does not appear to be with Bit9’s product, according to Morley. Bit9’s protection combats malware by helping companies whitelist applications that are deemed safe (and thus assume that all others are threats) with digitally signed certificates, as opposed to the traditional anti-malware approach of trying to identify and eliminate threats as they come.

The problem with the direct hack of Bit9 is that the cybercriminals obtained the ability to sign certificates and simply signed malware. Once signed, the malware could freely run amok in and around any network protected by Bit9 software.

Morley stated that only three of its customers were affected, but that the company has taken steps to rectify the situation including revoking the affected certificate and acquiring a new one, protecting all of its machines internally, adding a malware patch, and monitoring for harshes from any illegally signed malware.
  • | Post Points: 50
Top 150 Contributor
Posts 634
Points 5,700
Joined: Sep 2012
Location: Canada
RWilliams replied on Mon, Feb 11 2013 12:03 PM

I am not too sure what's embarrassing about it, aside from the fact some goober forgot to install it to some machines. It's not like the software installs itself, and all this does is prove that it works.

  • | Post Points: 20
Top 25 Contributor
Posts 3,688
Points 55,890
Joined: Jul 2004
Location: United States, Massachusetts
Dave_HH replied on Mon, Feb 11 2013 12:17 PM

One word best describes this amazing feat of stupid... DOH!

Editor In Chief

  • | Post Points: 5
Top 500 Contributor
Posts 234
Points 1,835
Joined: Nov 2012
scolaner replied on Mon, Feb 11 2013 3:46 PM

Rob, to illustrate why that's embarrassing: When I was a child, I toured a firehouse with my class. During the little Q&A session, I asked what they would do if the firehouse were to catch fire. They all laughed at me. But this is a case of the firehouse catching fire. Yes, they reacted quickly to put out the fire, but they're also the ones who left the stove on with a roll of paper towels sitting on the burner.

  • | Post Points: 5
Top 10 Contributor
Posts 8,765
Points 105,070
Joined: Apr 2009
Location: Shenandoah Valley, Virginia
realneil replied on Mon, Feb 11 2013 9:10 PM

It may take a while for them to clean the egg off of their faces.

Dogs are great judges of character, and if your dog doesn't like somebody being around, you shouldn't trust them.

  • | Post Points: 5
Page 1 of 1 (5 items) | RSS