A hacked construction company: the supplier's fault would be the cause

Recently a wave of hacking has hit the software of the firm Citrix.

These security vulnerabilities in its various computer programs have allowed hackers to attack a Luxembourg construction company. The major problem revealed as the cause of the hack is the fact that the provider did not warn its customers about the vulnerability.

This article will also interest you: How to protect companies from hackers?

the "Computer Incident Response Center Luxembourg," CIRCL, an institution public accountable for responding nationally to any security incidents helping cybercrime victims the best they can, has been warned Citrix's software problem.

since at the beginning, the institutions were warned of the security breach, which was not the case for the construction company. Asked about the RcCL officer Gérard Wagener explains a little bit about how the institution "We then go through the public databases to find the contact people in these networks. In order for them to be informed and that they know that there are so many machines in their network, which are potentially vulnerable – and that doesn't go any further for us. we let's hope that these people pass on the information. What we we really find the ideal, it is when we get an answer, that we are said that they had received the information and that they had informed their customers. Here In Luxembourg, there are several internet service providers that make a Great job. There, we have an answer within the hour, that customers have informed or take preventive measures. But hey, it's not the same everywhere. »

Back to the case concerning the hacking construction company. The supplier which has been called into question from the so-called Post Luxembourg. Being well aware of the flaw in the software he had provided to his customers, he did not not seen fit to warn them. Even if, in a sense, the law does not to do so, the merchant's duty could at least have encouraged him to in that sense. That is what the CRCL is doing. Gérard Wagener explains "People can contact us. They can communicate to us in their own right ipy address they have, the company and the contact person. And we can then directly inform these people. On the other hand, we also have a platform, called MISP Threat Sharing. All companies in the Luxembourg can join us there. They will even be able to benefit from the latest almost in real-time framing. ». In particular, this has put the disadvantage construction company because there was no contact with the construction system CIRCL warning.

Moreover, this work is not so easy for the agents of the Luxembourg computer security institution. Indeed, "It starts to get painful, because we have to call people for hours, stay on hold until someone comes, who will receive the information. The problem is that when we have a list of 100 companies to prevent and at 25th we stay with two men to whom we have to call constantly to find the right person. This means that all the following companies on the list will be notified later. ».

Now access an unlimited number of passwords: