FireEye was hacked, and its tools are out
A state-backed attacker stole FireEye’s red-team tools. FireEye published rules to detect them. Use them.
On Tuesday FireEye, one of the best-known security companies, said a highly skilled, state-sponsored attacker broke in and stole its red-team tools: the tools its own testers use to simulate attacks for clients.
FireEye did something useful straight away: it published hundreds of detection rules for those tools, and a list of the vulnerabilities they use.
What to do:
- Load FireEye’s published countermeasures into your security tools, or ask your provider if they have.
- Patch the vulnerabilities on FireEye’s list. Most have had fixes for a long time.
- Remember the bigger point: if a top security company can be breached, so can you. Detection and response matter as much as prevention.
FireEye’s openness here is the right example for every company that gets hit.