Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mercor says it was hit by cyberattack tied to compromise LiteLLM

techcrunch.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#41

Post by nope1000 »

_pdp_ wrote: post #21
nope1000 wrote: post #7

> The incident also prompted LiteLLM to make changes to its compliance processes, including shifting from controversial startup Delve to Vanta for compliance certifications. This is pretty funny. The leaked excel sheet with customers of Delve is basically a shortlist of targets for hackers to try now. Not that they necessarily have bad security, but you can play the odds

I am not defending Delve or anything and I hope they get what they deserver but there is no correlation between SOC2 certification and the actual cyber capability of a company. SOC2 and ISO27001 is just compliance and frankly most of it is BS.

Sure it's certainly not perfect and a lot of the documentation is something you just write for the audit and never look at it again but that's why I am saying play the odds. The average delve customer startup might be less secure that the average startup who has to justify their processes to a real auditor.

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#43

Post by sersi »

mikeocool wrote: post #28
cj wrote: post #27

Earlier quoted context omitted.

If your goal is to maximize your posture against cyber threats, spending your time on SOC 2 compliance with Vanta (or similar) is a waste of time if you consider the amount of time spent compared to security gained. It's incredibly easy to get SOC 2 audited and still have terrible security. > forces you to go through a very useful exercise of risk modeling Have you actually done this in Vanta, though? You would have…

Probably the most useful aspect of SOC2 is that it gives the technical side of the business an easy excuse for spending time and money on security, which, in startup environment is not always easy otherwise (Ie “we have to dedicate time to update our out of date dependencies, otherwise we’ll fail SOC2”). If you do it well, a startup can go through SOC2 and use it as an opportunity to put together a reasonable cyberse…

That's exactly what I've done in the past. We had to be soc2 and pci dss compliant (high volume so couldn't be through saq). I wouldn't say the auditor helped much in improving our security posture but allowed me to justify some changes and improvements that did help a lot.

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#44

Post by snapcaster »

_pdp_ wrote: post #21
nope1000 wrote: post #7

> The incident also prompted LiteLLM to make changes to its compliance processes, including shifting from controversial startup Delve to Vanta for compliance certifications. This is pretty funny. The leaked excel sheet with customers of Delve is basically a shortlist of targets for hackers to try now. Not that they necessarily have bad security, but you can play the odds

I am not defending Delve or anything and I hope they get what they deserver but there is no correlation between SOC2 certification and the actual cyber capability of a company. SOC2 and ISO27001 is just compliance and frankly most of it is BS.

Some of it is, but things like "your stage/dev and production environments should be completely isolated from eachother" are valid and most tech companies get lazy on this front

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#45

Post by sandeepkd »

_pdp_ wrote: post #21
nope1000 wrote: post #7

> The incident also prompted LiteLLM to make changes to its compliance processes, including shifting from controversial startup Delve to Vanta for compliance certifications. This is pretty funny. The leaked excel sheet with customers of Delve is basically a shortlist of targets for hackers to try now. Not that they necessarily have bad security, but you can play the odds

I am not defending Delve or anything and I hope they get what they deserver but there is no correlation between SOC2 certification and the actual cyber capability of a company. SOC2 and ISO27001 is just compliance and frankly most of it is BS.

Yes they may be a BS in certain cases, however its still better than nothing. They do allow the companies to consider the questions atleast instead of claiming unawareness and most importantly it facilitates the incremental improvement.

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#46

Post by kajman »

dns_snek wrote: post #23
lmc wrote: post #12

Earlier quoted context omitted.

Read this: https://kayssel.substack.com/p/docker-escape-breaking-out-of...

99% of this is inapplicable to this discussion because it's about misconfigurations. Escapes: - privileged mode (misconfiguration, not default or common) - excessive capabilities (same) - CAP_SYS_ADMIN (same) - CAP_SYS_PTRACE (same) - DAC_READ_SEARCH (same) - Docker socket exposure (same) - sensitive host path mounts (same) - CVE-2022-0847 (valid. https://www.docker.com/blog/vulnerability-alert-avoiding-dir... ) - CV…

I don't think it's crazy to imagine a misconfigured production environment. I always see these same examples of how "containers aren't really secure" and they're very amateur sins to commit though, as you mention.

AFAIK a comprehensive SELinux policy (like Red Hat ships) set to enforce will also prevent quite a few file accesses or modifications from escapes.

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#48

Post by robshippr »

Second major supply chain compromise in a week after the axios npm attack. 40 minutes and 500k machines affected. SOC2 won't catch this. The real question is whether your CI pipeline would have flagged a dependency change that happened between your last build and the one going to prod. Most teams have no visibility into that window at all.

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#49

Post by parliament32 »

_pdp_ wrote: post #21
nope1000 wrote: post #7

> The incident also prompted LiteLLM to make changes to its compliance processes, including shifting from controversial startup Delve to Vanta for compliance certifications. This is pretty funny. The leaked excel sheet with customers of Delve is basically a shortlist of targets for hackers to try now. Not that they necessarily have bad security, but you can play the odds

I am not defending Delve or anything and I hope they get what they deserver but there is no correlation between SOC2 certification and the actual cyber capability of a company. SOC2 and ISO27001 is just compliance and frankly most of it is BS.

It was never about cyber capability. It's a liability transfer framework.

If a service provider has a control that says "we use firewalls on all network access points, and configure those firewalls to CIS benchmark whatever", and a third-party signs off with "yes we checked, they have the firewalls, and they're configured properly", you now have two parties you can sue when a security incident caused by lack of firewalls causes you material damage.

Your org's cyber insurance will also go down if you can say "all our vendors have third-party attested compliance, and we do annual compliance reviews".

Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM

#50

Post by Lucasoato »

_pdp_ wrote: post #21
nope1000 wrote: post #7

> The incident also prompted LiteLLM to make changes to its compliance processes, including shifting from controversial startup Delve to Vanta for compliance certifications. This is pretty funny. The leaked excel sheet with customers of Delve is basically a shortlist of targets for hackers to try now. Not that they necessarily have bad security, but you can play the odds

I am not defending Delve or anything and I hope they get what they deserver but there is no correlation between SOC2 certification and the actual cyber capability of a company. SOC2 and ISO27001 is just compliance and frankly most of it is BS.

I went through SOC2 Type I and II. I’d say that most of that stuff is necessary, like splitting environments and so on. That doesn’t mean it’s anything close to sufficient to avoid being hacked.

It’s a framework to give you the direction, then if employees are careless (or even malicious), no security standard is complete enough to protect a company.

Post reply on HN