.
@jonoberheide and
@dugsong on uncovering the SolarWinds breach in 2019:
"One of the most significant breaches in history: a supposedly Russian state actor broke into SolarWinds, backdoored their product, and then all of these SolarWinds deployments across the federal government and enterprises had a backdoor into those networks.
They also were going after security companies. They had compromised Mandiant.
While the attackers were trying to move laterally, they logged into an account that was protected with Duo, which set off some red flags within Mandiant.
Mandiant ended up catching that intruder, tracing it back to the SolarWinds software, discovering that SolarWinds was backdoored, and then exposed this worldwide compromise.
You could report fraud in the Duo app. If it wasn't you logging in, it's like, 'No, that's not me.'
Your entire user base has basically been deputized as security monitors for your organization. See something, say something.
That's what happened."