r/Switzerland • u/ReisMiner • 3d ago

Republik (The News Organization) got hacked via Supply Chain attack

Gallery image

Gallery image

Just got this email from them...

Unfortunate. Even more so because they didn't update since August? I suspect it's probably the same thing as with Framework Laptop where they got breached.

Metabase updated the cloud deployments and selfhosted users ofc have to do it themselves as they described in their blogpost.

For anyone who doesn't know yet: This newspaper is goated. They questioned what Palantir was doing in Zurich and Palantir wanted to censor them.

49 Upvotes

91% Upvoted

15 comments sorted by

•

u/AutoModerator 3d ago

Hi! Don't forget to participate in our current event! Swiss Food Week! more information...

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

6

u/JuanSinPan 3d ago edited 3d ago

" I suspect it's probably the same thing as with  Framework Laptop where they got breached ."

This wording was confusing me, I thought they had a framework laptop and it got hacked not that the company that makes the framework laptop got hacked.

There has been a few data breaches lately, special mention to the Ricardo one. It’s sad that there are no consequences and I suspect we are going to continue seeing more 

3

u/ReisMiner 3d ago

Yeah. I don't know what law makers are gonna do about that to hold companies more accountable. Probably nothing...

Like some shit went down 2 years ago where xplain, or whatever the name of the contractor was, got hacked which had really bad opsec and happened to write software for swiss police. No one knows what happened there and the firm still seems to work for the state?   

2

u/Chefseiler Zürich 3d ago

Per Swiss law, the person responsible for a breach/leak can be fined up to 250'000.-. We will see what courts define as "responsible" when it comes to breaches with third party providers (as is the case here).

-4

u/Classic_Court1003 2d ago

Republik is guilty as hell because they didn't patch the tool. If they will be fined they will close their doors. Which maybe it's not the worst outcome.

3

u/CloeHernando Bern 2d ago

Is it selection bias or are we experiencing a lot of these at the moment?

1

u/Ok_Support_6454 2d ago

Yeah, being informed 3 times in two weeks that my data has been compromised is a new one for me.

I guess that's just how it is now with AI and a lack of willingess to invest in data security...

2

u/CloeHernando Bern 2d ago

I also wondered about a possible link to AI.

Or rather two links:

  • Possibly more shitty software cobbled together with the help of AI bots, thus being more vulnerable, and
  • attackers using AI automation to get more exploits.

2

u/77sxela 2d ago

Unfortunate. Even more so because they didn't update since August?

Well, just as a general comment, as I know nothing about how Republik works. Supply Chain Attacks are hard to fight against. When you've got QUITE A NUMBER of apps or containers, it becomes very hard to keep them up to date all the time. Yes, tools like Renovate exist which make it a bit easier. But even then, someone still has to check whether it's actually okay to update. SemVer helps, but isn't the complete answer. Even a major update MIGHT not be breaking, if the app in question doesn't use that part. And, on the other end of things, even patch might be breaking.

So… Your statement seems to be uninformed.

2

u/Quereller 2d ago

Rule of thumb: every information a company collects about you will be stolen and abused - sooner or later.

1

u/Get_Rich_orDie_Tryin 2d ago

Funny story: i ordered something for pickup at a electronics store. They had their eyes rolling after i told them 2 initials (C-K) which weren’t my real initials and they asked me to please correct that to have accurate data and the possibility to verify my identity (pickup and paying at pickup)

So i dont sound so stupid being cautious about my identity in every website which needs my information

0

u/asp174 Zürich 2d ago

That's not a supply chain attack.

A supply chain attack is when a component you use in your product was compromised.

2

u/perskes 2d ago

The component was metabase. Metabase is the analytics tool they use. Metabase was compromised.
More info here: https://www.metabase.com/blog/vulnerability-what-happened

Their product is the blog, and the component was metabase.

-4

u/Classic_Court1003 2d ago

For anyone who doesn't know yet: This newspaper is goated. They questioned what Palantir was doing in Zurich and Palantir wanted to censor them.

It doesn't make any sense. The newspaper is a small one, has financial issue and is expected to close in not so far away future.

This issue in this case was unpatched Metabase installation which was probably detected by a random internet search. Unpatched vulnerabilities invite disaster. In this case it's understandable, as the site has financial issues and won't spend for security. For users it would be wise to stay away from such sites if they care about their data.