Month: December 2020

Enlarge / Close up of digital data and binary code in network. (credit: Getty Images)

Of the 18,000 organizations that downloaded a backdoored version of software from SolarWinds, the tiniest of slivers—possibly as small as 0.2 percent—received a follow-on hack that used the backdoor to install a second-stage payload. The largest populations receiving stage two were, in order, tech companies, government agencies, and think tanks/NGOs. The vast majority—80 percent—of these 40 chosen ones were located in the US.

These figures were provided in an update from Microsoft President Brad Smith. Smith also shared some insightful and sobering commentary on the significance of this almost unprecedented attack. His numbers are incomplete, since Microsoft sees only what its Windows Defender app detects. Still, Microsoft sees a lot, so any difference with actual numbers is likely a rounding error.

Crème de la crème

SolarWinds is the maker of a nearly ubiquitous network management tool called Orion. A surprisingly large percentage of the world’s enterprise networks run it. Hackers backed by a nation state—two US senators who received private briefings say it was Russia—managed to take over SolarWinds’ software build system and push a security update infused with a backdoor. SolarWinds said about 18,000 users downloaded the malicious update.

Enlarge / Refunds have gone to a whole new level for CD Projekt Red's latest game. (credit: CD Projekt Red / Sam Machkovech)

Cyberpunk 2077's woes on "last-gen" gaming consoles mounted on Thursday with an unprecedented about-face by Sony. Effective immediately, the CD Projekt Red adventure game has been fully delisted from the PlayStation Store, and existing owners have been told to expect refunds for any purchases of the game's digital-download version.

This appears to require no action on the part of the game's owners, according to Sony's Thursday evening statement. Meanwhile, the refund's processing "may vary based on your payment method and financial institution." Ars Technica has confirmed that the game's PS Store listing can no longer be accessed on PS4 or PS5 consoles, while existing owners can still find the game in their digital library interface and play it.

The news follows CD Projekt Red's own admission that the game's performance on base consoles like Xbox One and PlayStation 4 suffered from "bugs and crashes." Therefore, Red encouraged customers to request refunds from both digital and physical retailers—and the company opened an email hotline for anyone who struggled with attempts to get refunds. Sure enough, game owners in both console camps found the default refund process unworkable—and Sony's sweeping action here may point to a requirement on their part to have a refund process be compatible with its terms of service. In other words, if the game is "broken," then Sony may need to acknowledge such issues with a top-to-bottom wipe of the game from PSN to work with CDPR's public refund plan, as opposed to offering selective refunds.