Page 1 of 2
Security incident response teams are still working to determine the scope of the massive data breach at Adobe Systems, and while the breach impacted millions of customers, experts say the source code leak associated with the incident could have even more dangerous repercussions to businesses and individuals.
Adobe said it is still investigating the extent of its source code leak. The source code serves as the underlying commands in the Adobe programs, and while attackers will hunt for zero-days, there's no reason why a sophisticated attacker couldn't put a backdoor into all the software, said Thomas Kellermann, vice president of cybersecurity at Trend Micro. Kellermann, a prominent security expert who served on The Commission on Cyber Security for the 44th Presidency, called the source code leak "highly significant."
"Adobe's own brand is being used against it at this point," Kellermann said. "Instead of just building munitions, they are robbing the weapons plants; you could weaponize electronic legal forms and other electronic paperwork and basically insert a backdoor into any system you wanted and people will trust that document."
[Related: Verizon Data Breach Report Finds Employees At Core Of Most Attacks ]
IT teams typically don't have a mature enough security team to create ways to make hacking into systems cost prohibitive, Kellermann said. Most businesses take an outdated approach to security by continually attempting to strengthen the perimeter, but hackers are already inside, Kellermann said.
"At this point, we're all dealing with an adversary that is in your house," Kellermann said. "We have to think about combining long-term defense-in-depth strategies with ways to create more of a prism in your environment instead of creating a fortress."
It's not the first time Adobe has had to deal with a security incident. Last November, the software maker acknowledged a breach of its customer website, forcing it to reset the passwords of thousands of users. The company isn't alone with its source code leak. VMware has had to deal with potential fallout from the exposure of its ESX server source code. Security firm Symantec was forced by a hacktivist group to acknowledge a 2006 breach, leaking the source code to some of its products, including an older version of its Norton enterprise software. The firm declined CRN's Friday request for comment on this story, but in previous interviews, the security vendor indicated it has added safeguards, issued software updates and end-of-lifed outdated versions of its software.
