Press

Weaver is a network-security expert at the International Computer Science Institute, a research center in Berkeley, California. Together with other researchers, he helped pinpoint the targets of the attack: two GitHub-hosted projects connected to GreatFire.org, a China-based anti-censorship organization.

The spread of this information raises questions about how securely it is handled and whether it is vulnerable to hacking, said Serge Egelman, a computer security and privacy researcher affiliated with the University of California, Berkeley. “There are really no consequences” for companies that don’t protect the data, he said, “other than bad press that gets forgotten about.”

“Their reputation is warranted and they are very good. They have worked for both parties for years now,” said Nicholas Weaver, a computer security expert at the University of California, Berkeley. “Criticism of CrowdStrike's job in both cases is unfair. They are an incident response team: You bring them in AFTER the manure has hit the 3 MW wind turbine. So it is unfair to complain about a mess,” Weaver said in an email.

Nicholas Weaver, a researcher at the International Computer Science Institute and lecturer at UC Berkeley, said the API should have validated that the account making the request had permission to read the data requested.“It seems like the only access control they had in place was that you were logged in at all. And if you can access other peoples’ data because they aren’t enforcing access controls on reading that data, it’s catastrophically bad and I’m willing to bet they’re not enforcing controls on writing to that data as well.”