huntress

The issue is that Huntress engineers personally have access to trial user data and apparently just...

Services like Huntress (there are many similar) only work by looking at what is happening on the computer.

So it sounds like Huntress has full and complete access to whoever downloads their software to try it out/demo it...

The threat actor was probably an adversary to existing huntress customers and the EDR probably reacted to his tooling and mistakes.

This makes sense, but in this case, isn't the company behind Huntress having direct access to this data still a problem?

I would love to get Abnormal or Huntress SAT, but I just don’t have the numbers to justify it.

I appreciate that Huntress shared their insights with the community and hope that they and others won't be discouraged from the unfortunate flaming.

Some random person downloaded Huntress to try it out.

In practice trusting Huntress isn't too different than trusting NPM with an engineer that has root access to their machine or any kind of centralized IT provisioning/patching setup.

Like, was this user really that distracted or inept to forget he installed a Huntress trial, or was this all for some larger, more insidious reason, or distraction?

I notice that you only have three comments ever, and they all seem to be defending how EDR software and Huntress works without engaging with this specific instance.

I'm usually on the other side of these things but here I think most of the actual (some might be artificial...) outrage and concern come from a misunderstanding of the product and services Huntress are selling and how their EDR product is packaged and sold.

"Hey everyone here, it's Huntress showing how <company> made the blunder of giving us access to their systems, so we did a little surprise finance audit of them!"

An advertorial like this can often save the "And that's why Our Product is so great, it can protect you from attacks like these!" for the end, but here, where the article is about how merely installing their product gives Huntress the company full access to everything you do, it leaves me with more questions than answers.

I doubt that Huntress could make the claim that their customer here was clearly told that they would be possibly monitoring their activity in the same way that a "Content to Monitoring" popup for every login on corporate machines does it.

If folks understood this better, there would be less reason for software like Huntress' EDR to exist.

This lands the same week as the ClawJacked vulnerability (Oasis) and the malware-laced installer campaign (Huntress).

Huntress is basically an outsourced portion of the IT department for smaller companies that don't have their own 24/7 security team.