@drwhax I think the biggest lesson here is that Blue Team can't rely on patching to keep everything safe.

We have to actually do the rest of the stuff that security calls for, and not just keep everything patched but do more to minimize the risks when one of these unsleeping tools gets turned on us.

And so many companies don't even have a proper inventory of what-all needs to be kept up to date.

This is going to suck so much.

@DaveMWilburn @sundogplanets they've admitted to a risk that could cause material harm to people engaged in a normal activity (and suggests that it could damage expensive scientific instruments as well)

Regardless of explicit laws on the particular topic that might expose them to civil suits that could get expensive.

And that could be the case even if they hadn't admitted to it.