Via Securosis, check out Krebs’ (seriously, I don’t have a bromance, he’s just the best security journalist out there…) article on CloudFlare’s CEO’s email hack from the other week. Check CloudFlare’s blog for an image of the visual timeline of the incident. Talk about involved!

Some web filters will flag that image location as bad, but the barely-readable preview was enough for me. Hopefully that link persists. If not, right-click the image and try to view it directly.

What’s fun is the CEO wasn’t the target, nor was CloudFlare. Apparently, the target was a client of CloudFlare’s, from what I gather. Bottomline, an attack can come from anywhere and try to get anywhere else. It’s not just targeted stuff that’s all about you, or APT that cares about you. Maybe you’re just peripheral to other goals, either as a company or as employees at a company. I hear a lot of talk about threat modeling and such, and that’s fine, but do threat models pick up things like this any better than general best practices, diligence, and education? Not sure, there.