I guess nobody gets pwned by high school kids just screwing around anymore. Every hack is now the "most sophisticated ever" by the "most technologically advanced state actor ever" to break the "most secure six-character password ever."
SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
11–20 of 294 posts
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#12I thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?
See it like stealing from a museum: very easy to break in (weak password -> breaking a window), hard to get out of here with all the paintings unnoticed - and that, on a daily basis.
The amount of effort and different techniques they've put in to remain undetected for months (years?) while infecting a lot of actors is pretty impressive.
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#13I thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?
There had been a weak password on the update server in the past. The compromised update however was introduced via the build system before being signed and distributed
https://www.sec.gov/Archives/edgar/data/0001739942/000162828...
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#14Convince me it’s more sophisticated than Stuxnet.
It's not a zero sum game. It is interesting in that it marks the first _wide spread_ attack on a supply chain via cyber space. The malware's DNS signaling protocol is pretty neat, which you can look at here: https://www.fireeye.com/blog/threat-research/2020/12/sunburs...
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#15I find it curious that they would quote an executive on this. I doubt any of them have gotten their hands dirty on real code in years. Microsoft alone employs thousands of people more qualified to speak on the subject.
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#16Convince me it’s more sophisticated than Stuxnet.
Agreed. It's amazing how they managed to infect air gapped computers. How do you even test something like that before the actual attack.
Most people know which countries developed stuxnet and used compromised human agents to place the infected drives into the target system.
The sophistication of the malware required state powers and assistance of the industrial company that manufactured the control systems. Those systems are not cheap and reverse engineering the control system software required detailed knowledge of the embedded hardware and software.
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#17I thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?
The whole weak password thing was simply a funnily timed thing some guy found. It had absolutely nothing to do with the malicious update, which was the source of this supply chain attack. For some reason a bunch of people online decided that two things happening around the same time means they are related. They are not
Ah ok. So the password was just an easy to understand sideshow. Thank you.
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#18I thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?
[deleted]
Re: SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
#19The SolarWinds incident was detect because of bad opsec by the operators who performed the FireEye op. I would image the capability was developed by an expert group in some intelligence agency, and then used as an entry point by a different operator group with lower standards.
But who is to day there aren't more of this kinds of attacks out there, just no one has made a foolish error using them yet? If we assume that, we have to assume this operation was somewhere in the middle of a normal curve of complexity, and there are even more sophisticated backdoored systems like that we just don't know about.
Imagine any medium-large code base (100+ of KLoCs), that is deployed widely, and has an auto update mechanism. Most companies don't have very strict access to the build process (and even if they do, all you need is to corrupt one employee), so it shouldn't be to hard to patch binaries before they are signed (especially bytecode in .NET and Java) , and add another URL and/or signature for verification (for sig only the attacker needs access to the web site/CDN too).
The change will be only a few lines, so is very hard to detect automatically - it will look like regular code for tools.