The Story of the SolarWinds Hack • Hacker News Board

Re: The Story of the SolarWinds Hack

#11

Post by trynton » Sat, Apr 17, 2021, 1:35 PM UTC

cyberlab wrote: post #2

> The routine update, it turns out, is no longer so routine Is there the rare case that we shouldn't update because the update could contain a malicious payload? If the update gets served over plaintext HTTP I would treat it as suspicious and may even block it from connecting at all. I run the risk of having outdated software, but that can be addressed by storing the software in a machine that's not connected to The…

@cyberlab: “Is there the rare case that we shouldn't update because the update could contain a malicious payload?”

You don't ever update your security “computers” from some third-party outsourcer. What you do is have your own people constantly probing their own systems for potential vulnerability and patching it themselves.

* jeez ..SolarWinds run their stuff on FTP and "active directory". It's got to be a joke.

* “computers” .. not allowed to use the 'W' word ;]

Re: The Story of the SolarWinds Hack

#12

Post by netfortius » Sat, Apr 17, 2021, 1:37 PM UTC

This article is a case of [a lot of] Monday morning quarterback[s]. Except for Mandia, I wouldn't allow any other exec(s) to speak about this, publicly, as to the why and how. Side note: I bet Bejtlich wishes he was still in that team ;-)

Re: The Story of the SolarWinds Hack

#13

Post by [deleted] » Sat, Apr 17, 2021, 1:41 PM UTC

cyberlab wrote: post #2

> The routine update, it turns out, is no longer so routine Is there the rare case that we shouldn't update because the update could contain a malicious payload? If the update gets served over plaintext HTTP I would treat it as suspicious and may even block it from connecting at all. I run the risk of having outdated software, but that can be addressed by storing the software in a machine that's not connected to The…

[deleted]

Re: The Story of the SolarWinds Hack

#14

Post by adolph » Sat, Apr 17, 2021, 1:42 PM UTC

How fortuitous is it that a months long investigation can be published right when the US announces sanctions? Great job National Radio!

Like razor blades in peanut butter cups, says CrowdStrike.

Re: The Story of the SolarWinds Hack

#15

Post by covidthrow » Sat, Apr 17, 2021, 2:01 PM UTC

adolph wrote: post #14

How fortuitous is it that a months long investigation can be published right when the US announces sanctions? Great job National Radio! Like razor blades in peanut butter cups , says CrowdStrike.

I fear that you're being downvoted for pointing out the even bigger threat of our national media's exceedingly more dangerous acts of propaganda, presumably because readers either don't recognize it or are wilfully blind to it because it reflects their own biases.

The SolarWinds hack was a devastating attack on our sovereignty.

And so is the other.

Re: The Story of the SolarWinds Hack

#16

Post by arminiusreturns » Sat, Apr 17, 2021, 2:06 PM UTC

Let me introduce you to PTECH and see if you still think Solarwinds was worse. Warning, a conspiracy rabbit hole lies this way, proceed with caution, lest your view of the world be challenged.

A start: https://www.youtube.com/watch?v=UuZRMpt_Tas&t=195

Re: The Story of the SolarWinds Hack

#17

Post by covidthrow » Sat, Apr 17, 2021, 2:10 PM UTC

cyberlab wrote: post #2

> The routine update, it turns out, is no longer so routine Is there the rare case that we shouldn't update because the update could contain a malicious payload? If the update gets served over plaintext HTTP I would treat it as suspicious and may even block it from connecting at all. I run the risk of having outdated software, but that can be addressed by storing the software in a machine that's not connected to The…

Plaintext transport doesn't matter if at least one part of the payload chain is cryptographically protected/verified.

If you have a machine that's air-gapped and its only IO is strictly humans (read: keyboard/screen, not USB or other electronic means) then your weak point is the human, so center your security around that. You can look at security of lottery machines to get a good idea how that's handled.

But if you're updating the machine with updates, then it doesn't really fit that criteria, soooo....

Re: The Story of the SolarWinds Hack

#18

Post by germinalphrase » Sat, Apr 17, 2021, 2:19 PM UTC

PeterisP wrote: post #9

dogman144 wrote: post #7

Earlier quoted context omitted.

Clandestine I think. Immediate reaction steps to this from CISA were pretty unprecedented; a govt-wide unpluggening on a Sunday night of a specific vendor doesn’t happen a lot.

We can compare and contrast with the effects of NotPetya, which caused widespread obvious economic damage (e.g. Maersk shipping and Merck losses) - due to the number of affected companies, Solarwinds had the potential to be worse, but I'm not sure if you can be more destructive than that without it being obviously visible.

Perhaps the damage is just not visible yet. The sand has not been tossed in the gear box. The blue prints have not been built. Maybe it’s a precursor event to a longer decline.

Re: The Story of the SolarWinds Hack

#19

Post by frombody » Sat, Apr 17, 2021, 2:21 PM UTC

1cvmask wrote: post #4

It’s nice how they equivocate over the ease of entry and their security policies: There was another unsettling report about passwords. A security researcher in Bangalore, India, named Vinoth Kumar told NPR that he had found the password to a server with SolarWinds apps and tools on a public message board and the password was: "solarwinds123." Kumar said he sent a message to SolarWinds in November and got an automated…

The password was in a file that was committed to github IIRC.

I think both the intern that posted the file and the person making that statement both did not realize that someone had given the user write access.. which in my opinion was the actual mistake, not the ftp or the password.

Re: The Story of the SolarWinds Hack

#20

Post by ta9999 » Sat, Apr 17, 2021, 2:35 PM UTC

frombody wrote: post #19

1cvmask wrote: post #4

It’s nice how they equivocate over the ease of entry and their security policies: There was another unsettling report about passwords. A security researcher in Bangalore, India, named Vinoth Kumar told NPR that he had found the password to a server with SolarWinds apps and tools on a public message board and the password was: "solarwinds123." Kumar said he sent a message to SolarWinds in November and got an automated…

The password was in a file that was committed to github IIRC. I think both the intern that posted the file and the person making that statement both did not realize that someone had given the user write access.. which in my opinion was the actual mistake, not the ftp or the password.

Something to remember is that these sorts of things happen in many organizations.

You should always verify the data you get, be careful with complex supply chains, and avoid binaries you didn't build yourself. Don't skip these things just because "that's the way it's always been done." 10 years ago very little internet traffic was encrypted, security still means progress not the status quo.