The Story of the SolarWinds Hack • Hacker News Board

Re: The Story of the SolarWinds Hack

#51

Post by CyberRage » Sat, Apr 17, 2021, 5:02 PM UTC

dogman144 wrote: post #6

1cvmask wrote: post #4

It’s nice how they equivocate over the ease of entry and their security policies: There was another unsettling report about passwords. A security researcher in Bangalore, India, named Vinoth Kumar told NPR that he had found the password to a server with SolarWinds apps and tools on a public message board and the password was: "solarwinds123." Kumar said he sent a message to SolarWinds in November and got an automated…

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

You don't get this kind of attack because you had an exposed FTP server.

The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal.

They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications.

The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this makes SolarWinds a prime target, one that is worth the efforts taken in this case.

Re: The Story of the SolarWinds Hack

#52

Post by rjzzleep » Sat, Apr 17, 2021, 5:03 PM UTC

ridaj wrote: post #27

dogman144 wrote: post #6

Earlier quoted context omitted.

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

I don't think they ignored it? Says it was addressed. I think it was OK to dispel the implication that the elaborate supply chain attack was allowed in the first place by sloppy pw practices. You don't want that to be the takeaway and then other companies thinking, well our pw management practice is really good so we don't have to worry about being a victim so much

They did ignore it. I think it was over a year actually. I don't feel like looking it up right now but it was also discussed in another submission. Whatever the actual number was it was VERY long.

Re: The Story of the SolarWinds Hack

#53

Post by seereadhack » Sat, Apr 17, 2021, 5:31 PM UTC

How might you compartmentalize admin access the whole way down the stack at the enterprise level? What if you were to start from scratch?

Re: The Story of the SolarWinds Hack

#54

Post by trashcan » Sat, Apr 17, 2021, 5:38 PM UTC

matwood wrote: post #46

de6u99er wrote: post #42

Anyone know how the software update was actually compromised in the first place?

The wiki page on the attack speculates an Office360 account was hacked. Presumably it was an account from an admin, and from there I could see them probing until finding credentials for the build system.

No idea if it is related, but a SAML implementation security issue was disclosed the same (or very close) day that the SolarWinds attack became public knowledge. Maybe that gave them access to the admin account?

Re: The Story of the SolarWinds Hack

#55

Post by tptacek » Sat, Apr 17, 2021, 5:39 PM UTC

Network monitoring software is a key part of the backroom operations we never see. [...] By its very nature, it touches everything — which is why hacking it was genius.

This is frustrating to read, since plenty of people did in fact warn that these kinds of systems were easy targets.

Re: The Story of the SolarWinds Hack

#56

Post by boomboomsubban » Sat, Apr 17, 2021, 5:42 PM UTC

CyberRage wrote: post #51

dogman144 wrote: post #6

Earlier quoted context omitted.

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

You don't get this kind of attack because you had an exposed FTP server. The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal. They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications. The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this m…

>You don't get this kind of attack because you had an exposed FTP server

This kind of attack needs an entry point, and an exposed FTP server provides the potential for one. Whether it actually was the entry point is a separate matter, willfully ignoring one unlocked door means there's likely to be others.

Re: The Story of the SolarWinds Hack

#57

Post by tkinom » Sat, Apr 17, 2021, 5:44 PM UTC

makomk wrote: post #24

andix wrote: post #21

I‘m quite sure there are a lot of attacks like that. Most of them just never get noticed. The best backdoors are those, which are never found.

Like, say, that backdoor someone wrote an article about recently which ran from RAM and had a sophisticated self-destruct mechanism that erased all traces if anyone tried to dump its memory? I wonder how many companies had exploits like that which they either didn't notice or didn't have the sophistication to actually catch and dump.

There are defences for this: If one controls/monitors for every app in system for network access, as soon as any unusually network access are triggered, it is investigated and block.

In my home windows setup, only windows defender, firefox and chrome are allowed out going internet access in regular base. Everything else are blocked.

Windows update are only allowed when I in the mood for it (~once a year). Anyone can do this easily by control srvhost.exe 's internet access with windows firewall app.

Re: The Story of the SolarWinds Hack

#58

Post by lanstin » Sat, Apr 17, 2021, 6:47 PM UTC

meowface wrote: post #49

SV_BubbleTime wrote: post #34

Earlier quoted context omitted.

> By design, the hack appeared to work only under very specific circumstances. Its victims had to download the tainted update and then actually deploy it. That was the first condition. The second was that their compromised networks needed to be connected to the Internet, so the hackers could communicate with their servers. Yea, wow, thanks NPR. Hard hitting stuff right there. Those are “very specific circumstances” t…

That's a perfectly valid paragraph. In a decent environment, outbound internet access should be restricted to only the hosts / networks / ports that require it. Especially for server environments. Many servers running the backdoored Orion probably tried to beacon but failed for that reason. (And I'd assume the backdoor would probably first verify outbound internet access so that the failed beacon doesn't generate a f…

I whitelist my networks (by port and host name, At least until TLS 1.3 removes the visible SNI) and my top denies list is very interesting. They have access to bits and pieces of the internet (especially PyPi damn you runtime downloads) and all connections to an allowed port will succeed (they will just be closed after the SNI or IP check fails).

Nonetheless the article was correct the hack did not need bizarre or rare circumstances to take effect.

Re: The Story of the SolarWinds Hack

#59

Post by lanstin » Sat, Apr 17, 2021, 6:57 PM UTC

arminiusreturns wrote: post #33

matkoniecz wrote: post #32

Earlier quoted context omitted.

> hand-hold on an important topic I assume that things available only as youtube video, unavailable in a text form are unimportant. (not all things in text form are important, but it is a nice filter that basically always works)

I think that is a very limited and closed mindset that inherently precludes a lot of first hand source information. something about leading a horse to water I suppose

The first and most important skill needed for the internet to be a net gain for a persons understanding is the ability to quickly develop and modify heuristics to filter out bad data. Filtering good data is fine, the truth repeats itself in many formulations, but believing bad data or even spending too long noticing it is bad and you are worse off than just using a library and books.

Re: The Story of the SolarWinds Hack

#60

Post by CyberRage » Sat, Apr 17, 2021, 7:00 PM UTC

boomboomsubban wrote: post #56

CyberRage wrote: post #51

Earlier quoted context omitted.

You don't get this kind of attack because you had an exposed FTP server. The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal. They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications. The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this m…

>You don't get this kind of attack because you had an exposed FTP server This kind of attack needs an entry point, and an exposed FTP server provides the potential for one. Whether it actually was the entry point is a separate matter, willfully ignoring one unlocked door means there's likely to be others.

Initial access is part of the day-to-day these days.

you can't cover all entry points, it's a matter of time for someone to make a mistake. the fact that the adversary showed these extreme levels of proficiency and dedication tells me that the vast majority of companies would have fallen for that. In fact, the backdoor was running for months on targets like Microsoft, gov agencies, security companies like Malwarebytes.

These companies know a thing or two about security.

Today we work with "assume breach" mentality that assumes you are already compromised.