Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Story of the SolarWinds Hack

npr.org

Post reply on HN
Print view View original

121–130 of 139 posts

Re: The Story of the SolarWinds Hack

#121

Post by amaccuish »

wglb wrote: post #83
amaccuish wrote: post #37

> But as CrowdStrike's decryption program chewed its way through the zeroes and ones, Meyers' heart sank. The crime scene was a bust. It had been wiped down That's a lot of words to say, we don't know who did it. I had a quick look but couldn't find anything, why are the fingers being pointed at Russia?

There has been considerable coverage of this attribution: https://ciexinc.com/blog/solarwinds-articles/attribution.htm...

The reply from ipsin was much more helpful. This list is mostly full of articles in general about the Solarwinds attack and others including "Supernova malware clues link Chinese threat group Spiral to SolarWinds server hacks (ZDNet)".

Re: The Story of the SolarWinds Hack

#122

Post by dogman144 »

PeterisP wrote: post #9
dogman144 wrote: post #7

Earlier quoted context omitted.

Clandestine I think. Immediate reaction steps to this from CISA were pretty unprecedented; a govt-wide unpluggening on a Sunday night of a specific vendor doesn’t happen a lot.

We can compare and contrast with the effects of NotPetya, which caused widespread obvious economic damage (e.g. Maersk shipping and Merck losses) - due to the number of affected companies, Solarwinds had the potential to be worse, but I'm not sure if you can be more destructive than that without it being obviously visible.

Two different attacks though. One was ransomware run amok, one was targeted supply chain attack to conduct espionage.

Re: The Story of the SolarWinds Hack

#123

Post by dogman144 »

CyberRage wrote: post #51
dogman144 wrote: post #6

Earlier quoted context omitted.

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

You don't get this kind of attack because you had an exposed FTP server. The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal. They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications. The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this m…

Yeah I mean I’ve read the technical FEYE writeups, and yeah once they had a foothold it got fairly f’ing complex (hope those guys don’t end up in my CI/CD ever, yikes).

That said, foothold for this stuff more often than note comes from keys on public GitHub repos (or things like that: simple misses that are enough to throw the door open).

I hear things like “intern” and “totally unrelated” and it’s the dog whistles of policy/policy enforcement failures of these sorts of initial ways in.

So many sexy hacks start from admin123 passwords unfortunately

Re: The Story of the SolarWinds Hack

#124

Post by [deleted] »

tptacek wrote: post #55

Network monitoring software is a key part of the backroom operations we never see. [...] By its very nature, it touches everything — which is why hacking it was genius. This is frustrating to read, since plenty of people did in fact warn that these kinds of systems were easy targets.

[deleted]

Re: The Story of the SolarWinds Hack

#125

Post by PeterisP »

dogman144 wrote: post #122
PeterisP wrote: post #9

Earlier quoted context omitted.

We can compare and contrast with the effects of NotPetya, which caused widespread obvious economic damage (e.g. Maersk shipping and Merck losses) - due to the number of affected companies, Solarwinds had the potential to be worse, but I'm not sure if you can be more destructive than that without it being obviously visible.

Two different attacks though. One was ransomware run amok, one was targeted supply chain attack to conduct espionage.

The attacks have more similarities than differences.

First, to correct a common misconception, NotPetya definitely wasn't ransomware run amok - it was designed to look like the previously popular Petya ransomware, but the actual ransom and decryption key processing mechanism was removed as that wasn't its purpose. It was masquerading as ransomware, but it wasn't ransomware, it just destroys data by encrypting it with a non-recoverable key.

Just as Solarwinds, NotPetya also was a targeted supply chain attack - it was deployed through updates from a previously hacked accounting/tax software company "Intellect Service" to all their customers in Ukraine, which also included many multinational companies which had their finance depts file tax reports in Ukraine; and just as Solarwinds, NotPetya is attributed to Russian government.

The main difference is that, as you say, it seems that Solarwinds was (at least at the stage it was detected) used only for espionage, while NotPetya was designed for pure destruction.

Re: The Story of the SolarWinds Hack

#126

Post by aleister_777 »

thu2111 wrote: post #111
encryptluks2 wrote: post #70

Earlier quoted context omitted.

The SolarWinds hack in addition to election interference should easily be seen as an attack worthy of taking out Putin IMO.

Because the Russia link is so strong? Dude, everything you read about Russia in the American press is garbage. From the article: "They cleaned the crime scene so thoroughly investigators can't prove definitively who was behind it." That's literally in the article but it doesn't stop them writing the whole thing as if it's utterly proven beyond doubt who was behind it.

I was speaking to some Russians at a party yesterday. They lamented at how Russian and American media were mirrors of each other.

Russia uses America as the core of their propaganda just the same as the DNC has been using Russia as their boogoieman since they needed a narrative to apply to Trump.

As someone who formerly worked for Crowdstrike and has performed the APT-29 demo countless times, I will say attribution is bullshit and people frankly have no real data to point fingers.

Re: The Story of the SolarWinds Hack

#127

Post by aleister_777 »

amaccuish wrote: post #37

> But as CrowdStrike's decryption program chewed its way through the zeroes and ones, Meyers' heart sank. The crime scene was a bust. It had been wiped down That's a lot of words to say, we don't know who did it. I had a quick look but couldn't find anything, why are the fingers being pointed at Russia?

I worked for Crowdstrike. We did this hack as our primary demo. Dmitri is on the Atlantic Council along with the rest of the Obama team. There is no more evidence to suggest Russia was involved than there was that Dmitri himself was for political reasons. And Shawn Henry will fire you for saying this out loud.

Re: The Story of the SolarWinds Hack

#128

Post by aleister_777 »

adolph wrote: post #14

How fortuitous is it that a months long investigation can be published right when the US announces sanctions? Great job National Radio! Like razor blades in peanut butter cups , says CrowdStrike.

I worked for Crowdstrike. We did this hack as our primary demo. Dmitri is on the Atlantic Council along with the rest of the Obama team.

There is no more evidence to suggest Russia was involved than there was that Dmitri himself was for political reasons. And Shawn Henry will fire you for saying this out loud.

Re: The Story of the SolarWinds Hack

#129

Post by aleister_777 »

exporectomy wrote: post #5
germinalphrase wrote: post #3

“A ‘Worst Nightmare’ cyberattack” that we all... just take in stride? Either the consequences are themselves clandestine, or cyberattacks aren’t as meaningful as our headlines would indicate.

The worst nightmare of the vice president of security at SolarWinds, not of the average person.

At least 18k+ networks were compromised. I bet average people got caught in that net.

Re: The Story of the SolarWinds Hack

#130

Post by dogman144 »

PeterisP wrote: post #125
dogman144 wrote: post #122

Earlier quoted context omitted.

Two different attacks though. One was ransomware run amok, one was targeted supply chain attack to conduct espionage.

The attacks have more similarities than differences. First, to correct a common misconception, NotPetya definitely wasn't ransomware run amok - it was designed to look like the previously popular Petya ransomware, but the actual ransom and decryption key processing mechanism was removed as that wasn't its purpose. It was masquerading as ransomware, but it wasn't ransomware, it just destroys data by encrypting it with…

Definitely correct in that NP originated a supply chain attack on that vendor in Kiev, I had forgotten and good catch.

NP, as Maersk and co experienced was definitely rware (a variant, sure) run amok however. It’s industry consensus that the attacker either a) didn’t think of the possible Global blast radius or b) thought of the blast radius but didn’t plan for how bad it would get.

In a sense, SW might reflect a more mature approach: consider the network spread, use a different exploit and intent - spyware for espionage vs rware variant for destruction.

That said, very different exploits and intents were used.

Post reply on HN