From what I've read so far I haven't been able to gather how Solarwinds could have prevented this? In other words what were the critical failures in their defenses? Or is this kept non-public on purpose?
The Story of the SolarWinds Hack
131–139 of 139 posts
Re: The Story of the SolarWinds Hack
#132Earlier quoted context omitted.
You don't get this kind of attack because you had an exposed FTP server. The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal. They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications. The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this m…
> You don't get this kind of attack because you had an exposed FTP server. Leaking the extremely weak login credentials to your updateserver, trough a public Github repo, is not exactly a glowing endorsement of how serious security seems to have been taken at Solwarwinds. With stuff like that being a thing, who knows where else they cut corners/got lazy. > this makes SolarWinds a prime target, one that is worth the e…
> could still not be bothered to put in some minimum effort to protect themselves.
What would have been the minimum effort that would have protected them?
Re: The Story of the SolarWinds Hack
#133"The tradecraft was phenomenal" Indeed, consider Figure 5 here [1]. A truly diabolical mastermind. But seriously, the article looks like window dressing for common incompetence. [1] https://www.microsoft.com/security/blog/2020/12/18/analyzing...
It seems to me to get the attack going the attackers needed to accomplish 2 things (at least):
1. Get the source-code of SolarWinds.Orion.Core.BusinessLayer.dll so they could know how to modify it
2. Get their modified source OR modified compiled DLL somehow into the build-pipeline at SolarWinds.
If SolarWinds could have prevented either of these two things from happening this attack would not have worked. Am I correct?
Re: The Story of the SolarWinds Hack
#134This is the line that got me: >And so we are fairly broadly deployed software and where we enjoy administrative privileges in customer environments. There is a lot of talk about shoring up security practices by many of the people quoted here. But something that would be hard to admit is that maybe they should not have administrative privileges in customer environments. Maybe they should not install agents on your mac…
> Maybe they should not install agents on your machine
But, is it possible or practical to do network management without "agents" ?
Re: The Story of the SolarWinds Hack
#135Anyone know how the software update was actually compromised in the first place?
This has been a puzzle for a while, and I am not yet satisfied with the answer so far. The closest to an explanation is found here: https://ciexinc.com/blog/solarwinds-articles/initial.html . I feel like this says "well, we are not really sure".
Two things, are they unsure the attack could have worked the way they describe, or are they unsure the attack actually happened that way?
From the viewpoint of the public it would be important to know what made this attack possible, and how to defend against it, even if the actual attack was accomplished some other way.
I guess what I'm asking is, do they know how to repeat this attack?
Re: The Story of the SolarWinds Hack
#136Earlier quoted context omitted.
> You don't get this kind of attack because you had an exposed FTP server. Leaking the extremely weak login credentials to your updateserver, trough a public Github repo, is not exactly a glowing endorsement of how serious security seems to have been taken at Solwarwinds. With stuff like that being a thing, who knows where else they cut corners/got lazy. > this makes SolarWinds a prime target, one that is worth the e…
> could still not be bothered to put in some minimum effort to protect themselves. What would have been the minimum effort that would have protected them?
The minimum effort starts at selecting more secure passwords than "company123".
Re: The Story of the SolarWinds Hack
#137Earlier quoted context omitted.
I think that is a very limited and closed mindset that inherently precludes a lot of first hand source information. something about leading a horse to water I suppose
The first and most important skill needed for the internet to be a net gain for a persons understanding is the ability to quickly develop and modify heuristics to filter out bad data. Filtering good data is fine, the truth repeats itself in many formulations, but believing bad data or even spending too long noticing it is bad and you are worse off than just using a library and books.
Hand waving cliches are not a strong foundation for truth seeking.
Re: The Story of the SolarWinds Hack
#138I‘m quite sure there are a lot of attacks like that. Most of them just never get noticed. The best backdoors are those, which are never found.
Well, usually highly targeted attacks are orchestrated with a reason. You want to leverage your access to perform actions because you got get revealed\blocked even not intentionally. Once you act, let's deploy some ransom, wipe some data, shut down power plants, you will be shown. Keeping a perfectly stealth backdoor for years as environments, software and personal change is extremely difficult.
If you want to stay unnoticed you need to remove the backdoor and all the traces after you are done with what you wanted to do (steal some information, damage something, ...), sure.