Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analyzing the compromised DLL file that started the Solorigate attack

microsoft.com

Post reply on HN
Print view View original

121–130 of 149 posts

Re: Analyzing the compromised DLL file that started the Solorigate attack

#121

Post by netsharc »

macNchz wrote: post #17
bob1029 wrote: post #4

I am curious how this code actually made it in, based upon the following: > The fact that the compromised file is digitally signed suggests the attackers were able to access the company’s software development or distribution pipeline. Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Unless this a compromise of the build machine, i…

Code review and protected master are certainly important but not infallible. If I were a malware author with code running on an owned dev machine and my goal was to sneak code into a repo, I can think of a bunch of strategies that might increase the odds of slipping past a review. Just running in the background, waiting to amend a big commit with many changed files/lines would probably go a long way. How often does a…

As many are saying here, why commit the malware, just modify Jenkins to detect that it's compiling this DLL and add those lines into the source about to be compiled..

Re: Analyzing the compromised DLL file that started the Solorigate attack

#122

Post by yenwel »

maccard wrote: post #107
bob1029 wrote: post #4

I am curious how this code actually made it in, based upon the following: > The fact that the compromised file is digitally signed suggests the attackers were able to access the company’s software development or distribution pipeline. Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Unless this a compromise of the build machine, i…

I've said this before, but I work on a team of 5 or 6 people. If I (pre covid) sent them a PR and walked over to their desk, told them it was super urgent and a tiny change just needed a rubber stamp, one of them would do it (and I would likely do the same for them). Failing that I can name a handful of developers that wouldn't be familiar with the system but will review my change because I did the same for them a fe…

I've worked at a mediacorp in user authentication team where one rogue junior developer from another team (with the most seniority though at that company subdividion because everybody else left) went behind my back to pressure my junior colleague to merge a pr in our codebase which opened a security hole in the back end because he was working together with a project lead who promised to deliver something that we couldn't.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#124

Post by vmception »

eternalny1 wrote: post #20

Interesting tidbit at the bottom ... > In an interesting turn of events, the investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor.

Is anyone ever pissed that one exploit getting caught reveals other hacker’s efforts?

Like how that amateurish but high profile Wannacry attack revealed a much more lucrative Monero mining botnet that was running with the same exploit for weeks longer, but some script kiddie ruined it

Re: Analyzing the compromised DLL file that started the Solorigate attack

#125

Post by e12e »

danielovichdk wrote: post #67
efdee wrote: post #37

Earlier quoted context omitted.

This comment, along with the original comment of the same person, is laughable at best and downright Russian astroturfing in a less favorable reading. Obviously, Russia has a policy to support whatever the US is angry about (SciHub, Snowden, ...). To paint these as altruistic is just silly - there is no chance on earth they would support Snowden if his leaks were about Russia rather than about the US. To paint the So…

On a side note. I Wonder why Snowden chose Russia as his safe haven, thinking about the politics and rulings the country is known for. Have Snowden ever told why he chose Russia?

> [Snowden] had been on his way from Hong Kong via Russia and Cuba to what he hoped would be sanctuary in Ecuador when the US cancelled his passport, leaving him stranded in Russia.

https://www.theguardian.com/us-news/ng-interactive/2019/sep/...

Re: Analyzing the compromised DLL file that started the Solorigate attack

#126

Post by e12e »

cogs wrote: post #49
DethNinja wrote: post #18

Earlier quoted context omitted.

I assume huge percentage of this site is IT professionals and software engineers. I’ll have to ask then, what proof is there that Russia did this hack? Do you realise how hard it is to track professional hackers? You will have to trace the entire network commands up to a source and hope that it is registered under their name. I genuinely cannot believe people here think that government managed to find the source of t…

Attribution is not from tracing connections or domain ownership, it's from looking at the coding style, the "Tactics, Techniques and Procedures" and the choice of targets.

Might still be backed by old fashioned humint - maybe an asset in Russia told someone. If so, that might be trustworthy, but also needed to be kept secret. If I needed to publicize and justify such information, I might try to claim that "the coding of the exploit was consistent with Russian trade craft" or something like that...

Re: Analyzing the compromised DLL file that started the Solorigate attack

#127

Post by e12e »

coolgod wrote: post #86
cogs wrote: post #49

Earlier quoted context omitted.

Attribution is not from tracing connections or domain ownership, it's from looking at the coding style, the "Tactics, Techniques and Procedures" and the choice of targets.

That's just fancy technical terms to justify the propaganda. If these kinds of "hard proof" which definitively link hacks to nation state actors exist, why are they never publically revealed?

> why are they never publically revealed?

To protect the source(s)?

Re: Analyzing the compromised DLL file that started the Solorigate attack

#128

Post by marcosdumay »

breck wrote: post #15
ipython wrote: post #12

Earlier quoted context omitted.

So you're saying that Russia's interests are entirely altrustic? That's quite a stretch. I don't think they hacked SolarWinds to "prove how insecure closed source, proprietary software is". Why don't they prove how "insecure" Kaspersky AV is, in that case? Seems strange to pick a software package that nobody's heard of, but happens to be used by thousands of juicy industrial espionage targets of their primary politic…

I have no idea what Russia's interests are. I'm just genuinely curious and in the dark. I've never been to the country and grew up in the West during the Cold War, so when I think of Russia I was indoctrinated to think of "the bad guys". The country is an enigma to me—very good at math but from what I read a corrupt place with rule by power and not law. So yeah, I'm just genuinely asking, how are they the ones doing…

Hum... Most of it seems sarcastic, but a simple antagonistic view towards the US explains a lot:

> protecting a whistleblower against government overreach

Becomes protecting an enemy of their enemy, and one that commands a high press influence.

> pointing out how fundamentally insecure closed source, proprietary software

Becomes just exploiting the enemy infrastructure.

The one thing that I'm not comfortable with a simple explanation of "the Russian government doesn't like the US" is their support of SciHub. It can explain the support quite well, but it is not the only simple explanation available, so there may be other reasons.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#129

Post by nhoughto »

richardjennings wrote: post #117

"Finally, the backdoor composes a JSON document into which it adds the unique user ID described earlier, a session ID, and a set of other non-relevant data fields. It then sends this JSON document to the C2 server." Is there any further explanation of how this was achieved? One might expect as "par for the course" that all external connections be blocked aside from explicitly designated ranges. I would expect that an…

I was wondering the same, if the compromise is of the Orion product which presumably isn't just sitting there with open access to the internet? Like this doesn't seem to be a very broad exploit that could start on a machine with outside world access (like a Windows exploit itself) and then pivot into more sensitive areas.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#130

Post by ashleyn »

eternalny1 wrote: post #21
bob1029 wrote: post #4

I am curious how this code actually made it in, based upon the following: > The fact that the compromised file is digitally signed suggests the attackers were able to access the company’s software development or distribution pipeline. Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Unless this a compromise of the build machine, i…

They are claiming that their build system was compromised and the code was not under source control. > Based on our investigations to date, which are ongoing, we believe that the vulnerability was inserted within the Orion Platform products and existed in updates released between March and June 2020 (what we call the “relevant period”) as a result of a compromise of the Orion software build system and was not present…

In my experience and where I work, the build system tends to be the most neglected part of the pipeline, most trouble-prone and frequently the source of headaches nobody wants to bother with. I think the days of build being the red-headed stepchild nobody wants to deal with is coming to an abrupt end.
Post reply on HN