Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analyzing the compromised DLL file that started the Solorigate attack

microsoft.com

Post reply on HN
Print view View original

141–149 of 149 posts

Re: Analyzing the compromised DLL file that started the Solorigate attack

#141

Post by maccard »

yenwel wrote: post #122
maccard wrote: post #107

Earlier quoted context omitted.

I've said this before, but I work on a team of 5 or 6 people. If I (pre covid) sent them a PR and walked over to their desk, told them it was super urgent and a tiny change just needed a rubber stamp, one of them would do it (and I would likely do the same for them). Failing that I can name a handful of developers that wouldn't be familiar with the system but will review my change because I did the same for them a fe…

I've worked at a mediacorp in user authentication team where one rogue junior developer from another team (with the most seniority though at that company subdividion because everybody else left) went behind my back to pressure my junior colleague to merge a pr in our codebase which opened a security hole in the back end because he was working together with a project lead who promised to deliver something that we coul…

Exactly. Even if it didn't have a security issue, one developer going to a trusted dev on another team and saying "hey, it's the week before Christmas/9pm on a Friday night, nobody else is here, I really need this merge, it's low risk and can go out in the next rollout but QA need to check it this weekend/I'm off next week/" will often result in a thumbs up.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#142

Post by TheOperator »

jeffbee wrote: post #95
robocat wrote: post #54

Earlier quoted context omitted.

Google banned Windows machines from their workforce a decade ago (due to getting hacked by the Chinese). Has Google relaxed that ban in any way? I.e. does Google believe that Windows 10 is now secure? What other major corporations or government departments have followed Google’s example since 2010?

I think "banned" is an overstatement. There were/are people obligated to use Windows because they need professional EDA tools and suchlike software only available for that platform. And although it's by no means my speciality -- I'm a distributed systems developer, not a Windows sysop -- I was told a few years ago that the general belief was that Windows had the most sound security story of all the operating systems…

NTFS was a file system built from the ground up for security compliance. Microsoft since about Windows XP SP2 has been taking security increasingly seriously, and they were willing to break a lot of software to enforce UAC in the Vista days and got nothing but hate for it.

Still regarding this specific hack the exploit was hidden in Orion's telemetry, showing that Microsoft's new love of telemetry isn't just privacy invading it's security degrading.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#143

Post by TheOperator »

breck wrote: post #8

Anyone else find it ironic that the country that is responsible for democratizing access to scientific research (via support of SciHub), the country protecting a whistleblower against government overreach (Snowden), the country pointing out how fundamentally insecure closed source, proprietary software is (SolarWinds), is...Russia? How did we get here?

I feel this is tongue in cheek but at the same time I've personally benefited from 2/3 of these already. I find that very interesting that I'm benefiting from the shit stirring that Russia is doing.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#144

Post by [deleted] »

dboreham wrote: post #114
saagarjha wrote: post #103

Earlier quoted context omitted.

I mean, not even that. The cost to buy a software engineer and get them hired at the place you want to attack is really not that high. Once inside it’s generally possible to get things in (“the guild server was failing so I SSHed in and fixed it”).

Whispers for decades that NSA does this.

[deleted]

Re: Analyzing the compromised DLL file that started the Solorigate attack

#145

Post by loufe »

tester756 wrote: post #90
krapp wrote: post #88

Earlier quoted context omitted.

it's been a common way to refer to a scandal since Watergate[0]. Don't know if that's actually the case here though. [0] https://en.wikipedia.org/wiki/Watergate_scandal

but why? why cannot it just be "solarwinds hack"

It's a tad conspiratorial, but I suspect there was a concerted effort by media to muddy down the impacts of future watergate-level scandals by highlighting a lot of minor "gates". Already I feel tempted to roll my eyes each time I see another HN post about X-gate, seeing many "weaker" stories using the same nomenclature certainly steals power away from the stories that hit hard.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#146

Post by BuildTheRobots »

Osiris wrote: post #75
Osiris wrote: post #72

Earlier quoted context omitted.

An article I read said that they did provide hashes but they also provided instructions on how to install it anyway if the hashes didn't match.

https://mobile.twitter.com/KyleHanslovan/status/133841999966...

How is this possibly acceptable? We've given people verifiable proof that this binary is not the one we created, yet users should crack on and install it anyway?

Re: Analyzing the compromised DLL file that started the Solorigate attack

#147

Post by peter_d_sherman »

Observation: "avsvmcloud.com" -- seems to be the one constant around which a whole bunch of other things, which are variables revolve... (oh sure, "appsync-api" also appears to be a constant -- but it exists at a far less important place in the URL).

"avsvmcloud.com" is far, far more important -- because ALL of the communications go there...

Now, it may be that "avsvmcloud.com" is a legitimate ISP, hosting provider or what-have-you...

But, if I were an investigator on this case, I know I'd want to track each and every place that these requests flow through whoever owns the "avsvmcloud.com" network...

I'd start with the idea that because a subdomain is being used, that the first thing that happens is that subdomains must be resolved by a DNS subdomain servers... so where exactly on whoever owns the "avsvmcloud.com" network, does that happen?

I'd even go so far as to audit, completely dissasemble, the DNS software that is running on those servers... Give it to as many security researchers as possible... What does it do? Where does it point to? What's on the other end of those IP addresses that it resolves to? Are there any anomalies in that IP address resolution? Specifically, when/where and how do they manifest? Are there any patterns there? Who owns the machines on the other side of those IP addresses?

Etc., etc.

In fact...

What would happen if someone were to run a machine learning algorithm on say a, let's be polite and call it a "challenged" DNS resolver?

Would it find some DNS resolution anomalies?

In fact, if I were an investigator, I'd go as far as to audit the whole chain of DNS resolvers / the DNS resolution process THOROUGHLY...

Re: Analyzing the compromised DLL file that started the Solorigate attack

#148

Post by jjk166 »

_kbh_ wrote: post #136
jjk166 wrote: post #112

Earlier quoted context omitted.

> In terms of what the media says: typically, they report on off-the-record remarks from officials and leaks. That's just how the game is played. This isn't how the game is supposed to be played and is a symptom of the erosion of the media's journalistic integrity. Anonymous sources can tell you where the bodies are buried, but you still need to dig up the bodies. One would think if you're going through all the troub…

And herein lies the problem, anyone who actually knows who it is, is not going to tell you how they know. The intelligence that was used to discover who the attacker, is much more valuable than the information of who the attacker is. The best you'd probably get is 'classified sources/methods/intelligence'.

And anyone who doesn't know can give you just as much information. If you don't substantiate the rumor, it remains an unsubstantiated rumor.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#149

Post by KMag »

bombcar wrote: post #135
vmception wrote: post #124

Earlier quoted context omitted.

Is anyone ever pissed that one exploit getting caught reveals other hacker’s efforts? Like how that amateurish but high profile Wannacry attack revealed a much more lucrative Monero mining botnet that was running with the same exploit for weeks longer, but some script kiddie ruined it

I recall at least one "worm" that would patch the hole it came in by, perhaps so that it wouldn't have competition. It wasn't one of those "healing viruses" either; it was exploiting a weakness and preventing others from doing the same.

> it was exploiting a weakness and preventing others from doing the same.

This is also a solution (albeit with a race condition) to one bug that the Morris worm had: the same worm infecting a host multiple times and the multiple instances drawing more attention / stepping on its own feet. Other worms likely have had similar flaws.

(Any suggestions to eloquently un-mix the worm/feet metaphors?)

Post reply on HN