Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analyzing the compromised DLL file that started the Solorigate attack

microsoft.com

Post reply on HN
Print view View original

21–30 of 149 posts

Re: Analyzing the compromised DLL file that started the Solorigate attack

#21

Post by eternalny1 »

bob1029 wrote: post #4

I am curious how this code actually made it in, based upon the following: > The fact that the compromised file is digitally signed suggests the attackers were able to access the company’s software development or distribution pipeline. Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Unless this a compromise of the build machine, i…

They are claiming that their build system was compromised and the code was not under source control.

> Based on our investigations to date, which are ongoing, we believe that the vulnerability was inserted within the Orion Platform products and existed in updates released between March and June 2020 (what we call the “relevant period”) as a result of a compromise of the Orion software build system and was not present in the source code repository of the Orion Platform products.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#22

Post by smspf »

>In an interesting turn of events, the investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor.

Either that one was used to compromise the supply chain (in which case it makes little to no sense to keep it around and risk detection), or at least 2 different groups had the chance to target sensitive US infrastructure.

Funny how media coverage of this issue misses no chance of mentioning Russia and nobody else, not even possible suspects.

I wonder what happens if the attackers notice each other on the compromised system. Do they get along in exfiltrating data or do they fight quietly?

Re: Analyzing the compromised DLL file that started the Solorigate attack

#23

Post by breck »

DethNinja wrote: post #18
breck wrote: post #8

Anyone else find it ironic that the country that is responsible for democratizing access to scientific research (via support of SciHub), the country protecting a whistleblower against government overreach (Snowden), the country pointing out how fundamentally insecure closed source, proprietary software is (SolarWinds), is...Russia? How did we get here?

I assume huge percentage of this site is IT professionals and software engineers. I’ll have to ask then, what proof is there that Russia did this hack? Do you realise how hard it is to track professional hackers? You will have to trace the entire network commands up to a source and hope that it is registered under their name. I genuinely cannot believe people here think that government managed to find the source of t…

A hack this big is bound to have plenty of HUMINT. I think it would be hard for either government to cover that up.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#24

Post by yuribro »

mad_vill wrote: post #7

> To have some minimal form of obfuscation from prying eyes, the strings in the backdoor are compressed and encoded in Base64, or their hashes are used instead. ah so base64 is valid encryption after all.

It says encoded, not encrypted. base64 is an encoding. It also says obfuscation, which isn't encryption either.

And finally, it talks about hashes (without even claiming cryptographic hash functions), and but it's not about the base64 strings...

Re: Analyzing the compromised DLL file that started the Solorigate attack

#25

Post by tigerBL00D »

breck wrote: post #8

Anyone else find it ironic that the country that is responsible for democratizing access to scientific research (via support of SciHub), the country protecting a whistleblower against government overreach (Snowden), the country pointing out how fundamentally insecure closed source, proprietary software is (SolarWinds), is...Russia? How did we get here?

It's only ironic of you buy into the narrative that Russia is somehow more evil or malicious than your average superpower.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#26

Post by DharmaPolice »

breck wrote: post #8

Anyone else find it ironic that the country that is responsible for democratizing access to scientific research (via support of SciHub), the country protecting a whistleblower against government overreach (Snowden), the country pointing out how fundamentally insecure closed source, proprietary software is (SolarWinds), is...Russia? How did we get here?

Not really a new thing. The Soviets would point out the defects in US society as much as the US would highlight defects in the USSR.

And granting asylum to persons who have fallen out of favour with an enemy/rival has a been a thing back to at least the time of the Peloponnesian War and probably before.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#27

Post by ThePadawan »

mehrdadn wrote: post #10

Any GitHub/GitLab/etc. employees here? I think you might be able to help mitigate some of these kinds of attacks: > To have some minimal form of obfuscation from prying eyes, the strings in the backdoor are compressed and encoded in Base64, or their hashes are used instead. There needs to be a quick tool that flags strings that appear to represent binary data before a merge, maybe even decoding them when possible and…

The relevant code was (allegedly) not part of source control, but inserted during the build process.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#28

Post by mehrdadn »

ThePadawan wrote: post #27
mehrdadn wrote: post #10

Any GitHub/GitLab/etc. employees here? I think you might be able to help mitigate some of these kinds of attacks: > To have some minimal form of obfuscation from prying eyes, the strings in the backdoor are compressed and encoded in Base64, or their hashes are used instead. There needs to be a quick tool that flags strings that appear to represent binary data before a merge, maybe even decoding them when possible and…

The relevant code was (allegedly) not part of source control, but inserted during the build process.

Hmm, interesting. I'm confused if that's how I should read this. You might be right. I assume you're referring to this paragraph?

> Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Therefore, insertion of malicious code into the SolarWinds.Orion.Core.BusinessLayer.dll likely occurred at an early stage, before the final stages of the software build, which would include digitally signing the compiled code.

They talk about adding classes at an early stage... I assumed that meant modifying the source code in some fashion. Sounds like you took it to mean they inserted binary (MSIL?) code during the build? Or are you referring to a different paragraph that indicates this wasn't part of source control?

Re: Analyzing the compromised DLL file that started the Solorigate attack

#29

Post by infogulch »

eternalny1 wrote: post #20

Interesting tidbit at the bottom ... > In an interesting turn of events, the investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor.

This makes me think of a common refrain when dealing with parasite infestations: If you see one, there's way more than just one.

Deterministic builds cannot come soon enough. And really, builds are not enough, we need to be able to extend confidence in the execution of the programs we write much deeper than just builds.

Re: Analyzing the compromised DLL file that started the Solorigate attack

#30

Post by bayindirh »

breck wrote: post #8

Anyone else find it ironic that the country that is responsible for democratizing access to scientific research (via support of SciHub), the country protecting a whistleblower against government overreach (Snowden), the country pointing out how fundamentally insecure closed source, proprietary software is (SolarWinds), is...Russia? How did we get here?

> The country pointing out how fundamentally insecure closed source, proprietary software is (SolarWinds), is...Russia?

I think this research was pioneered by US with Stuxnet/Flame? No?

Post reply on HN