5 ms·

Maybe I'm being dense, but the article left me confused regarding how the "sunburst" backdoor made it into a piece of software signed by the vendor. Can anyone

Maybe I'm being dense, but the article left me confused regarding how the "sunburst" backdoor made it into a piece of software signed by the vendor. Can anyone explain?

jeffmcjunkin 6y ago
It strongly implies that the vendor was thoroughly compromised, in order to insert backdoors into their software (possibly amongst other attacker actions).
- tootie 6y ago
  Yeah, seems like a buried lede. SolarWinds was owned pretty badly and the attack that lead to that isn't described. Once they had access they have free reign to send malware to any one of their clients masquerading as routine patches. Sounds like they went the extra mile to deliver an extremely subtle exploit to avoid detection.
  - jiveturkey 6y ago
    ironic that you spelled ‘lede’ correctly but not ‘led’
    - dxdm 6y ago
      Are you the guy doing youtube vids on submarine stuff? I like those, but it's unexpected to find you here, snarking over people's spelling. If you're not the guy, I recommend looking him up if you're interested in this sort of thing, it's a nice way to spend time online. :)
      - deleted 6y ago
        [deleted]
      - jiveturkey 6y ago
        are you the righteous indignation police? sometimes a simple “i found it amusing/ironic/delightful/serendipitous “ comment is just that, you know. i’m not sure why you think my comment was snarky, or holier than thou, or worthy of a criticism. the sub guy was amusing. as my own comment was intended. i’m honored by the comparison.
  - rblatz 6y ago
    I bet the 2 week waiting period was to avoid detection in the solarwinds QA environment.
abvdasker 6y ago
> SolarWinds.Orion.Core.BusinessLayer.dll is signed by SolarWinds, using the certificate with serial number 0f:e9:73:75:20:22:a6:06:ad:f2:a3:6e:34:5d:c0:ed. The file was signed on March 24, 2020. The “Delivery and Installation” section covers this. It’s a very short section, the subtext of which is that there’s basically no defense for malware delivered with a valid signature from a trusted vendor. It’ll be pretty interesting to find out what happened at SolarWinds in the coming days: whether this malware was smuggled into the update via employee collusion with attackers or a hack of SolarWinds itself.
- DoofusOfDeath 6y ago
  Thanks. I had read that, but I figured I must be missing something. I assumed that if the vendor was genuinely signing malware, that would be headline of the story.
Rapzid 6y ago
This it the real story. I don't find the details of "sunburst" particularly interesting or clever. How this ended up signed by SolarWinds though..
- jeffrallen 6y ago
  Occam's razor says that Solarwinds just... signed it. Just like Juniper shipped breakable VPNs and RSA shipped a bad random number generator. No need to look too far for why.
  - octoberfranklin 6y ago
    nothing to see here move along
    - rayvd 6y ago
      No need to move along, but likely no need to spend time exploring exotic and highly unlikely root cause scenarios.
ericcholis 6y ago
Reminds me of the three(?) times CCLeaner was been compromised.
drevil-v2 6y ago
Exactly my thoughts and confusion. It was a valid signed component of the Solarwinds application... so.... how did the attackers manage to sign it and publish it as a legitimate update? I used to work at a bank and any software deployment had multiple automatic and manual checks. Multiple senior engineers and managers had to approve the publish. Was someone being blackmailed? Or a malicious actor managed to gain employment?
- gauravphoenix 6y ago
  There could be many vectors including the compromise of the build server. That Jenkins plugin you haven't updated in years. Or that maven package no one knows about. Third party risk management is unfortunately not well funded cyber security vertical.
  - drevil-v2 6y ago
    Solarwinds is not your average software company. Look at their customer list. They would have had ISO certifications and independent 3rd party audits done a billion times. Those type of companies don't even speak to you if you don't have those credentials. You think you are supplying software to all the armed forces branches and "forgot" to update a Jenkins plugin?
    - X-Istence 6y ago
      Yes, absolutely. Oh, the amount of outdated software that your average corp runs is mind blowing. Not only that, but if you have a tight IT department, the amount of shadow IT that happens because of the too onerous processes put in place by IT will leave so much infrastructure that is critical but not managed correctly. As a security professional, getting people to upgrade simple software is difficult enough, upgrading critical infrastructure used 24/7 by the development team... forget about it.
      - tmuxtux 6y ago
        Corporation probably doesn’t even know, IT management is all outsourced
FateOfNations 6y ago
Microsoft's block post goes on about compromised SAML signing certificates but doesn't explain exactly how they fit in to the attach chain. https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...

Maybe I'm being dense, but the article left me confused regarding how the "sunburst" backdoor made it into a piece of software signed by the vendor. Can anyone explain?

jeffmcjunkin 6y ago

It strongly implies that the vendor was thoroughly compromised, in order to insert backdoors into their software (possibly amongst other attacker actions).

tootie 6y ago
Yeah, seems like a buried lede. SolarWinds was owned pretty badly and the attack that lead to that isn't described. Once they had access they have free reign to send malware to any one of their clients masquerading as routine patches. Sounds like they went the extra mile to deliver an extremely subtle exploit to avoid detection.
- jiveturkey 6y ago
  ironic that you spelled ‘lede’ correctly but not ‘led’
  - dxdm 6y ago
    Are you the guy doing youtube vids on submarine stuff? I like those, but it's unexpected to find you here, snarking over people's spelling. If you're not the guy, I recommend looking him up if you're interested in this sort of thing, it's a nice way to spend time online. :)
    - deleted 6y ago
      [deleted]
    - jiveturkey 6y ago
      are you the righteous indignation police? sometimes a simple “i found it amusing/ironic/delightful/serendipitous “ comment is just that, you know. i’m not sure why you think my comment was snarky, or holier than thou, or worthy of a criticism. the sub guy was amusing. as my own comment was intended. i’m honored by the comparison.
- rblatz 6y ago
  I bet the 2 week waiting period was to avoid detection in the solarwinds QA environment.

abvdasker 6y ago

> SolarWinds.Orion.Core.BusinessLayer.dll is signed by SolarWinds, using the certificate with serial number 0f:e9:73:75:20:22:a6:06:ad:f2:a3:6e:34:5d:c0:ed. The file was signed on March 24, 2020. The “Delivery and Installation” section covers this. It’s a very short section, the subtext of which is that there’s basically no defense for malware delivered with a valid signature from a trusted vendor. It’ll be pretty interesting to find out what happened at SolarWinds in the coming days: whether this malware was smuggled into the update via employee collusion with attackers or a hack of SolarWinds itself.

DoofusOfDeath 6y ago
Thanks. I had read that, but I figured I must be missing something. I assumed that if the vendor was genuinely signing malware, that would be headline of the story.

Rapzid 6y ago

This it the real story. I don't find the details of "sunburst" particularly interesting or clever. How this ended up signed by SolarWinds though..

jeffrallen 6y ago
Occam's razor says that Solarwinds just... signed it. Just like Juniper shipped breakable VPNs and RSA shipped a bad random number generator. No need to look too far for why.
- octoberfranklin 6y ago
  nothing to see here move along
  - rayvd 6y ago
    No need to move along, but likely no need to spend time exploring exotic and highly unlikely root cause scenarios.

ericcholis 6y ago

Reminds me of the three(?) times CCLeaner was been compromised.

drevil-v2 6y ago

Exactly my thoughts and confusion. It was a valid signed component of the Solarwinds application... so.... how did the attackers manage to sign it and publish it as a legitimate update? I used to work at a bank and any software deployment had multiple automatic and manual checks. Multiple senior engineers and managers had to approve the publish. Was someone being blackmailed? Or a malicious actor managed to gain employment?

gauravphoenix 6y ago
There could be many vectors including the compromise of the build server. That Jenkins plugin you haven't updated in years. Or that maven package no one knows about. Third party risk management is unfortunately not well funded cyber security vertical.
- drevil-v2 6y ago
  Solarwinds is not your average software company. Look at their customer list. They would have had ISO certifications and independent 3rd party audits done a billion times. Those type of companies don't even speak to you if you don't have those credentials. You think you are supplying software to all the armed forces branches and "forgot" to update a Jenkins plugin?
  - X-Istence 6y ago
    Yes, absolutely. Oh, the amount of outdated software that your average corp runs is mind blowing. Not only that, but if you have a tight IT department, the amount of shadow IT that happens because of the too onerous processes put in place by IT will leave so much infrastructure that is critical but not managed correctly. As a security professional, getting people to upgrade simple software is difficult enough, upgrading critical infrastructure used 24/7 by the development team... forget about it.
    - tmuxtux 6y ago
      Corporation probably doesn’t even know, IT management is all outsourced

FateOfNations 6y ago

Microsoft's block post goes on about compromised SAML signing certificates but doesn't explain exactly how they fit in to the attach chain. https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...