3 ms·
SolarWinds has a major presence in the "MSP" market with their "n-Able" product. Lots and lots of PCs and servers have the n-Able agent installed. I am aware of
by EvanAnderson 6y ago
SolarWinds has a major presence in the "MSP" market with their "n-Able" product. Lots and lots of PCs and servers have the n-Able agent installed. I am aware of MSPs that use their Customer-facing n-Able installations for the management of their internal systems. Credential harvesting potential alone would be massive.
If somebody can backdoor one of their products it would stand to reason they can backdoor others too.
- rixed 6y agoI wonder how frequently this agent has been forced upon users by the security team.
- octoberfranklin 6y agoLess often than the Intel Manglement Engine.
- iJohnDoe 6y agoIt’s mind blowing how relevant this comment is. IME needs to go away.
- EvanAnderson 6y agoHad a chance to look at an n-Able / n-Central installation this morning. Turns out that the "Probe" component (installed on machines in remote networks to act as a centralized data collector within that network) does use the affected Orion DLL, but the version appears to be older than the malicious version. If this hadn't been spotted sooner I wonder if the affected component would have ended up being bundled into n-Able and being shipped that way too.