5 ms·
Really impressive! It'll be interesting to see how the malware got signed by SolarWinds... I wonder what the cost of an attack like this is. It doesn't feel im
by filleokus 6y ago
Really impressive! It'll be interesting to see how the malware got signed by SolarWinds...
I wonder what the cost of an attack like this is. It doesn't feel impossible for a small group (< 10) of very smart and motivated people to maybe achieve this in 12-18 months of work?
Of course they could be working on behalf of some nation state, but compared to let's say an ICBM attack, this is probably not out of the realm of non-nation-state actors to pull of.
An entrepreneurial crime syndicate would probably have the resources to do this (or outsource to some mercenary attackers).
- nl 6y agoSome (pretty interesting) details here: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome... They used a an on-premises compromise to gain access to an organization’s trusted SAML token- signing certificate. This enables them to forge SAML tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts Note the on-premises compromise (!!) Microsoft credits it to a nation state.
- thu2111 6y agoI think that just means they hacked a machine running in the offices, not that they were literally physically on-premises. There's a rather large opaque black hole in the middle of this assertion: how are the attackers obtaining administrator credentials to the SSO systems? There seems to be a pretty big leap here from "get code inside the firewall via Orion" and "oops, now your SSO ticket private key is pwned". They say administrator credential compromise, OK, that's a pretty general class of techniques. The details would be good because otherwise there seems to be a missing link here.
- syshum 6y agoI am sure since they are classing in as a "nation state hack" the government will move quickly to classify the details for "national security". So then the question becomes was it really a nation state, or just incompetence being covered by claims of "nation state" hacking
- Proven 6y agoTime to cross reference that Shanghai CCP member database...
- delfinom 6y agoSounds like somebody was running around with domain admin accounts improperly at SolarWinds.
- SV_BubbleTime 6y agoRight. When the implication is spies, lockpicking, laser limbo.... The more likely scenarios are a CFO that thinks they are also a CTO, a sr tech that was given admin credentials to fix a problem that kept coming up for some reason, or some inconsequential service bot account was given admin privileges in development and never fixed later.
- weare138 6y agoConsidering someone at SolarWinds uploaded FTP credentials to their public Github and left it exposed for almost 2 years, I could definitely see that happening. https://savebreach.com/solarwinds-exposed-ftp-credentials-back-in-2018-says-security-researcher-vinoth/ https://savebreach.com/solarwinds-exposed-ftp-credentials-ba...