9 ms·
Hackers used SolarWinds' dominance against it in sprawling spy campaign
- fuckthemachine 6y agodropping the caps out of their name was smart, that would have thrown me off
- ratsmack 6y ago>"1, 2, 3, 4, 5, 6... that's the combination I use on my luggage." These people are supposed to be security professionals.
- omarhaneef 6y agoCame here to make this reference and you beat me by a fraction of a second.
- chrisco255 6y agoIt's almost like they were paid to be incompetent.
- lemonspat 6y ago'solarwinds123' is gross negligence by any professional, let alone one that offers security/networking services to corporations and agencies
- bluedino 6y agoCost cutting is a wonderful thing
- mike_d 6y agoThis is indefensible. However, Solarwinds isn't a security company. They build network monitoring/management tools and have a very telco feel. I'm honestly not surprised by this level of incompetence.
- chrisco255 6y agoTheir software allows network traffic to be monitored for some of the most important government agencies we have: the White House, the Pentagon, Treasury Dept, etc. They're not some retail company. Their tools provide a vector to attack extremely sensitive systems. Network monitoring and management is by definition supposed to be secure, especially for critical systems.
- cbsmith 6y agoAgreed... but having used SolarWinds... I can't believe people use this stuff.
- captn3m0 6y agoThey have 6 tools listed on their IT Security Downloads: - Access Rights Manager: Manage and audit access rights across your IT infrastructure - Security Event Manager - Improve your security posture and quickly demonstrate compliance with an easy-to-use, affordable SIEM tool - Server Configuration Monitor - Gain visibility into systems changes and easily compare configurations over time with our new change monitoring tool - Patch Manager - Patch management software designed to quickly address software vulnerabilities - Serv-U Managed File Transfer Server - Enhance security and control over file transfers in and outside your organization - Serv-U File Transfer Protocol Server - Simple, affordable, easy-to-use FTP server software While I wouldn't call all of these security sensitive, but considering some of the other tools that they built: - Dameware Remote Support: Remote control and systems management tools in one easy-to-use package - Dameware Remote Everywhere: Deliver the tools IT professionals need in a cloud-based, remote support solution - User Device Tracker: Network device tracking software designed to locate users and devices on your network they definitely count as a security-sensitive vendor.
- Bob274927427 6y agoYou'd be surprised how many engineers don't understand security. A few years ago I complained to the DD-WRT developers that they need to serve up with firmware images on HTTPS (They were serving them up on HTTP). Their images are not cryptographically signed and they didn't publish hashes so at the very least they could try to secure the transport and use HTTPS. My request was rejected and they were confused as to why HTTPS was necessary as "it's not like we're doing online banking".
- sbelskie 6y agoI think if you put the capital letters in the middle and the numbers and punctuation at the beginning you are golden.
- tclancy 6y agoAdd the current year and ! and that shit is unbreakable. Not legally binding in the contiguous United States.
- MattGaiser 6y agoWhat are the good password practices for handling passwords that several people need to be able to use? I have yet to be in an organization that hasn’t defaulted to something quite unwise simply because trying to maintain the institutional knowledge of that password is otherwise difficult.
- klinskyc 6y agoThe good password practice is to not do this.
- dangoor 6y agoYou can use a team-oriented password manager with access controls, 2fa, etc.
- JimDabell 6y ago> What are the good password practices for handling passwords that several people need to be able to use? Mostly – don’t. Every user that has access to a system should have their own credentials. There’s no reason for an update server to be set up this way.
- viraptor 6y agoThis. Assign required roles to existing company accounts. Use SSO where possible. Don't have shared "god accounts" for anything.
- deleted 6y ago[deleted]
- lemonspat 6y agoYou can SSO the password to an identity store (LDAP / AD), add MFA Or, you sign a key/certificate for each user, add MFA Or, you create a complex password for each user, and add MFA Or you create a complex password, shared in a keystore that handles checkout and rotation Worst case, if you're lazy, you create a complex password for a handful of your teammates and reset it when a team member leaves Or if you're solarwinds, you apparently choose gross negligence
- ratsmack 6y ago>Three people familiar with the investigation have told Reuters that Russia is a top suspect, although others familiar with the inquiry have said it is still too early to tell. If this is the case, then why is Russia so definitively portrayed as the culprit in so many publications, currently?
- blhack 6y agoBecause Russia were legitimately a culprit during the cold war, and many people who grew up during that period are susceptible to clickbait where Russia is, again, the bad guy. They were primed for it during their entire childhood, and then as adults with movies, video games, etc.
- Craighead 6y agoUh huh, so that means even when there's direct evidence people shouldn't believe it because it's the boogeyman argument?
- forgingahead 6y agoAs Obama told Romney years ago, "the 80s called and are asking for their policy back!". American media loves their heroes and villains narratives, and the characters change depending on what is convenient. Even if Russia was responsible, would you believe them after all the other times they cried wolf?
- viraptor 6y agoThis is annoying without knowing the sources. But APT behaviours are repeated, researched, investigated. This could be legitimately mapped to a specific group using details which relevant agencies don't want to make public. Not sure we can deal with it better than acknowledge this is someone's opinion and there's a chance they may have more information, but there's also chance they're playing games.
- sudosysgen 6y agoA third possibility is that the attacker is pretending to be someone else as misdirection and that whoever is investigating fell into their trap.
- nimbius 6y agoIt's official If you are stupid enough to accept the advanced persistent state sponsored threat argument And you're dense enough to give these guys a second chance Then you should just fire your engineers and base your entire life out of the Gartner trade rag magic quadrants.
- unclekev 6y ago> base your entire life out of the Gartner trade rag magic quadrants Seems to work pretty well for a lot of the CIO/CTO level people who I have worked with. Unfortunately.
- olefoo 6y agoRemember that these individuals are usually hired and given responsibility based on their ability to game class signalling games; they exist to justify the status quo. If the status quo were more justifiable their actual job responsibilities to other people within the organization ( conflict resolution, scheduling, resource allocation, and personnel management) are things that could be automated in a hot minute.
- gabereiser 6y agoI don’t know about full automation, but I can confirm that in large f500 companies, Gartner holds a lot of weight. Most follow their recommendations. I’m guilty too of using that argument: “According to Gartner...” to give weight to my position when talking to C-level folks. I wish I didn’t have to, but lots of folks trust their recommendations.
- keyle 6y agoI'm either too old or too young to understand anything of what you've just said.
- TechBro8615 6y agoNot OP, but pretty sure he’s saying that if you’re eg a CISO who’s naive enough to accept whatever argument is fed to you for why this is a “state sponsored attack” (implying that it’s not), then you may as well reduce your professional decision making to favoring whatever Gartner recommends in their “magic quadrant” marketing materials.
- stefan_ 6y agoRemember when FireEye told you this was a super sophisticated nation state attack? Not much left of them trying to lie their way out of this shambles.
- kube-system 6y agoUsing a bad password on one of your systems (a year ago) does not, in any way, preclude the possibility of being attacked in a sophisticated manner by a sophisticated attacker.
- Craighead 6y agoIt's reveling how little the average HN user understands about security, maybe in part revealing why there is such a problem with security to begin with l.
- anigbrowl 6y agoLove to be a ~$6 billion company handling critical infrastructure that saves money by using paperclips instead of padlocks.
- saboot 6y agoNot just companies.. The Brits at one point had their nuclear weapons secured with a cheap bike lock
- j0ba 6y agoRUSSIA is the only one who could have guessed this password!
- exception_e 6y agoFirst time I ever had to leave a comment surrounding the HN Guidelines, but "Please don't use Hacker News for political or ideological battle. It tramples curiosity." Just today you wrote "[...] Russians, you're a fucking Trump supporter!" HN is the best and I'm sure you agree. Please take it easy with these kinds of comments.
- My7thAccount 6y agoIt tramples curiosity when no one questions why the Russians are blamed for everything which is intellectually dishonest. A few hackers isn’t indicative of the entire country. It’s almost starting to border on bigotry
- kube-system 6y agoNobody is blaming Russian people, they’re blaming the Russian government. All large foreign powers engage in espionage of their rivals and have done so for literally millennia.
- My7thAccount 6y agoThere is still no proof it was Russia though unless you have some facts other than “someone told me so” or “I read it somewhere”. Why are people so naive
- wolfgang42 6y agoPeople are questioning why everyone is so quick to point at Russia: https://news.ycombinator.com/item?id=25438348 https://news.ycombinator.com/item?id=25438348
- 6y ago
- deleted 6y ago[deleted]
- aero-glide 6y agoSo does this attack really require "State sponsored infrastructure" to have occurred?
- dilyevsky 6y agoClearly only state sponsored attacker could’ve guessed that password
- noitsnot 6y agoThe password probably hasn't been changed since they last updated the UI of Orion ten years ago. https://www.networkmanagementsoftware.com/wp-content/uploads/orion-ui-old.jpg https://www.networkmanagementsoftware.com/wp-content/uploads...
- deleted 6y ago[deleted]
- blhack 6y agoThe password to a twitter account, and the password to an update server which apparently allows you to pwn parts of seemingly every branch of the US government are not even remotely on the same scale.
- daenz 6y agoHanlon's Razor etc etc, but if I wanted to create an intentional security vulnerability and have plausible deniability, I would use stupidly simple passwords as well.
- mc32 6y agoNo, why? If they have special customers I’m sure they could give their special customers a complicated password to use just the same.
- mellosouls 6y agoActual title: Hackers used SolarWinds' dominance against it in sprawling spy campaign Not to dismiss the point of the editorialised title here ("SolarWinds use the password 'solarwinds123' on their Update Servers") but note: Neither the password nor the stolen access is considered the most likely source of the current intrusion, researchers said
- dyslexit 6y agoAdditionally, that was a flaw from a year ago. Still incredibly stupid, but not really relevant to the recent hacks at all. This is being used to discredit the fact that investigators are pointing to "a" state actor for the source of these hacks.
- jjulius 6y ago>Additionally, that was a flaw from a year ago. Still incredibly stupid, but not really relevant to the recent hacks at all. I'd argue that it's very relevant; if they were making such terrible decisions a year ago, what else did they do wrong between then and the hack? I am reluctant to assume that they didn't make other mistakes, given how obvious this password flub was.
- deleted 6y ago[deleted]
- nabakin 6y agoThe title should be edited from "use" to "used" imo.
- eatonphil 6y ago> Neither the password nor the stolen access is considered the most likely source of the current intrusion, researchers said. For what it's worth.
- BLKNSLVR 6y agoBurglar 1: "Hey guys I managed to bypass the security system on the window and jimmy it open just enough for us to squeeze in and out" Burglar 2: "Key's under the doormat"
- ratsmack 6y agoIt's surprising how many hacks are from insiders or through social engineering.
- cratermoon 6y agoIt's not surprising if you track the industry news.
- ashtonkem 6y agoWith such a blisteringly dumb mistake already being made, I’m sure the attackers had to choose which one of the wide open doors to use.
- grupthink 6y agoYep, forget security through obscurity. They're going for paralysis through over-analysis.
- ashtonkem 6y agoI know you’re joking, but leaving out honeypots to slow down enemy attackers is a valid strategy. Except you need to purposefully leave honeypots that don’t have anything valuable in them. They seemed to have misunderstood the strategy.
- cdubzzz 6y ago90 days prior to that it was 'solarwinds12'.
- ineedasername 6y agoSurprising they added complexity with 123 I stead of just incrementing to 13. Or maybe a few years ago some security genius mandated a weekly password change and they had just made it to week 123.
- toomuchtodo 6y agoHow did Solarwinds ever pass a SOC2 or similar audit? And who performed the audit(s)?
- ratsmack 6y agoIt would be nice to know if they did or if it was ever required of them.
- deleted 6y ago[deleted]
- ta009988 6y agoWhat value does SolarWinds provide? I manage three days centers, about 4000 physical machines, and tens of thousands of VMs, switches, routers, etc. Never had a need for anything SolarWinds provides, and we have tons of stuff in PCI-DSS environments...
- sys_64738 6y ago'501@rw1nd5IZE' would be better.
- taa0x0 6y agoThree data centers, 4000 physical machines, tens of thousands of VMs, switches, routers, etc... Never needed SolarWinds, and we'll definitely never entertain them now.
- rognjen 6y agoThat's actually the most secure password they could have chosen. Who'd suspect that a security company would use the simplest of passwords. Dumbasses wasting time trying to crack a secure password, hah! /s
- ciscod 6y agoThrowaway here. These kinds of passwords are all over the place. Cisco uses a simple variation of c!sco123 for a lot of it’s managed gear which is a documented default that doesn’t get changed.
- strogonoff 6y ago> Three weeks ago, SolarWinds posted a job ad seeking a new vice president for security; the position is still listed as open. Does this mean the job listing was posted before this incident gone public?
- kerng 6y agoA friend of mine talked about building a simple crawler to find companies with open security positions. He noticed whenever there is a spike in open security positions a breach is soon announced or was just announced recently.
- rtx 6y agoTake it to its logical conclusion and short the company.
- hikerclimb 6y agoNice! Hopefully more is government stuff gets hacked.
- blhack 6y ago>Security researcher Vinoth Kumar told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123” Wow.
- walrus01 6y agoFrom the perspective of people who run real, serious monitoring systems for big ISP stuff, solarwinds has never been taken seriously. It's "monitoring" software for those persons who are entirely dependent on the Windows GUI.
- deleted 6y ago[deleted]
- kerng 6y agoThat might mean their software was already compromised long before what was reported to have happened in March - just noone noticed... I heard it's not uncommon that multiple adversaries sometimes poke around the same systems, even fight each other to maintain access.
- olefoo 6y agoFor such a high value target why aren't they using MFA built in to the hardware? They're a networking company but they apparently build stuff like it's still 1996.
- niahmiah 6y agoThey forgot the capital letter and special character. If only they had used Solarwinds123! We could have avoided this whole thing.
- zajio1am 6y agoThis reminds me an affair from 2006, where National Security Bureau of Slovak Republic (NBU SR) used on some servers password "nbusr123".
- leric 6y agoSo this can render them incompetent and innocent, it's all Russia's fault.
- dannyw 6y agoThese sort of actions should be criminal negligence. No qualified professional should think 'solarwinds123' is an acceptable password, especially in a production environment!
- throwaway5752 6y ago1. This isn't the article's headline 2. The weak password wasn't how they were hacked 3. Solar winds was just the vector, the actual payloads were targeted and advanced. Their insecure password may be disappointing but it's not relevant to the much more important story about who used them to compromise very sophisticated targets.
- renewiltord 6y agoYou can use grep -e '[a-zA-Z]\{4,\}$' /etc/dictionaries-common/words | shuf | head -n 4 if for some reason you don't want to use a password manager's generator. There's some entropy lost by the fact that you're choosing without replacement but it's not the end of the world.
- deleted 6y ago[deleted]
- client4 6y agoIn 2001 you could download Solarwinds from an unsecured FTP server. It looks like things have remained the same.
- cratermoon 6y agoWhat you're hearing is the sound of thousands of corporate IT security personnel realizing that, compared to these attackers, the have no idea what they are doing.
- dang 6y agoThe submitted title ("SolarWinds use the password 'solarwinds123' on their Update Servers") broke the site guidelines badly. Not only is it not the article title (which the site guidelines ask people to use except when it's misleading or baity), it's not even what the article actually says about that cherry-picked detail. Titles are by far the biggest influence on threads. As a result of this title, this thread is a shallow, frothy rantfest. The site guidelines say "Please use the original title, unless it is misleading or linkbait; don't editorialize." Cherry-picking a detail is editorializing, getting it wrong is misleading, and getting it wrong by making it more sensational is linkbait, for the trifecta. Submitters: please don't do that. If you want to say what you think is important about an article, please do so in the comments. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=%22level%20playing%20field%22%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
- jrs235 6y ago>which the site guidelines ask people to use except when it's misleading or baity Or too long and needs shortening. In these cases, what, if there is one, is the preferred way to shorten titles? Truncate or attempt to rewrite to shorten without editorializing?
- dang 6y agoGood question! (The limit is 80 chars.) The answer is to truncate, not rewrite. However, truncation isn't always natural. One shouldn't start abbreviating words, for example, that don't normally get abbreviated. In cases where there isn't a natural way to truncate, a better option is to look at the HTML doc title, a subtitle, a heading, or sometimes even a photo caption, that say accurately and neutrally what the article is about. There's often also a sentence in the opening paragraph that can be used. Sometimes none of those exists, but you can find a representative phrase lurking in the article body. The key is that it be representative though, not cherry-picked. There's a bit of interpretation involved there, but you can nearly always pick out the general-overview phrase if one exists. They have a distinctive quality. Rewriting should only be a last resort. When we edit titles, we always try to use representative language from the article and rather than to make up language ourselves.