3 ms·
This is egregious, for sure, but it doesn't explain how a DLL signed with their certificate ended up in the wild. Have SolarWinds' handling practices for their
by EvanAnderson 6y ago
This is egregious, for sure, but it doesn't explain how a DLL signed with their certificate ended up in the wild.
Have SolarWinds' handling practices for their code signing certificate come to light? It's sounding more and more like we're going to find out it was a "PFX file w/ the password 'password' saved on a network share" kind of situation.
- jjk166 6y ago> This raises many questions. Were the certificates used to sign the binaries obtained from that public GitHub repository or, from any other information leaked publicly. Exposed certificate could have allowed hackers to sign their malicious SolarWinds Orion binaries and pass them off as legitimate software developed by SolarWinds, subsequently uploading them to the Downloads server with the previously found leaked FTP credentials.
- roland-s 6y agoThis is wild speculation but just to highlight how FTP could be leveraged to get a signed DLL. Imagine SolarWinds has a "sign everything in this directory" script. Attackers gain access to that trusted directory either directly via FTP or by pivoting off FTP access. They just plop their DLL in there and let SolarWinds auto-sign it. No cert required.
- EvanAnderson 6y agoScary as heck but possible. I implemented an HSM-based signing service for a firmware attestation system a few years ago. Authorization to sign and an audit trail of signature requests were a big deal. Something like the "plop a file in a directory" would make me weep.
- ohiovr 6y agoStolen certificate is my guess.