4 ms·
> The adversary added a malicious version of the binary solarwinds.orion.core.businesslayer.dll into the SolarWinds software lifecycle Can someone explain how
by jackconsidine 6y ago
> The adversary added a malicious version of the binary solarwinds.orion.core.businesslayer.dll into the SolarWinds software lifecycle
Can someone explain how they were able to do this?
- GartzenDeHaes 6y agoIt was previously reported that the user name/password of the FTP server used to distributed updates was accidently uploaded to github by SolarWinds.
- stevemk14ebr 6y agoThis is almost certainly just a funny and unfortunate coincidence. The malicious binary was signed, you can't do that with just FTP upload access. The code looks to be injected at build time according to this report by reversing labs: https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth https://blog.reversinglabs.com/blog/sunburst-the-next-level-... 'Signing occurred within a minute of library compilation. That leaves no time for the attackers to be able to monitor the build system, replace the binary and change the metadata to match this perfectly. The simplest way for all these timestamp artifacts to align perfectly is to have the attackers’ code injected directly into the source, and then have the existing build and signing system perform the compilation and release processes as defined by the Orion software developers.'
- GartzenDeHaes 6y agoThanks, that's interesting.
- eloff 6y agoThe interesting part is it looks like they somehow got hold of the SolarWinds signing key to sign the binary.
- tyu2 6y agoI'm not sure why you say it's interesting, signed binaries was always known to be a useless measure against APT level threats, getting signing keys is probably the easiest thing at that level. I remember Microsoft even publicly admitted they can't do shit against APT, so all of their "security" PR is essentially not real security, but that's been a thing with all megacorps for years now.
- stevemk14ebr 6y agoGetting _a_ signing key is not equal to having access to SolarWind's signing key. It is interesting because it shows the extent of the breach.
- schoolornot 6y agoThey weren't verifying their build outputs against their build inputs. That or there was a rogue insider. We'll never get the full story.