4 ms·
It was previously reported that the user name/password of the FTP server used to distributed updates was accidently uploaded to github by SolarWinds.
by GartzenDeHaes 6y ago
It was previously reported that the user name/password of the FTP server used to distributed updates was accidently uploaded to github by SolarWinds.
- stevemk14ebr 6y agoThis is almost certainly just a funny and unfortunate coincidence. The malicious binary was signed, you can't do that with just FTP upload access. The code looks to be injected at build time according to this report by reversing labs: https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth https://blog.reversinglabs.com/blog/sunburst-the-next-level-... 'Signing occurred within a minute of library compilation. That leaves no time for the attackers to be able to monitor the build system, replace the binary and change the metadata to match this perfectly. The simplest way for all these timestamp artifacts to align perfectly is to have the attackers’ code injected directly into the source, and then have the existing build and signing system perform the compilation and release processes as defined by the Orion software developers.'
- GartzenDeHaes 6y agoThanks, that's interesting.