4 ms·

The solarwinds hack gets more expansive every time we find out more. This really doesn't bode well.

jand 6y ago
And this is why all the "they got into our left pocket but could not access the right pocket" statements can be ignored for now. It would be better to assume that every network/system in smelling range of a Solarwinds sticker is compromised.
wespiser_2018 6y ago
Yea, what concerns me is the sophistication of the attack, and just how widespread the damage/fallout is. The attack very good cover, while everyone scrambles to limit exposure and not sure exactly what to look for.
- bredren 6y ago
  What concerns me is lack of clear precedent for some equitable retaliation. And if some equitable retaliation is designed would there be public support for it if it were to include conventional warfare in some proxy fight. Much of the country has been told that China is the enemy and investigations into Russian interference in our country is a hoax. If this is more work from the fancy bear folks this is problematic. The US is a month away from a new president. The new president’s authority to act against this attack continued to be undermined by the sitting president who just fired the head of cyber command because he said the election itself was secure. Not because it wasn’t, but because he said it was to the public! I can not think of a more sophisticated and long term military intelligence operation than the epic we are witnessing right now. The United States could not be in a weaker position than now.
  - sofixa 6y ago
    Retaliation for a cyber attack, with cyber attacks, sanctions, or military operations could set a dangerous precedent. Don't forget that the US and allies have been behind many cyber attacks, including against Russia and China ( and probably were involved with Stuxnet against Iran). Do you want Russia, China, Iran, etc. to retaliate against US cyber attacks? Because that's how you get an escalation. https://en.m.wikipedia.org/wiki/Cyberwarfare_in_the_United_States https://en.m.wikipedia.org/wiki/Cyberwarfare_in_the_United_S...
    - sterlind 6y ago
      Tit-for-tat at least has precedent. The two major problems are attribution and how you actually launch a retaliatory cyber attack. DDoSing the enemy for crippling your power grid (a la Ukraine) is weak at best. One way is to have your backdoor planted, but only use it in retaliation. I assume that's why EnergyBear was found on the US power grid - not because Russia wanted to preemptively strike our grid, but so that they'd have the retaliation option ready to go, just in case.
tmaly 6y ago
The CISA post yesterday https://us-cert.cisa.gov/ncas/alerts/aa20-352a https://us-cert.cisa.gov/ncas/alerts/aa20-352a mentioned "Note (Updated December 18, 2020): CISA has evidence of initial access vectors other than the SolarWinds Orion platform." This raised any eye that there are other attack vectors that have been found but which they have not or do not have information on.

jand 6y ago

And this is why all the "they got into our left pocket but could not access the right pocket" statements can be ignored for now. It would be better to assume that every network/system in smelling range of a Solarwinds sticker is compromised.

wespiser_2018 6y ago

Yea, what concerns me is the sophistication of the attack, and just how widespread the damage/fallout is. The attack very good cover, while everyone scrambles to limit exposure and not sure exactly what to look for.

bredren 6y ago
What concerns me is lack of clear precedent for some equitable retaliation. And if some equitable retaliation is designed would there be public support for it if it were to include conventional warfare in some proxy fight. Much of the country has been told that China is the enemy and investigations into Russian interference in our country is a hoax. If this is more work from the fancy bear folks this is problematic. The US is a month away from a new president. The new president’s authority to act against this attack continued to be undermined by the sitting president who just fired the head of cyber command because he said the election itself was secure. Not because it wasn’t, but because he said it was to the public! I can not think of a more sophisticated and long term military intelligence operation than the epic we are witnessing right now. The United States could not be in a weaker position than now.
- sofixa 6y ago
  Retaliation for a cyber attack, with cyber attacks, sanctions, or military operations could set a dangerous precedent. Don't forget that the US and allies have been behind many cyber attacks, including against Russia and China ( and probably were involved with Stuxnet against Iran). Do you want Russia, China, Iran, etc. to retaliate against US cyber attacks? Because that's how you get an escalation. https://en.m.wikipedia.org/wiki/Cyberwarfare_in_the_United_States https://en.m.wikipedia.org/wiki/Cyberwarfare_in_the_United_S...
  - sterlind 6y ago
    Tit-for-tat at least has precedent. The two major problems are attribution and how you actually launch a retaliatory cyber attack. DDoSing the enemy for crippling your power grid (a la Ukraine) is weak at best. One way is to have your backdoor planted, but only use it in retaliation. I assume that's why EnergyBear was found on the US power grid - not because Russia wanted to preemptively strike our grid, but so that they'd have the retaliation option ready to go, just in case.

tmaly 6y ago

The CISA post yesterday https://us-cert.cisa.gov/ncas/alerts/aa20-352a https://us-cert.cisa.gov/ncas/alerts/aa20-352a mentioned "Note (Updated December 18, 2020): CISA has evidence of initial access vectors other than the SolarWinds Orion platform." This raised any eye that there are other attack vectors that have been found but which they have not or do not have information on.