4 ms·

I'm really curious what's going to happen to SolarWinds the company, if anything, because of all this.

by vsareto 6y ago

maxerickson 6y ago
Stealing a joke I saw on Twitter, they rebrand.
- BitwiseFool 6y ago
  Truth in humor, there's a good chance that's exactly what will happen.
jen729w 6y ago
I was about to start a SW design literally the first day back next year. Not any more.
- vntok 6y ago
  Why not? Surely they must have put the very best minds money can buy on the problem to fix it?
  - jen729w 6y ago
    Well yeah, that was me. ;-) Perception is why. Especially for certain clients. Let’s pretend that I work for the French department of the interior and some time early next year I go to install SolarWinds. You think the boss is gonna OK that, knowing it’ll be in the paper the next day? No chance. They’re screwed for a while, only hope they have is staying afloat long enough for our short memories to forget this.
dboreham 6y ago
They re-emerge called "737-Max".
Dirlewanger 6y ago
Nothing. Equifax had nothing happen to them, this won't be any different.
djsumdog 6y ago
Absolutely nothing likely. Honestly, this is a weird fucking hack. The update went out signed by Solar Winds. Somehow, they got this payload into the build-chain their developers use.
- vsareto 6y ago
  Maybe they were just automatically signing it as a a CI/CD step?
  - EvanAnderson 6y ago
    I would love to see a postmortem for how they were handling their code signing cert. Right now I get a "PFX file on a network share and everybody knows the password" kind of feeling.
  - dane-pgp 6y ago
    Maybe after signing it (but before releasing it), the CI/CD should upload the signed hash to an independent third-party publicly-accessible append-only log (like Certificate Transparency). Assuming the binary is reproducibly buildable, different internal teams can try rebuilding the source and checking that the signature matches what's in the public log, and that each entry in the log has a corresponding commit in the source repo.
- rossjudson 6y ago
  I'm looking for info on this same topic. If the update was signed, how did that happen? The other thing that occurs to me is that this Solar Winds update goes out to a huge number of organizations, with a tremendous diversity of capabilities. Why was FireEye the first one to notice? Was the Solar Winds code exempted from monitoring, because it is monitoring? How big is this blind spot?
  - EvanAnderson 6y ago
    My understanding was that FireEye noticed because this backdoor was used to attack them. They worked it backwards and found the backdoor. It would be interesting to know how many "softer" targets the attacker went after and were completely undetected. It's worth noting that FireEye didn't find the backdoor until after it had been exploited. Nobody can vet modern software. The complexity is too high, let alone accounting for the ridiculous update "velocity" that's coming out of most commercial software today. Just getting software "manufacturers" to itemize and document the normal communication mechanisms used by their software, so that threat hunters aren't reverse engineering communications protocols, would go a long way. If SolarWinds had provided a list of domains their software needed to communicate with that would have gone a long way to stopping this kind of attack. (I can't be the only person who demands vendors provide this info, and who puts third-party software behind MiTM proxies and hard-assed ACLs.)
Silhouette 6y ago
On Friday last week, SWI was trading around 23.5. Today it closed around 14.2, so it looks like the big money investors are betting on SolarWinds-the-business being toast. Even if it does survive, if it doesn't somehow stage a miracle recovery very quickly, the current senior leadership are surely done as soon as they've finished being ritually sacrificed so their replacements don't get saddled with too much of the fallout. As another potentially interesting data point, SWI still appears to have a P/E close to 120 even now. Given that traditional value investors might consider something closer to 20 to be reasonable for an established business and the huge ratios of many big tech stocks only make sense if you think they're going to continue the dramatic growth some of them have enjoyed for a while, there could still be a long way for stocks in SWI to fall even if they do eventually stabilise.

I'm really curious what's going to happen to SolarWinds the company, if anything, because of all this.

maxerickson 6y ago

Stealing a joke I saw on Twitter, they rebrand.

BitwiseFool 6y ago
Truth in humor, there's a good chance that's exactly what will happen.

jen729w 6y ago

I was about to start a SW design literally the first day back next year. Not any more.

vntok 6y ago
Why not? Surely they must have put the very best minds money can buy on the problem to fix it?
- jen729w 6y ago
  Well yeah, that was me. ;-) Perception is why. Especially for certain clients. Let’s pretend that I work for the French department of the interior and some time early next year I go to install SolarWinds. You think the boss is gonna OK that, knowing it’ll be in the paper the next day? No chance. They’re screwed for a while, only hope they have is staying afloat long enough for our short memories to forget this.

dboreham 6y ago

They re-emerge called "737-Max".

Dirlewanger 6y ago

Nothing. Equifax had nothing happen to them, this won't be any different.

djsumdog 6y ago

Absolutely nothing likely. Honestly, this is a weird fucking hack. The update went out signed by Solar Winds. Somehow, they got this payload into the build-chain their developers use.

vsareto 6y ago
Maybe they were just automatically signing it as a a CI/CD step?
- EvanAnderson 6y ago
  I would love to see a postmortem for how they were handling their code signing cert. Right now I get a "PFX file on a network share and everybody knows the password" kind of feeling.
- dane-pgp 6y ago
  Maybe after signing it (but before releasing it), the CI/CD should upload the signed hash to an independent third-party publicly-accessible append-only log (like Certificate Transparency). Assuming the binary is reproducibly buildable, different internal teams can try rebuilding the source and checking that the signature matches what's in the public log, and that each entry in the log has a corresponding commit in the source repo.
rossjudson 6y ago
I'm looking for info on this same topic. If the update was signed, how did that happen? The other thing that occurs to me is that this Solar Winds update goes out to a huge number of organizations, with a tremendous diversity of capabilities. Why was FireEye the first one to notice? Was the Solar Winds code exempted from monitoring, because it is monitoring? How big is this blind spot?
- EvanAnderson 6y ago
  My understanding was that FireEye noticed because this backdoor was used to attack them. They worked it backwards and found the backdoor. It would be interesting to know how many "softer" targets the attacker went after and were completely undetected. It's worth noting that FireEye didn't find the backdoor until after it had been exploited. Nobody can vet modern software. The complexity is too high, let alone accounting for the ridiculous update "velocity" that's coming out of most commercial software today. Just getting software "manufacturers" to itemize and document the normal communication mechanisms used by their software, so that threat hunters aren't reverse engineering communications protocols, would go a long way. If SolarWinds had provided a list of domains their software needed to communicate with that would have gone a long way to stopping this kind of attack. (I can't be the only person who demands vendors provide this info, and who puts third-party software behind MiTM proxies and hard-assed ACLs.)

Silhouette 6y ago

On Friday last week, SWI was trading around 23.5. Today it closed around 14.2, so it looks like the big money investors are betting on SolarWinds-the-business being toast. Even if it does survive, if it doesn't somehow stage a miracle recovery very quickly, the current senior leadership are surely done as soon as they've finished being ritually sacrificed so their replacements don't get saddled with too much of the fallout. As another potentially interesting data point, SWI still appears to have a P/E close to 120 even now. Given that traditional value investors might consider something closer to 20 to be reasonable for an established business and the huge ratios of many big tech stocks only make sense if you think they're going to continue the dramatic growth some of them have enjoyed for a while, there could still be a long way for stocks in SWI to fall even if they do eventually stabilise.