3 ms·

I'm looking for info on this same topic. If the update was signed, how did that happen? The other thing that occurs to me is that this Solar Winds update goes

I'm looking for info on this same topic. If the update was signed, how did that happen? The other thing that occurs to me is that this Solar Winds update goes out to a huge number of organizations, with a tremendous diversity of capabilities. Why was FireEye the first one to notice? Was the Solar Winds code exempted from monitoring, because it is monitoring? How big is this blind spot?

EvanAnderson 6y ago
My understanding was that FireEye noticed because this backdoor was used to attack them. They worked it backwards and found the backdoor. It would be interesting to know how many "softer" targets the attacker went after and were completely undetected. It's worth noting that FireEye didn't find the backdoor until after it had been exploited. Nobody can vet modern software. The complexity is too high, let alone accounting for the ridiculous update "velocity" that's coming out of most commercial software today. Just getting software "manufacturers" to itemize and document the normal communication mechanisms used by their software, so that threat hunters aren't reverse engineering communications protocols, would go a long way. If SolarWinds had provided a list of domains their software needed to communicate with that would have gone a long way to stopping this kind of attack. (I can't be the only person who demands vendors provide this info, and who puts third-party software behind MiTM proxies and hard-assed ACLs.)
- octoberfranklin 6y ago
  New doctrine: update velocity is a vulnerability.
  - EvanAnderson 6y ago
    I've always seen it as a good indicator of unreliability and poor QA practices. "We update our software frequently" has never seemed like a good thing to me. I read it as "You're paying licenses fees to be our testers."
octoberfranklin 6y ago
> If the update was signed, how did that happen? https://news.ycombinator.com/item?id=25462894 https://news.ycombinator.com/item?id=25462894 https://news.ycombinator.com/item?id=25463034 https://news.ycombinator.com/item?id=25463034

EvanAnderson 6y ago

My understanding was that FireEye noticed because this backdoor was used to attack them. They worked it backwards and found the backdoor. It would be interesting to know how many "softer" targets the attacker went after and were completely undetected. It's worth noting that FireEye didn't find the backdoor until after it had been exploited. Nobody can vet modern software. The complexity is too high, let alone accounting for the ridiculous update "velocity" that's coming out of most commercial software today. Just getting software "manufacturers" to itemize and document the normal communication mechanisms used by their software, so that threat hunters aren't reverse engineering communications protocols, would go a long way. If SolarWinds had provided a list of domains their software needed to communicate with that would have gone a long way to stopping this kind of attack. (I can't be the only person who demands vendors provide this info, and who puts third-party software behind MiTM proxies and hard-assed ACLs.)

octoberfranklin 6y ago
New doctrine: update velocity is a vulnerability.
- EvanAnderson 6y ago
  I've always seen it as a good indicator of unreliability and poor QA practices. "We update our software frequently" has never seemed like a good thing to me. I read it as "You're paying licenses fees to be our testers."

octoberfranklin 6y ago

> If the update was signed, how did that happen? https://news.ycombinator.com/item?id=25462894 https://news.ycombinator.com/item?id=25462894 https://news.ycombinator.com/item?id=25463034 https://news.ycombinator.com/item?id=25463034