6 ms·

Security expert warned SolarWinds in 2019 that anyone could access server

205 points by 1cvmask 6y ago

tpmx 6y ago
This seems to be the Vinoth Kumar from the article: https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/1338431183588188160
- Throwaway1771 6y ago
  Hope he's got his head on a swivel.
- 1cvmask 6y ago
  Yes it is Vinoth Kumar as mentioned in the article and the password was: solarwinds123
  - nullsense 6y ago
    derp
  - mrtweetyhack 6y ago
    almost as good as password123
alexpc201 6y ago
This was widely known. All organizations who didn’t ditched SolarWinds by then deserved what happened. Will you risk your enterprise bussiness for someone who don’t take good care of his own passwords? Would you trust morons who disclose their own keys with your IT infrastructure? It will happen again because nobody really cares. But its our data they’re gambling.
- tpmx 6y ago
  Was it widely known? That seems weird. Got a link?
  - doggydogs94 6y ago
    I doubt there is a news article. He means, word of mouth within people who work with network monitoring products.
  - alexpc201 6y ago
    https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/1338431183588188160
Drunk_Engineer 6y ago
But..but...experts on TV are saying this hack was so sophisticated it could have only been done by the Russians.
- ceph_ 6y ago
  Take your disingenuous strawman elsewhere.
  - tpmx 6y ago
    That's not really a straw man argument though, right? https://en.wikipedia.org/wiki/Straw_man https://en.wikipedia.org/wiki/Straw_man Edit: I too read the Microsoft analysis/decompilation. It looks like it was developed by a competent team that either was comfortable with using English correctly for the various symbols, or went out of their way to do so.
    - hn_throwaway_99 6y ago
      It is a straw man, because it is conflating the idea that SolarWinds had some simple security hole in the past with the evidence of this particular hack, which shows quite a level of competent capability, at least as described by the FireEyes report. Edit: Furthermore, the argument isn't just "the attack is so sophisticated it could only have been done by the Russians." The report from Reuters identified people internal to the investigation who said it "bore the hallmarks" of known Russian hacking groups. One could argue that isn't sufficient evidence, fine, but nobody is saying people are just assuming it's the Russians because it's a sophisticated attack.
      - tpmx 6y ago
        > The report from Reuters identified people internal to the investigation who said it "bore the hallmarks" of known Russian hacking groups. I too believe that report. That's not what we're discussing though - the supposed straw man was "experts on TV are saying this hack was so sophisticated it could have only been done by the Russians". What I'm saying is that many countries and companies have the capability to perform something like this. Not that Russia didn't do it.
arkadiyt 6y ago
This password to their FTP server would have allowed you to upload arbitrary executables, but they still wouldn't be signed like a valid SolarWinds update would be, so it seems unlikely to be related to the recent hack. The real attack compromised SolarWinds' build server, as they self-reported in their SEC filing [1]. [1]: https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/6dd04fe2-7d10-4632-89f1-eb8f932f6e94.pdf https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/6dd04fe...
- hn_throwaway_99 6y ago
  Really, really, really looking for the eventual analysis of how the attackers were able to compromise SolarWinds' build server. And to that point, while SolarWinds' bending over backward to characterize it as "an incredibly complex and sophisticated attack" is predictable, it's also ludicrous without saying how the initial intrusion occurred. That is, everything I've read has explained how the actual payload that was delivered to the victims' networks was sophisticated and complex, but it's possible the original build server vulnerability was braindead simple. We just don't know until that is revealed.
  - redis_mlc 6y ago
    > compromise ... build server The first think I think of is Jenkins running on a public IP?
  - Animats 6y ago
    Now that it's come out that SolarWinds's default password on their deployed systems was 'solarwinds123', it's quite possible that the break-in to their build server wasn't all that hard.
    - foolmeonce 6y ago
      It also doesn't really matter if I understood correctly AFA establishing incompetent defense for simple attacks. You could ftp in and upload a binary? but it wouldn't be signed! What about an old binary? Already we are into attacks on the anti-rollback on individual clients and we didn't need anything a beginner wouldn't try. (I would go so far as to say that if there was insufficient anti-rollback and they still burned 0-days to get into that build server then they were expending resources trying to either look sophisticated or had some other odd motivation.)
loceng 6y ago
All internet companies should require security insurance, and insurance companies should be a required vector for submitting security vulnerabilities.
- olefoo 6y ago
  This is an idea that should be explored more fully. The downside is that it will make information technology a much less freewheeling and innovative field.
  - tpmx 6y ago
    It's a massive innovation killer downside. How about we restrict this to "all internet companies selling security software to governments", at the very widest? Also: It doesn't fix the problem.
    - olefoo 6y ago
      Construction companies seem to do fine even though building codes exist. It's not uncommon for a mature industry to face a reckoning around damaging practices that were common when they were nascent industries. Would you like to live below a dam that was built under a loose and permissive regulatory regime? How about storing sensitive personal data in a datacenter whose owner specifically disclaims liability for it's exposure?
      - Aerroon 6y ago
        >Construction companies seem to do fine even though building codes exist. They're not the one's paying for it. The people wanting the building built are. And there's a lot of corruption in that. On top of that, there's a pretty clear housing crisis in big cities. I'm unsure whether that's the industry to follow.
- javert 6y ago
  This is the kind of idea that killed the American medical system. It's a bad idea to create insurance monopolies. Unless you are a corrupt regulator, corrupt insurance company exec, or corrupt officer in the industry being targeted. Then, you can fine tune it to maximize your take and punish the downstream customers. Like how the American medical system works.
naveen99 6y ago
Here is a simple way to monitor your machines for intrusions or malpractice by insiders: Put an amount of bitcoin on each machine , equal to licensing fees you would pay for backdoored security tools like solar winds. Monitor the bitcoin address for when it gets stolen. If it gets stolen, you have been owned.
- skissane 6y ago
  A nation state actor will steal all your data and leave the bitcoin untouched.
  - naveen99 6y ago
    The nation state isn’t going to know which bitcoins their agent stole... the agent can take both data and bitcoin. No one will talk about the bitcoin to the outside world.
    - skissane 6y ago
      Do you think offensive black hats employed by governments aren't closely monitored by their employers? It doesn't matter whether the attacker works for China, Russia, the US, whoever – they are likely sitting in a very secure building owned by a military branch or intelligence agency, absolutely everything they do is closely monitored by their superiors (spy agencies love to spy on their own spies), they aren't allowed to take personal electronic devices into the building and they are physically searched on entry and exit. Do you think, working in that kind of environment, they'll find it easy to steal their target's bitcoin? Do you think their superiors will look kindly on agents compromising operations for personal financial gain?
      - naveen99 6y ago
        You mean like secret service agents: https://www.justice.gov/usao-ndca/pr/former-secret-service-agent-sentenced-scheme-related-silk-road-investigation https://www.justice.gov/usao-ndca/pr/former-secret-service-a...
dmix 6y ago
These stories always follow the exact same pattern. It's weird. This is why I got burnt out of infosec.
vondur 6y ago
Would something like 2FA have been helpful for those with write access to the build servers?

205 points by 1cvmask 6y ago

tpmx 6y ago

This seems to be the Vinoth Kumar from the article: https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/1338431183588188160

Throwaway1771 6y ago
Hope he's got his head on a swivel.
1cvmask 6y ago
Yes it is Vinoth Kumar as mentioned in the article and the password was: solarwinds123
- nullsense 6y ago
  derp
- mrtweetyhack 6y ago
  almost as good as password123

alexpc201 6y ago

This was widely known. All organizations who didn’t ditched SolarWinds by then deserved what happened. Will you risk your enterprise bussiness for someone who don’t take good care of his own passwords? Would you trust morons who disclose their own keys with your IT infrastructure? It will happen again because nobody really cares. But its our data they’re gambling.

tpmx 6y ago
Was it widely known? That seems weird. Got a link?
- doggydogs94 6y ago
  I doubt there is a news article. He means, word of mouth within people who work with network monitoring products.
- alexpc201 6y ago
  https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/1338431183588188160

Drunk_Engineer 6y ago

But..but...experts on TV are saying this hack was so sophisticated it could have only been done by the Russians.

ceph_ 6y ago
Take your disingenuous strawman elsewhere.
- tpmx 6y ago
  That's not really a straw man argument though, right? https://en.wikipedia.org/wiki/Straw_man https://en.wikipedia.org/wiki/Straw_man Edit: I too read the Microsoft analysis/decompilation. It looks like it was developed by a competent team that either was comfortable with using English correctly for the various symbols, or went out of their way to do so.
  - hn_throwaway_99 6y ago
    It is a straw man, because it is conflating the idea that SolarWinds had some simple security hole in the past with the evidence of this particular hack, which shows quite a level of competent capability, at least as described by the FireEyes report. Edit: Furthermore, the argument isn't just "the attack is so sophisticated it could only have been done by the Russians." The report from Reuters identified people internal to the investigation who said it "bore the hallmarks" of known Russian hacking groups. One could argue that isn't sufficient evidence, fine, but nobody is saying people are just assuming it's the Russians because it's a sophisticated attack.
    - tpmx 6y ago
      > The report from Reuters identified people internal to the investigation who said it "bore the hallmarks" of known Russian hacking groups. I too believe that report. That's not what we're discussing though - the supposed straw man was "experts on TV are saying this hack was so sophisticated it could have only been done by the Russians". What I'm saying is that many countries and companies have the capability to perform something like this. Not that Russia didn't do it.

arkadiyt 6y ago

This password to their FTP server would have allowed you to upload arbitrary executables, but they still wouldn't be signed like a valid SolarWinds update would be, so it seems unlikely to be related to the recent hack. The real attack compromised SolarWinds' build server, as they self-reported in their SEC filing [1]. [1]: https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/6dd04fe2-7d10-4632-89f1-eb8f932f6e94.pdf https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/6dd04fe...

hn_throwaway_99 6y ago
Really, really, really looking for the eventual analysis of how the attackers were able to compromise SolarWinds' build server. And to that point, while SolarWinds' bending over backward to characterize it as "an incredibly complex and sophisticated attack" is predictable, it's also ludicrous without saying how the initial intrusion occurred. That is, everything I've read has explained how the actual payload that was delivered to the victims' networks was sophisticated and complex, but it's possible the original build server vulnerability was braindead simple. We just don't know until that is revealed.
- redis_mlc 6y ago
  > compromise ... build server The first think I think of is Jenkins running on a public IP?
- Animats 6y ago
  Now that it's come out that SolarWinds's default password on their deployed systems was 'solarwinds123', it's quite possible that the break-in to their build server wasn't all that hard.
  - foolmeonce 6y ago
    It also doesn't really matter if I understood correctly AFA establishing incompetent defense for simple attacks. You could ftp in and upload a binary? but it wouldn't be signed! What about an old binary? Already we are into attacks on the anti-rollback on individual clients and we didn't need anything a beginner wouldn't try. (I would go so far as to say that if there was insufficient anti-rollback and they still burned 0-days to get into that build server then they were expending resources trying to either look sophisticated or had some other odd motivation.)

loceng 6y ago

All internet companies should require security insurance, and insurance companies should be a required vector for submitting security vulnerabilities.

olefoo 6y ago
This is an idea that should be explored more fully. The downside is that it will make information technology a much less freewheeling and innovative field.
- tpmx 6y ago
  It's a massive innovation killer downside. How about we restrict this to "all internet companies selling security software to governments", at the very widest? Also: It doesn't fix the problem.
  - olefoo 6y ago
    Construction companies seem to do fine even though building codes exist. It's not uncommon for a mature industry to face a reckoning around damaging practices that were common when they were nascent industries. Would you like to live below a dam that was built under a loose and permissive regulatory regime? How about storing sensitive personal data in a datacenter whose owner specifically disclaims liability for it's exposure?
    - Aerroon 6y ago
      >Construction companies seem to do fine even though building codes exist. They're not the one's paying for it. The people wanting the building built are. And there's a lot of corruption in that. On top of that, there's a pretty clear housing crisis in big cities. I'm unsure whether that's the industry to follow.
javert 6y ago
This is the kind of idea that killed the American medical system. It's a bad idea to create insurance monopolies. Unless you are a corrupt regulator, corrupt insurance company exec, or corrupt officer in the industry being targeted. Then, you can fine tune it to maximize your take and punish the downstream customers. Like how the American medical system works.

naveen99 6y ago

Here is a simple way to monitor your machines for intrusions or malpractice by insiders: Put an amount of bitcoin on each machine , equal to licensing fees you would pay for backdoored security tools like solar winds. Monitor the bitcoin address for when it gets stolen. If it gets stolen, you have been owned.

skissane 6y ago
A nation state actor will steal all your data and leave the bitcoin untouched.
- naveen99 6y ago
  The nation state isn’t going to know which bitcoins their agent stole... the agent can take both data and bitcoin. No one will talk about the bitcoin to the outside world.
  - skissane 6y ago
    Do you think offensive black hats employed by governments aren't closely monitored by their employers? It doesn't matter whether the attacker works for China, Russia, the US, whoever – they are likely sitting in a very secure building owned by a military branch or intelligence agency, absolutely everything they do is closely monitored by their superiors (spy agencies love to spy on their own spies), they aren't allowed to take personal electronic devices into the building and they are physically searched on entry and exit. Do you think, working in that kind of environment, they'll find it easy to steal their target's bitcoin? Do you think their superiors will look kindly on agents compromising operations for personal financial gain?
    - naveen99 6y ago
      You mean like secret service agents: https://www.justice.gov/usao-ndca/pr/former-secret-service-agent-sentenced-scheme-related-silk-road-investigation https://www.justice.gov/usao-ndca/pr/former-secret-service-a...

dmix 6y ago

These stories always follow the exact same pattern. It's weird. This is why I got burnt out of infosec.

vondur 6y ago

Would something like 2FA have been helpful for those with write access to the build servers?