5 ms·

I'm actually really curious now if the GitHub repo where the password was found was the initial cause of the breach. The article doesn't make this clear, but t

I'm actually really curious now if the GitHub repo where the password was found was the initial cause of the breach. The article doesn't make this clear, but the original Twitter post[1] does: it was a password that allowed FTP uploads to downloads.solarwinds.com (the same DNS name as where the backdoored updates came from[2]). Vinoth Kumar (mentioned in the article) uploaded a PoC text file which could then be downloaded over HTTP. His screenshot has the repo name redacted, but if SolarWinds accidentally included their code-publishing credentials, maybe the signing key for their code was also in that repo at some point? I've seen that kind of thing before, even if I had to grep through old commits to find it. [1] https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/1338431183588188160 [2] https://twitter.com/Andrew___Morris/status/1338614208905302021/photo/1 https://twitter.com/Andrew___Morris/status/13386142089053020...

blincoln 6y ago
I did a bit more research, and found that it wasn't an official SolarWinds GitHub repo. It seems to have been an employee's personal repo containing company code that they accidentally made public.[1] The original URL of the file with credentials in it was https://github.com/xkozus00/mib-importer/blob/master/Src/Lib/PurgeApp/PurgeApp.exe.config https://github.com/xkozus00/mib-importer/blob/master/Src/Lib... .[2] That is, the credentials were part of a utility/library that was only being referenced by the project, but it was still included in the repo. SolarWinds historically hasn't provided a tool to import arbitrary MIB files into their product. Customers seem to submit them to SolarWinds support, and if support agrees, they seem to use internal tooling (presumably the mib-importer) to import them into the official MIB database.[3] Building some sort of official release data could easily require the use of a signing key, and a company that uses "solarwinds123" as their code-publishing password seems likely to use the same key for multiple purposes, but I didn't find any conclusive evidence, and it's certainly possible the two incidents aren't related. [1] https://savebreach.com/solarwinds-exposed-ftp-credentials-back-in-2018-says-security-researcher-vinoth/ https://savebreach.com/solarwinds-exposed-ftp-credentials-ba... [2] The Wayback machine has a few entries archived, but none of the interesting/conclusive information, see: https://web.archive.org/web/*/https://github.com/xkozus00/mib-importer/ https://web.archive.org/web/*/https://github.com/xkozus00/mi...* [3] https://documentation.solarwinds.com/en/success_center/NPM/content/Core-Downloading-the-SolarWinds-MIB-Database-sw3581.htm https://documentation.solarwinds.com/en/success_center/NPM/c...

blincoln 6y ago

I did a bit more research, and found that it wasn't an official SolarWinds GitHub repo. It seems to have been an employee's personal repo containing company code that they accidentally made public.[1] The original URL of the file with credentials in it was https://github.com/xkozus00/mib-importer/blob/master/Src/Lib/PurgeApp/PurgeApp.exe.config https://github.com/xkozus00/mib-importer/blob/master/Src/Lib... .[2] That is, the credentials were part of a utility/library that was only being referenced by the project, but it was still included in the repo. SolarWinds historically hasn't provided a tool to import arbitrary MIB files into their product. Customers seem to submit them to SolarWinds support, and if support agrees, they seem to use internal tooling (presumably the mib-importer) to import them into the official MIB database.[3] Building some sort of official release data could easily require the use of a signing key, and a company that uses "solarwinds123" as their code-publishing password seems likely to use the same key for multiple purposes, but I didn't find any conclusive evidence, and it's certainly possible the two incidents aren't related. [1] https://savebreach.com/solarwinds-exposed-ftp-credentials-back-in-2018-says-security-researcher-vinoth/ https://savebreach.com/solarwinds-exposed-ftp-credentials-ba... [2] The Wayback machine has a few entries archived, but none of the interesting/conclusive information, see: https://web.archive.org/web/*/https://github.com/xkozus00/mib-importer/ https://web.archive.org/web/*/https://github.com/xkozus00/mi...* [3] https://documentation.solarwinds.com/en/success_center/NPM/content/Core-Downloading-the-SolarWinds-MIB-Database-sw3581.htm https://documentation.solarwinds.com/en/success_center/NPM/c...