11 ms·
SolarWinds: The more we learn, the worse it looks
- burnthrow 6y ago> It's nice that Microsoft is admitting that the open-source approach is the right one for security -- something I and other open-source advocates have been saying for decades. But, inner source isn't the same thing as open source. I thought this was common knowledge, but in a previous related thread my comment saying the same was downvoted with some replies about how MS engineers are security gods or some such. Interesting to contrast mainstream tech coverage with HN's RSU echo chamber.
- A4ET8a8uTh0 6y agoI did notice that the initial coverage of the hack blamed open source tools ( which was interesting in itself ). I am not sure if I can ascribe it to malice though.
- lolsal 6y agoI was under the impression the argument against OSS from MS was not due to software security, but due to protecting IP.
- vehementi 6y agohttps://en.wikipedia.org/wiki/Solar_Winds https://en.wikipedia.org/wiki/Solar_Winds the correct definition of solar winds
- recursive 6y agoIt's also the name of a company. https://www.solarwinds.com/ https://www.solarwinds.com/
- lordnacho 6y agoKinda apt to name it after a phenomenon that causes communications outages
- JorgeGT 6y agoYes, like people using Icarus as a company/product name in the aerospace sector.
- Izkata 6y agoOr the Trojan condom
- _trampeltier 6y agoMaybe Solarwinds is just another Crypto AG? The name a bad joke, who knows ;->
- vehementi 6y agoYes I didn't miss that crucial part of the title... I just wanted to throw back to a childhood game :)
- bastard_op 6y agoMost every .gov workshop is a windows shop, and will mandate windows software, been here many times. Solarwinds is a good microsoft slave, and not horrible for network management software, but not so much up on security as selling software. I know several Solarwinds shops including 2 current customers struggling with whether to crap can it, or rebuild and move forward until the next atrocity. Dealing with Solarwinds for some 15 years, it's typical Windows software - not so much security, but sell more of all our things, get paid.
- PeterisP 6y agoIt's worth to note that from the perspective of the involved companies all this incident was much ado about nothing and no incentive to change anything. Sure, some of their customers or customers' customers got exposed to attackers, and some government secrets may have been lost, and some of their tech employees had to do a bit of overtime and "reputation was harmed", but so what, why should they care? Is there any material impact on the company finances? Currently it does not seem that it's going to destroy their future sales and ongoing licencing revenue, and it does not seem that they are going to have any huge liabilities for negligence. If anything, the consequences (or lack of them) to SolarWind and other historical breaches are a good illustration that in the current business environment intentionally cutting corners on security is a smart move as it saves you money but if you get used to harm many others then you just shrug, do some apologetic PR and move on, and the impact of reputation damage is small and fleeting.
- hpoe 6y agoI've started realizing this since the Exquifax breach. There is no point for companies to take security seriously because what the flip does it matter for them? They'll bohoo about how bad it was, fire their security people bring in new ones and nothing will change. In short if you are in the security field at this point you aren't being brought in to secure or stop anything you're there for upper management to point the blame at when the attack does occur. Because spending money on security cuts into revenue and profits and unlike not investing in paying off technical debt this has no material consequences.
- wwright 6y agoSecurity deficiencies are technical debt
- hpoe 6y agoThey are technical debt with no monetary impact however. If my servers crash and I have downtime because customers can't use my website or product that's a problem. If I suffer a massive security breach and loose all of my customers personal information, I am not going to face any consequences.
- intern4tional 6y agoThe article makes many jumps and some false claims. Example: "Russia, we now know, used SolarWinds' hacked program to infiltrate at least 18,000 government and private networks. The data within these networks, user IDs, passwords, financial records, source code, you name it, can be presumed now to be in the hands of Russian intelligence agents." Reality from the linked source: "The breach is far broader than first believed. Initial estimates were that Russia sent its probes only into a few dozen of the 18,000 government and private networks they gained access to when they inserted code into network management software made by a Texas company named SolarWinds. But as businesses like Amazon and Microsoft that provide cloud services dig deeper for evidence, it now appears Russia exploited multiple layers of the supply chain to gain access to as many as 250 networks." There's a big difference between 250 and 18000. Further it claims that the source code access is significant. As noted in this thread: https://news.ycombinator.com/item?id=25599210 https://news.ycombinator.com/item?id=25599210 all major Governments have had read access to the source code for Microsoft products for years. The hack is extremely serious and for that reason it merits accurate claims, response, and technical actions. Fearmongering like this article does to push an opinion piece is not it.
- PeterisP 6y ago18000 customers downloaded the backdoored version so the attackers got access and could have gone into any and all of these networks. As far as we know, they did move forward in 250 or so and did not proceeed with the others (presumably because of resource constraints) - but still all those 18000 networks were infiltrated by the malware, and if I was one of these 18000 companies then I would not just assume that we got skipped - so at the very least that should result in 18000 careful audits to verify if the potential intrusion happened.
- djsumdog 6y agoThere was a 10~14 day time delay before it connected to its CNC. It minimized network traffic and was probably only activated for targets deemed worthy. People with a weapon like that don't want to be detected unless there is a viable target.
- 6y ago
- blindm 6y ago> Russia, we now know, used SolarWinds' hacked program to infiltrate at least 18,000 government and private networks. The question of whether it was Russia is not that interesting. This thing of countries blaming other countries for attacks is getting boring. In cyber, there are no borders. If something is vulnerable, it's vulnerable. You don't need the prerequisite of APTs or 'sophisticated nation state cyber threat actors' or whatever. Attribution is boring these days and so much emphasis on Russia as if we don't know already they have their fingers in so many American pies.
- coding123 6y agoSure it might be boring to find out any specific hack is China or Russia, etc... but where that becomes important is the fact that whatever secrets that get stolen, the country does in fact matter. Think of it this way - if the government of the country you live in places a bounty of say ($2000 USD or that country's equivalent) for each top secret document - it both places a high value target on us, as well as revealing the things that they DONT know. I mean, specifically do you know of the latest in Fort Knox's security protocols? Do you know the latest in high powered microwave weapons that we're developing (and how to make them)? These are things we really don't want additional countries knowing how to make.
- jc01480 6y agoThe real threat is the IP obtained about leaders in key positions that will be used to blackmail the same. While that’s more of a Chinese tactic, Russia and others dabble here as well. One could say they simply instituted Assange doctrine for institutional purposes.
- naikrovek 6y ago> This thing of countries blaming other countries for attacks is getting boring. In cyber, there are no borders. Technically correct, and very wrong in all other ways. Who performs the attack is a very real concern, because unlike some of us, the attackers likely have lofty goals in the real world which are aided greatly by their successes in "cyber." (I maintain that anyone who uses the word "cyber" seriously today doesn't understand what they're talking about, in virtually all cases. It's fine to not understand stuff, by the way. Just be open to learning more.) If Russia is able to find holes in Windows, the OS used by nearly every business on the planet, they will use those vulnerabilities to their advantage in whatever ways they require. They will obtain personal information about people, blackmail them, maybe. Who knows. Russia and others WANT to take down those who disapprove of them quite strongly. They potentially want to bring low anyone who has spoken bad about them publicly (if so, I'm screwed) or anyone who could have helped them in some way and chose not to. North Korea, Iran, Saudi Arabia, Russia (perhaps to a lesser extent) have real beefs with the US. Information gained via incredibly catastrophic breaches like this one give real countries with real weapons real leverage against others, potentially. Especially if the vulnerability opens more doorways that would otherwise not have been accessible. I've been divorced twice. DO NOT UNDERESTIMATE the lengths that people will go for revenge for even the smallest slights. Some people get absolutely drunk on the slightest bit of power they have over others, and they know that, so they accumulate leverage against their enemies, real or imagined, continually in anticipation of a time when it will be useful. In short: this is a big deal. It matters who is behind it.
- x87678r 6y agoDo we even really know it was Russia? Everything I've seen so far seems to assume that rather than have a confirmed link. edit: source seems to be Washington Post article "according to people familiar with the matter, who requested anonymity" https://web.archive.org/web/20201213220635if_/https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html https://web.archive.org/web/20201213220635if_/https://www.wa...
- crocodiletears 6y agoNot that I've been able to discern. But why live in a world of ambiguity when you can blame everything you don't like on a central antagonist'
- jkhdigital 6y agoI treat anonymously sourced news articles as a coin toss nowadays—assume a 50% chance that the claims in the article are unqualified truth.
- 9wzYQbTYsAIc 6y agoNot a good read - more like a rant, light on substance, and stretches some things.
- anigbrowl 6y agoThis is a terrible article. It is just a rehash of information that was public 2 weeks ago with a couple of scare quotes. I should have known better than to expect news from zdnet though.
- ed25519FUUU 6y ago> Russia, we now know, used SolarWinds' hacked program to infiltrate at least 18,000 government and private networks. The data within these networks, user IDs, passwords, financial records, source code, you name it, can be presumed now to be in the hands of Russian intelligence agents. Yep. I'm SURE it was just Russia. It's not like our government is perfectly happy squirreling away CVEs so our own intelligence agencies can exploit them themselves.
- mastazi 6y agoThis article seems to be poorly written. For example, I have no idea what the author wanted to say here: For decades, one of proprietary software's stupid assumptions is that "security by obscurity" works. While it can help -- no, really it can if used intelligently -- that's not the case with proprietary code.
- osgovernment 6y agoYou can do both. PIE: https://en.wikipedia.org/wiki/Position-independent_code#Position-independent_executables https://en.wikipedia.org/wiki/Position-independent_code#Posi... Obfuscation: https://en.wikipedia.org/wiki/Obfuscation_(software)#Obfuscating_software https://en.wikipedia.org/wiki/Obfuscation_(software)#Obfusca...
- djsumdog 6y agoI'm glad there are others who are challenging the Russian narrative in here. I'm sure many of us watched the original SANS broadcast (which wasn't for public release; youtube-dl is a great tool. I download everything before I start watching it now before it disappears). In the SANS report a research tries to discredit people who claim this is CIA or a US state sponsored operation, yet also claim there is clear evidence of a "signature" from "Cozy Bear" ... what is this signature? Shell code? A known compiler flag? FireEye and SANS have released zero information on this or anything that connects things to Cozy Bear. Also from that report, there were excluded IP ranges that were all Microsoft IPs (not all of the Microsoft IPs, but all the ranges belonged to Microsoft). Vault 7 shows the NSA and CIA are involved in domestic operations (and if you go back far enough Church Committee) and there is a chance this was a US based State Actor. Let's not forget about STUX. The level of this attack was incredibly sophisticated. It had built-in delays for several days to avoid network sandboxing tests in the CI/CD pipeline. It was signed and released from Solarwinds CI/CD pipleine as well. Let's not dismiss Snowden so easily and not realize this could have been an American state actor as well (or even the UK, the EU or any other "allay" or enemy).
- lemonspat 6y agoSo your theory is, because they didn't release the Cozy Bear signatures, that it must be CIA/NSA? That's a huge stretch to the opposite side of the conspiracy. How do you explain the hacking of the Treasury and other government agencies in your scenario?
- djsumdog 6y agoI'm just wondering what the hell a "signature" is in this context? You think Cozy Bear is leaving their name in the binary? It's just a lot of security-by-obscurity hand waving. It's FireEye spewing out stuff as "facts" with very little evidence.
- iou 6y agoA signature in this context nearly always means an IoC: https://en.wikipedia.org/wiki/Indicator_of_compromise https://en.wikipedia.org/wiki/Indicator_of_compromise Which in weak cases can be an artifact observed throughout the attacks though not necessary for the behaviour to occur (e.g. compiler timestamp), and in strong cases the artifact is tied directly to the malicious behaviour (e.g. explicit registry key or anti-infection marker)
- flowerlad 6y agoDoes it strike anyone as odd that SolarWinds has a Vice President of security? Note that this company develops network and infrastructure management software and their updates are automatically pulled and installed by their customers. Every VP at such a company needs to be a VP of security, and every engineer needs to be a security engineer. Not understanding that is problem #1. Having a Vice President of Security at a company like this is a bit like having a "Vice President of Profit". Just as profit is everyone's job, so should security, at a company like this. If Target or Costco has a VP of Security that's understandable because security is not integral to their products, but for SolarWinds it should have been.
- Skunkleton 6y agoIt's probably a matrixed organization. There is just a VP with this focus because it is "very important".
- FpUser 6y agoLevel of reporting in this article seem to target unicellular protists. Congratulations ZDNet, real journalists of the past must be turning in their graves.
- adelarsq 6y agoThis appears to be fake news or clickbait. So many false info. This event appears not related to any country. Someone interested on sell private data would do something like this.
- chiefalchemist 6y agoThis is what happens when you put all your eggs in one basket. Centralization and emphasis on scale comes with risk; especially when technology and security are involved. It was only a matter of time.
- sloshnmosh 6y agoHas there been any evidence released to the public that shows how and why the Russians are being attributed to the SolarWinds hack? I’ve looked at the source code that Microsoft and others have realeased of the initial backdoor but I don’t see anything in those few lines that can positively attribute to anyone. In fact, the only thing that looked familiar was the crypto that was used to create the sub domains on the fly that hid the victims Fingerprints looked similar to what has been used in mobile malware created by China but that is still too flimsy to attribute anyone to as well.
- jc01480 6y agoMethods utilized in this compromise are consistent with known attributed methods used in breaches not disclosed.
- sacks2k 6y agoThe Dominion company (behind the voting machine software in the US) used Solarwinds. It was plastered on many of their websites. It was removed the day this hack went public. I don't believe in coincidences.
- carboniferous 6y agoWhat exactly are you implying?
- sacks2k 6y agoYou can put the pieces together. Why aren't we hearing about this on the news?
- deleted 6y ago[deleted]
- AnimalMuppet 6y agoStop vagueposting. If you've got a point, state it. Don't make us guess.
- sacks2k 6y agoSince you can't actually figure out the most obvious point ever made in a comment. The Dominion company used Solarwinds, which could have directly affected our elections after multiple companies were breached from the hack. In Georgia, a security professional proved that machines were not only attached to the Internet, but were getting updates from servers outside the country and had the ability to be updated in real-time. This was never investigated.
- AnimalMuppet 6y agoThank you. I could figure out most of that, but I resent the "I ask questions and expect you to figure it out" format, no matter who does it and what point they're pushing. And in fact you supplied some details that I did not know and would not have guessed.
- teloli 6y agoInteresting that the US would outsource tasks critical in terms of national security to an external private company even though the American Department of Defense is the largest employer in the world, public or private. Don’t they have enough people in the payroll to write their own remote management software?
- vasuki 6y agoNot that we have public evidence to prove whether it was a nation-state or not, but in my experience as a vulnerability researcher, finding high-impact flaws in popular tools (closed + open source) and government services is much more easier than people realize. Take a look at the number of vulnerabilities reported to US Department of Defense via Hackerone: https://hackerone.com/deptofdefense/hacktivity?filter=type%3Apublic&type=team https://hackerone.com/deptofdefense/hacktivity?filter=type%3... (and these are just the ones publicly disclosed, a lot of them remain undisclosed, you can change the filter to see how many are reported in last few days/hours) And taking this single report as example: https://hackerone.com/reports/761790 https://hackerone.com/reports/761790 Reported at: December 19, 2019 4:19pm +0000 Resolved: 1 Month ago And this is when there is no bounty attached to these, just some Hackerone points which help you gain higher reputation and possibly win some private program invitations. Imagine how many reports a monetary reward would bring in. I would really be surprised to know that adversaries are not already hoarding the flaws, especially when this is their daily business.
- coold 6y agoAh, good old cold-war-like hysteria about "evil" russians. But ussr doesn't exist for 30 years and russia does not have ANYTHING close to what Snowden revealed exist in USA.
- TurkishPoptart 6y agoYes they do. Source: https://en.wikipedia.org/wiki/The_Red_Web_(book) https://en.wikipedia.org/wiki/The_Red_Web_(book)
- thatfunkymunki 6y agoThis is either intentional misinformation or very poorly researched. Russia's surveillance capabilities are well established, e.g. https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/SORM