4 ms·

On a semirelated note, what's with all the articles claiming the attack represents an extreme level of sophistication? It sounds like the execution was skilled

by ahepp 6y ago

On a semirelated note, what's with all the articles claiming the attack represents an extreme level of sophistication? It sounds like the execution was skilled, but I haven't heard anything yet that seems technically novel or extraordinary. Maybe I haven't read the right articles, but it sounds like solarwinds got pwned, and all these big targets loaded the malware onto their own networks... Again, skillful execution, but it's not like they cracked an encryption algorithm or even did known-but-still-awesome exploits like rowhammer/spectre

ballenf 6y ago
If Amazon's research is correct that 250 companies were targeted, that indicates just as a matter of a scale there had to be significant resources behind the effort. I'd call that sophisticated even if just in terms of organizational efforts. Additionally, doing this and not getting caught for 6 months or whatever takes significant discipline from every single person involved. You don't see that level of size, discipline and organization outside a handful of top companies.
- nitrogen 6y ago
  I haven't been following this story very closely. Was each and every organization individually targeted after the SolarWinds compromise was in place, or was it sort of opportunistic and automated, where the SolarWinds compromise phoned home and most of the 250 orgs just got automated/scripted escalation and exfiltration, and only a few orgs got personal attention?
  - SAI_Peregrinus 6y ago
    Something like 18,000 orgs got compromised IIRC, but the 250 are the ones where they chose to actually activate secondary payloads. So 250 got personal attention.
Sattanics 6y ago
Most likely attack on open port, then they sent automated some social engereening stuff, and while looking at it later they've found some fish to fry. Sorry for my English here, too complicated times from Finnish speaker.
hn_throwaway_99 6y ago
There are 2 separate things going on, which often get conflated: 1. The actual malicious payload that was installed on the compromised networks was very sophisticated. It was discussed in the HN post when the news first went live, but the payload went to great and pretty ingenious lengths to hide its tracks and prevent detection. I remember a bunch of HN comments along the lines of "Wow, how did the companies ever even find that?!" 2. How SolarWinds was originally breached hasn't been released, and while the "solarwinds123" password is an unrelated issue, it does point to a pretty shocking lack of security culture at SolarWinds. I'm going to put my chips down on the original breach being quite simple and mundane, but SolarWinds will go (and has already gone) to great lengths to emphasize the sophistication of the attackers to try to deflect blame.

by ahepp 6y ago

ballenf 6y ago

If Amazon's research is correct that 250 companies were targeted, that indicates just as a matter of a scale there had to be significant resources behind the effort. I'd call that sophisticated even if just in terms of organizational efforts. Additionally, doing this and not getting caught for 6 months or whatever takes significant discipline from every single person involved. You don't see that level of size, discipline and organization outside a handful of top companies.

nitrogen 6y ago
I haven't been following this story very closely. Was each and every organization individually targeted after the SolarWinds compromise was in place, or was it sort of opportunistic and automated, where the SolarWinds compromise phoned home and most of the 250 orgs just got automated/scripted escalation and exfiltration, and only a few orgs got personal attention?
- SAI_Peregrinus 6y ago
  Something like 18,000 orgs got compromised IIRC, but the 250 are the ones where they chose to actually activate secondary payloads. So 250 got personal attention.

Sattanics 6y ago

Most likely attack on open port, then they sent automated some social engereening stuff, and while looking at it later they've found some fish to fry. Sorry for my English here, too complicated times from Finnish speaker.

hn_throwaway_99 6y ago

There are 2 separate things going on, which often get conflated: 1. The actual malicious payload that was installed on the compromised networks was very sophisticated. It was discussed in the HN post when the news first went live, but the payload went to great and pretty ingenious lengths to hide its tracks and prevent detection. I remember a bunch of HN comments along the lines of "Wow, how did the companies ever even find that?!" 2. How SolarWinds was originally breached hasn't been released, and while the "solarwinds123" password is an unrelated issue, it does point to a pretty shocking lack of security culture at SolarWinds. I'm going to put my chips down on the original breach being quite simple and mundane, but SolarWinds will go (and has already gone) to great lengths to emphasize the sophistication of the attackers to try to deflect blame.