23 ms·
SolarWinds hack was 'largest and most sophisticated attack' ever: MSFT president
- MattGaiser 6y agoI thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?
- Craighead 6y agoMaybe do just a few minutes of research before first posting on a thread about state sponsored cyber crime. The actual "hack" was a supply chain hijack, the actors inserted malicious dll code through a solarwinds authorized developer workstation, thus ensuring the code would be signed, and then pushed as a legitimate update to the downstream implementations of solarwinds.
- sebmellen 6y ago·
- jjcon 6y agoWeak passwords had nothing to do with the hack
- stevemk14ebr 6y agoThe whole weak password thing was simply a funnily timed thing some guy found. It had absolutely nothing to do with the malicious update, which was the source of this supply chain attack. For some reason a bunch of people online decided that two things happening around the same time means they are related. They are not
- MattGaiser 6y agoAh ok. So the password was just an easy to understand sideshow. Thank you.
- oefrha 6y agoNo, “a bunch of people online” decided that if you have jarring security practices in one avenue, it’s totally unsurprising if it turns out that you have other doors wide open too. Which is a completely reasonable assumption.
- stevemk14ebr 6y agoIt can definitely be said that this may be an indicator of a larger security issue at the company. But assuming that issue is the cause for the backdoor, yes that is a leap, and an unfounded one. Correlation != Causation, and it's always unreasonable to assume otherwise.
- canardlaquay 6y agoSee it like stealing from a museum: very easy to break in (weak password -> breaking a window), hard to get out of here with all the paintings unnoticed - and that, on a daily basis. The amount of effort and different techniques they've put in to remain undetected for months (years?) while infecting a lot of actors is pretty impressive.
- Ardren 6y agoThere had been a weak password on the update server in the past. The compromised update however was introduced via the build system before being signed and distributed https://www.sec.gov/Archives/edgar/data/0001739942/000162828020017451/swi-20201214.htm https://www.sec.gov/Archives/edgar/data/0001739942/000162828...
- deleted 6y ago[deleted]
- jdxcode 6y agoConvince me it’s more sophisticated than Stuxnet.
- rafale 6y agoAgreed. It's amazing how they managed to infect air gapped computers. How do you even test something like that before the actual attack.
- millzlane 6y agoCompromise an employee.
- wwww4all 6y agoMost people know which countries developed stuxnet and used compromised human agents to place the infected drives into the target system. The sophistication of the malware required state powers and assistance of the industrial company that manufactured the control systems. Those systems are not cheap and reverse engineering the control system software required detailed knowledge of the embedded hardware and software.
- talhah 6y agoFrom what I've read and heard about the attack in the past, they had managed to find the supplier and had confiscated some blueprints or the actual structures (nuclear reactor?) that was used and then reverse engineered it from there with the help of nuclear scientists to find vulnerabilities in it.
- _kbh_ 6y agofrom what I understand, they have the same controller that was being used in the centrifuges on their desk to develop the payload the rest was just a way to get to the controllers of the centrifuge which was rather standard.
- stevemk14ebr 6y agoIt's not a zero sum game. It is interesting in that it marks the first _wide spread_ attack on a supply chain via cyber space. The malware's DNS signaling protocol is pretty neat, which you can look at here: https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html https://www.fireeye.com/blog/threat-research/2020/12/sunburs...
- jjcm 6y agoLargest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I'm missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack. [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- kmonsen 6y agoI guess they mean latest hack we have been the target of? Stuxnet was custom written malware targeting Iran, so yes I would agree with you but perhaps what he was trying to say is still true.
- stevemk14ebr 6y agoThe attack is unique in its usage of the supply chain. The malware is not 'sophisticated' in the same way stuxnet is because it has different goals. This actors goals align with stealth above all else, which is evident in both the design of the malware and the choice of the supply chain delivery vehicle. Also realize that the network comminication scheme used attempts to blend in with the legitimate SolarWinds software. If you design a stuxnet like malware and deploy it to 18k+ companies it will be found, because exploiting zero days left and right is super noisey. This malware was minimal. It's cool in a different way
- foolfoolz 6y agoit’s also interesting a value prop of solar winds is traffic monitoring
- mike_d 6y agoStuxnet was also a supply chain attack. The first infections were at Foolad Technic and Behpajooh, a pair of privately owned engineering firms. The malware keeps a "breadcrumb" trail of each machine it infects, and based on investigations by Symantec [1] it was determined that every Stuxnet sample from Natanz originated from outside suppliers. 1. https://tinyurl.com/1eswo98i https://tinyurl.com/1eswo98i
- qzw 6y agoI guess nobody gets pwned by high school kids just screwing around anymore. Every hack is now the "most sophisticated ever" by the "most technologically advanced state actor ever" to break the "most secure six-character password ever."
- JohnJamesRambo 6y agoI checked again and their website still looks like something made by an AI using a template. https://www.solarwinds.com/ https://www.solarwinds.com/ We’re Geekbuilt.® Developed by network and systems engineers who know what it takes to manage today's dynamic IT environments, SolarWinds has a deep connection to the IT community. The result? IT management products that are effective, accessible, and easy to use.
- jessaustin 6y ago"Accessible" is a good word. Almost invites speculation as to whom they're accessible. More fitting than "secure", anyway.
- 0xy 6y agoSolarwinds' former VP of Security posted a blog post entitled "Do Your Vendors Take Security Seriously?" [1] while, according to reports, being totally pwned from floor to ceiling. [1] https://www.solarwindsmsp.com/blog/do-your-vendors-take-security-seriously https://www.solarwindsmsp.com/blog/do-your-vendors-take-secu...
- deleted 6y ago[deleted]
- ThePadawan 6y ago> their website still looks like something made by an AI using a template. This is every website of any company selling to enterprise customers. It's incredibly frustrating as a reader. I imagine anytime someone actually answers the question "Yes, but what do you do?", they get fired.
- xirbeosbwo1234 6y agoI find it curious that they would quote an executive on this. I doubt any of them have gotten their hands dirty on real code in years. Microsoft alone employs thousands of people more qualified to speak on the subject.
- boomboomsubban 6y agoThe executive is also an attorney, clearly relevant technical expertise wasn't how they chose someone to go on 60 monutes
- IgorBog61650384 6y agoThe SolarWinds incident was detect because of bad opsec by the operators who performed the FireEye op. I would image the capability was developed by an expert group in some intelligence agency, and then used as an entry point by a different operator group with lower standards. But who is to day there aren't more of this kinds of attacks out there, just no one has made a foolish error using them yet? If we assume that, we have to assume this operation was somewhere in the middle of a normal curve of complexity, and there are even more sophisticated backdoored systems like that we just don't know about. Imagine any medium-large code base (100+ of KLoCs), that is deployed widely, and has an auto update mechanism. Most companies don't have very strict access to the build process (and even if they do, all you need is to corrupt one employee), so it shouldn't be to hard to patch binaries before they are signed (especially bytecode in .NET and Java) , and add another URL and/or signature for verification (for sig only the attacker needs access to the web site/CDN too). The change will be only a few lines, so is very hard to detect automatically - it will look like regular code for tools.
- goshx 6y agoNot sure I agree... kids in early 2000’s were hacking and controlling backbones just for fun but you didn’t hear about it.
- adolph 6y agoA16Z podcast coverage of the topic: https://a16z.simplecast.com/episodes/solarwinds-anatomy-of-hack-supply-chain-compromise-cloud-security https://a16z.simplecast.com/episodes/solarwinds-anatomy-of-h...
- lamestreetmedia 6y agoI listen to Scott Locklin. It appear to me A16Z more sophisticated threat to world than Russians even CIA combined.
- mianos 6y agoI just listened to this. Normally I like the A16Z podcast but this one was way below the normal standard. Just because they were organised, tested the exploit before they released it over a wider area it must have been a nation state? It is as if a group of mates who codes a hack like this for a hobby/interest are disorganised have no experience in delivering software? Such ignorance for a self confessed expert. Scary.
- ed25519FUUU 6y agoThere’s no reason to believe that our government intelligence agencies wasn’t also actively exploiting the solarwinds vulnerability.
- Aaronstotle 6y agoI feel like this Solarwinds breach was a low effort, extremely high reward move, sort of like how Russia only had to spend 100k on ads in 2016 to get a massive reach on Facebook. I wouldn't think say this is the most sophisticated attack, this sounds more like they are embarrassed they were hacked for a year before they realized it and have to save face
- Terretta 6y ago> “I think from a software engineering perspective, it’s probably fair to say that this is the largest and most sophisticated attack the world has ever seen,” Smith said. The word “seen” is doing a lot of work there. (Think, probably, and fair, are doing some too.)
- atlgator 6y agoConsidering how many security defects and malware have plagued Windows for so long, Microsoft is virtue signaling the hell out of this.
- killjoywashere 6y agoThe largest and most sophisticated attack is still out there, we just haven't detected it yet.
- EnderWT 6y agoThis article is a summary of the 60 minutes interview: https://www.cbsnews.com/news/solarwinds-hack-russia-cyberattack-60-minutes-2021-02-14/ https://www.cbsnews.com/news/solarwinds-hack-russia-cyberatt...
- tptacek 6y agoI mean, it's 100% going to happen again, and it was plainly obvious it was going to happen to begin with. We did a Black Hat talk about this (checks notes) 14 years ago, after being paid by a client to audit something like 12 different agent-based management systems: https://web.archive.org/web/20061215050427/http://www.matasano.com/log/646/matasano-security-recommendation-001-avoid-agents/ https://web.archive.org/web/20061215050427/http://www.matasa... Agent-based endpoint management is super convenient and is mainstream in modern IT management. But nobody grows up wanting to write the communications software for enterprise server inventory software, so the code quality on these products, which are ubiquitous, is awful. But 99% of enterprise buyers aren't even slightly motivated by software security when making purchasing decisions, and everyone knows it, so vendors buy fig-leaf audits from vendors who will sell public-facing documents for 2p1w engagements, and IT purchasers, whose performance reviews are based on completing projects and not protecting their companies from $500,000 purchase orders for what is effectively malware, accept those bogus reviews and get on with their lives. Nothing is going to change about this, because nothing is going to alter the incentives. Reporters like Nicole Perlroth will try to blame it on ex-NSA hired guns (as if you needed the exploit chains NSA buys to break any of these systems), but I can't think of any realistic policy that could be applied to stop these kinds of attacks, not without massively disrupting the technology industry at the same time. Best get used to it, is I guess my point. I mean that sincerely, not as a sort of appeal to right the ship; the ship is already upside down.
- quasirandom 6y ago> but I can't think of any realistic policy that could be applied to stop these kinds of attacks, not without massively disrupting the technology industry at the same time Why wouldn't Dan Geer's proposal to attach traditional products liability to closed source software improve the situation? Over time, source availability and reproducible builds should make this kind of thing a lot more difficult without wrecking anyone's budget. No?
- tptacek 6y agoThat would work if we knew how to ship secure software at something resembling the cadence the industry demands, but we do not. We pretend to, and we get away with it because there isn't toothy liability attached to shipping bugs. We are all here, the software people on this site, the beneficiaries of that system. Just very simple things, like reimplementing non-performance-sensitive C software from the 1990s and 2000s in simple memory-safe languages; it can't happen, the budget to make it happen would totally disrupt P&L at large companies; repeat with every well-known risk this kind of code is exposed to. I don't think we know how to solve this problem, which is why I tend to recoil from policy proposals to "solve" it.
- mikewarot 6y agoWere any multilayer capability based secure operating systems compromised? No... Were any in use at all? No So, nothing really sophisticated... just exploiting the bad design of existing operating systems. This will continue for the foreseeable future.
- rautnirmala 6y agogood morning
- rangoon626 6y agogood morning
- cookiengineer 6y agoIf the password for your "military grade" secured infastructure is literally "solarwinds123", I wouldn't say it's a sophisticated attack. It's a more complete picture of how much modern businesses value security or pentesting audits. The answer to that is exactly zero effs. As long as businesses think there is no ROI in security, this will stay the same. The only thing sophisticated about this was that from code to deployment there wasn't any single audit of anyone. And that's a bad joke by any security measurement. If any intruder can stay undetected THAT long, I don't wanna know what's up with MSFTs infrastructure. Must be an open door for everyone, and probably still uses the Perl pre-release based pipeline.
- talhah 6y agoInitial compromise may not have been sophisticated or hard to achieve, the post compromise may have been somewhat sophisticated judging from the attackers operational security.
- mjevans 6y agoFrom casual reading alone, easily an order of magnitude, or two or three such orders, more sophisticated than the development and resources seemingly applied by SolarWinds.
- jzer0cool 6y agonot sure how it is mil grade if an infra allows such a password to begin with.
- kerng 6y agoStuxnet seems to be far more sophisticated. I mean the entire idea of jumping an air gapped network was crazy but it worked. Since Microsoft itself was compromised via SolarWinds angle I'd take the president's statement with a grain of salt and probably less objective than it would be otherwise.
- adrr 6y agoI thought MSFT was compromised due a netlogon exploit not Solarwinds. They hacked office365 which got them into Solarwinds.
- kerng 6y agohttps://www.pcmag.com/news/microsoft-hit-by-solarwinds-breach-says-it-isolated-and-removed-the-malware https://www.pcmag.com/news/microsoft-hit-by-solarwinds-breac... “We have been actively looking for indicators of this actor and can confirm that we detected malicious SolarWinds binaries in our environment, which we isolated and removed,” the company said in a statement.
- adrr 6y agoIt sounds like Microsoft hack happened before Solarwinds. https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
- wly_cdgr 6y agoWhy, it was so sophisticated that not even we at ~ Microsoft ~ could have possibly anticipated and defended against it
- sschueller 6y agoSad that we don't have a media that would have tech experts on staff that could questions such claims.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- sorokod 6y agoReminds me the analysis done on the compromised dll [1]. The injected code looks comically dodgy. [1] https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ https://www.microsoft.com/security/blog/2020/12/18/analyzing...
- WalterBright 6y agoOn "60 Minutes" they reported that the hardware in your computer is likely compromised as well, so new hardware will have to be bought. This has a simple fix I've advocated for years. Put the firmware for disk drives, USB sticks, embedded systems, etc., in ROM. Or at least provide a physical write-enable switch for updates. I have no idea why people responsible for security do not demand this. I would expect them to be really sick and tired of "we have no idea if our firmware is infected or not, because we allow any piece of software to modify the firmware."
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- mjevans 6y agoA literal turn-key switch on the case would work. Turn the key one way to enable firmware updates. Turn it the other to disable them. This should also be easy to replace and come as a standard sized device. As an alternative, a 'security card' slot; similarly easily replaced or with an internal switch depressed re-'paired' to a new key.
- WalterBright 6y agoJust a one cent slide switch will do the job. Even a jumper will do the job.
- mjevans 6y agoCeremony is part of the need for a key or a card. This needs to have weight to average, even sub-average, end users. It must be out of the ordinary. The ceremony must have weight and differentiation from typical activities. True going inside and moving a jumper is fine for those willing to open the case, but it must work on Gradnma's Dell; while under warranty, without voiding the warranty.
- import 6y agoMS: 'Largest and most sophisticated attack'. Reality: 'solarwinds123'
- Turbots 6y agoNot the most sophisticated one in terms of technology, but probably the hack with the widest impact, orchestrated and planned successfully by a hostile nation with a huge set of people. The US is going to see impact of this attack for years/decades to come, and it will cost them a shitload of manyears and money to mitigate the risks caused by this.
- WalterBright 6y agoI've found my experience designing gearboxes for Boeing has applicability to software design. For example, the fundamental idea with airplane design is not to design components that cannot fail, as that is impossible. The idea is to design the system to be tolerant of failure. Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?" This is a fundamental shift in viewpoint. It seems pretty well established that making secure software is impossible. Time to pivot to designing software systems that are tolerant of inevitable security breaches. One example of this is compartmentalization. A single breach must not have access to all the sensitive data. Another is backups must be air gapped (or put on physically read-only media) so ransomware cannot compromise them. Compartmentalization is used in battleship design, aircraft design, spy networks, etc. Time to use it in software systems design. P.S. Just to be clear, one still strives to design airplane parts so they won't fail, it's just that one does not rely on them never failing. P.P.S. It's really really hard to sink a battleship as they are so compartmentalized. See the sinking of the Bismarck and the Yamato.
- icare_1er 6y agoThat's pretty much the concept of defense-in-depth, and breaches like Solar Winds of others like this kind of threat actors, are so sophisticated that they do work around every single aspect of this.
- pornel 6y ago> are so sophisticated Their password was "SolarWinds123". Everyone who gets pwnd tells a story about sophisticated state actors to make it sound like some unstoppable force has hit their impenetrable defences.
- icare_1er 6y ago1/ The article talks about the SolarWinds hack, as the campaign that then targeted Microsoft, the DoJ and others. Not the hack "into" SolarWinds. 2/ For SolarWinds itself, the password is one tiny step along the way. I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender) and getting knowledge of the company's architecture, its internal Repos, etc. You'd have to bypass MFA too at some point, which the attackers did. 3/ If having malware than monitors developers VisualStudio console in realtime to inject a few lines into it so that it gets secretly compiled into their day-to-day work, without breaking the project, while also providing C2 capabilities; if that, is not "sophisticated", i'd be curious to see an example of "sophisticated" malware.
- kortilla 6y agoDo we call it sophisticated to cover up how embarrassing it was and the fact that it lurked in what is an obvious attack vector in retrospect? It just shined a light on how shaky the foundation is we’re standing on. This is relatively tame considering its just some back-doored bolt on software. What happens when it’s the build compiler for the Windows OS? How about the intel NIC firmware? Our only answer seems to be even more automated updates. Yet that means a slip up in chrome build security could compromise tens of millions of people in a week. It’s mind boggling how fragile all of this is. It’s barely safe with insiders behaving correctly. How many people do you think have to sign off on a code change driving the Qualcomm chipset in your phone? My guess is 1, and that’s if it’s a “modern” development process. So that’s it, two people colluding and you’ve got a back door worth a fortune to a nation state. What a fucking mess.
- KirillPanov 6y ago> Our only answer seems to be even more automated updates No, exactly the opposite. Automatic updates are insane. If software updates itself automatically, you need to assume it is compromised. If software requires manual updates, you need to assume that the more frequent the updates, the less secure it is.
- spicyramen 6y agoI thought the most sophisticated has been stuxnet
- aritmo 6y agoIt was not the largest or most sophisticated attack, ever. It looks like they are trying to limit their liability by claiming there was nothing at all that they could have done.
- jiofih 6y ago> how many engineers have probably worked on these attacks. And the answer we came to was, well, certainly more than 1,000 Anyone have insights on what part of the attack might have taken a thousand people?
- funkisjazz 6y agoDoes the fact that the MSFT president made it make anyone else think it's a fairly worthless statement? Not trying to bad-mouth MSFT, just saying that presidents are PR.
- LeanderK 6y agohow sophisticated is the penetration testing of government infrastructure? It seems to me like one should invest roughly as much in defensive (so penetration testing etc.) as in offensive capabilities. Maybe even more, because the attack surface is so big.
- teddyh 6y agoEvery company who was ever hacked was hacked by the absolutely most sophisticated and highly advanced techniques ever, according to the accompanying press release. This tells us nothing about what actually happened.
- dwheeler 6y agoWhat's interesting about the main SolarWinds subversion was a build environment subversion. It didn't matter how much source code review was done. To detect/counter this kind of attack you need different measures. Start by hardening the build environment, but if you want real strength you need reproducible builds. For more info see: https://www.linuxfoundation.org/en/blog/preventing-supply-chain-attacks-like-solarwinds/ https://www.linuxfoundation.org/en/blog/preventing-supply-ch...
- alkonaut 6y agoI think this hack shines a light on the less-is-more approach to security. I can count on an OS or a compiler to not be hacked, but I can't add an unlimited amount of "security software" because someone decides we need to do something to protect against vectors X, Y and Z and those are addressed by massive pieces of software that runs in sensitive locations such as "everyone's machine" or "our CI infrastrycture". It's just a very bad idea™. Unfortunately it's an idea that is going to be a very hard idea to get rid of (Right now my computer is running CarbonBlack, F-Secure AV, EgoSecure, CyberARK, and at least a couple of others I forget. I assume many of you on corporate machines have the same problem).
- AzzieElbab 6y agoWhat exactly was so sophisticated? From what I read earlier, a backdoor access was compromised and that is about it. Anyone has more info?
- TLightful 6y ago... "that we're aware of"
- lcall 6y agoJust some thoughts, I can be wrong, and I probably have much less in-depth knowledge of the attack. To call it the largest & most sophisticated ever seen sounds like ignoring some that others have mentioned here, and the fact that we don't know what others have not been publicized yet, including things like this (https://www.schneier.com/blog/archives/2021/02/chinese-supply-chain-attack-on-computer-systems.html https://www.schneier.com/blog/archives/2021/02/chinese-suppl... where we don't know everything, there can be debate; but given means, motive, and opportunity, I think at least keeping our eyes open and attempting to adopt wise practices based on realistic trust levels and long-term track records, could be a good idea. Plus I question the credibility of MS on security or anything they say, given their long track record, and when compared to others (like maybe OpenBSD), and things like this as just one very recent example: https://www.schneier.com/blog/archives/2021/02/on-vulnerability-adjacent-vulnerabilities.html https://www.schneier.com/blog/archives/2021/02/on-vulnerabil... ...?
- arminiusreturns 6y agoIt's not the most sophisticated, thats a bad usage of terms, however, it is most likely one of the largest of it's type and severity just on pure scale. My take is that this is mostly on the heads of all the many gov orgs (I'm ignoring corporate land right now), who have become so dominated by gui-ninjas with stockholm syndrome for MS and other black-box closed source systems that they honestly just don't think about the underlying system fundamentals at all. Not only have I contracted and seen some of these systems first hand (and the bad management that engineers them), but I have a family member is is the head of IT for a state gov org, and I've heard about how lackluster the response has been internally. There is just a response to update systems. No fundamental reconsideration of sourcing practices, no fundamental reconsideration of security practices, just lazy hope that it doesn't affect them. I highly suspect most of these orgs are completely compromised already on the tech side (and other ways too, cough Epstein cough), and because of lack of accountability, nobody really gives a fuck. Then at the very high levels at the federal level, those "leaders" don't care because they are playing the classic good ol boy backscratching contract and bid game, and they get their cut, so they could care less that a few years down the road something like all of OPM is compromised. Congress, the one entity that should be in a position to start passing legislation to address these issues, is instead completely compromised on both sides of the isle by the same kind of realpolitik, where K-street writes the legislation along with a few staffers they will hire later for their "help", congresspeople don't even read the bills, but vote according to donation dollars and influence gained. The whole system is completely disconnected from reality, and the number one thing that is lacking is the largest four letter word in DC or in any government org... Accountability.
- chkaloon 6y ago...that we know about...
- jorblumesea 6y agoIs it fair to ask companies, even large companies, to be able to match the resources state actors bring to bear? I feel like the debate is missing that asymmetry.
- Bedgeseb 6y agoI mean, their only sensible narrative is "it was the most sophisticated hack ever" irrespective of what actually happened.
- swiley 6y agoNow that this has happened are we going to learn a lesson and stop flinging binaries around?