3 ms·

I thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the b

I thought they got access through an update sever with a weak password? Was the attack otherwise sophisticated and just relied on an easy entry point? So the breaking in was easy, but the plan to steal once inside was sophisticated?

Craighead 6y ago
Maybe do just a few minutes of research before first posting on a thread about state sponsored cyber crime. The actual "hack" was a supply chain hijack, the actors inserted malicious dll code through a solarwinds authorized developer workstation, thus ensuring the code would be signed, and then pushed as a legitimate update to the downstream implementations of solarwinds.
sebmellen 6y ago
·
- jjcon 6y ago
  Weak passwords had nothing to do with the hack
stevemk14ebr 6y ago
The whole weak password thing was simply a funnily timed thing some guy found. It had absolutely nothing to do with the malicious update, which was the source of this supply chain attack. For some reason a bunch of people online decided that two things happening around the same time means they are related. They are not
- MattGaiser 6y ago
  Ah ok. So the password was just an easy to understand sideshow. Thank you.
- oefrha 6y ago
  No, “a bunch of people online” decided that if you have jarring security practices in one avenue, it’s totally unsurprising if it turns out that you have other doors wide open too. Which is a completely reasonable assumption.
  - stevemk14ebr 6y ago
    It can definitely be said that this may be an indicator of a larger security issue at the company. But assuming that issue is the cause for the backdoor, yes that is a leap, and an unfounded one. Correlation != Causation, and it's always unreasonable to assume otherwise.
canardlaquay 6y ago
See it like stealing from a museum: very easy to break in (weak password -> breaking a window), hard to get out of here with all the paintings unnoticed - and that, on a daily basis. The amount of effort and different techniques they've put in to remain undetected for months (years?) while infecting a lot of actors is pretty impressive.
Ardren 6y ago
There had been a weak password on the update server in the past. The compromised update however was introduced via the build system before being signed and distributed https://www.sec.gov/Archives/edgar/data/0001739942/000162828020017451/swi-20201214.htm https://www.sec.gov/Archives/edgar/data/0001739942/000162828...
deleted 6y ago
[deleted]

Craighead 6y ago

Maybe do just a few minutes of research before first posting on a thread about state sponsored cyber crime. The actual "hack" was a supply chain hijack, the actors inserted malicious dll code through a solarwinds authorized developer workstation, thus ensuring the code would be signed, and then pushed as a legitimate update to the downstream implementations of solarwinds.

sebmellen 6y ago

jjcon 6y ago
Weak passwords had nothing to do with the hack

stevemk14ebr 6y ago

The whole weak password thing was simply a funnily timed thing some guy found. It had absolutely nothing to do with the malicious update, which was the source of this supply chain attack. For some reason a bunch of people online decided that two things happening around the same time means they are related. They are not

MattGaiser 6y ago
Ah ok. So the password was just an easy to understand sideshow. Thank you.
oefrha 6y ago
No, “a bunch of people online” decided that if you have jarring security practices in one avenue, it’s totally unsurprising if it turns out that you have other doors wide open too. Which is a completely reasonable assumption.
- stevemk14ebr 6y ago
  It can definitely be said that this may be an indicator of a larger security issue at the company. But assuming that issue is the cause for the backdoor, yes that is a leap, and an unfounded one. Correlation != Causation, and it's always unreasonable to assume otherwise.

canardlaquay 6y ago

See it like stealing from a museum: very easy to break in (weak password -> breaking a window), hard to get out of here with all the paintings unnoticed - and that, on a daily basis. The amount of effort and different techniques they've put in to remain undetected for months (years?) while infecting a lot of actors is pretty impressive.

Ardren 6y ago

There had been a weak password on the update server in the past. The compromised update however was introduced via the build system before being signed and distributed https://www.sec.gov/Archives/edgar/data/0001739942/000162828020017451/swi-20201214.htm https://www.sec.gov/Archives/edgar/data/0001739942/000162828...

deleted 6y ago

[deleted]