8 ms·

Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to

• kmonsen 6y ago
  I guess they mean latest hack we have been the target of? Stuxnet was custom written malware targeting Iran, so yes I would agree with you but perhaps what he was trying to say is still true.
• stevemk14ebr 6y ago
  The attack is unique in its usage of the supply chain. The malware is not 'sophisticated' in the same way stuxnet is because it has different goals. This actors goals align with stealth above all else, which is evident in both the design of the malware and the choice of the supply chain delivery vehicle. Also realize that the network comminication scheme used attempts to blend in with the legitimate SolarWinds software. If you design a stuxnet like malware and deploy it to 18k+ companies it will be found, because exploiting zero days left and right is super noisey. This malware was minimal. It's cool in a different way
  • foolfoolz 6y ago
    it’s also interesting a value prop of solar winds is traffic monitoring
  • mike_d 6y ago
    Stuxnet was also a supply chain attack. The first infections were at Foolad Technic and Behpajooh, a pair of privately owned engineering firms. The malware keeps a "breadcrumb" trail of each machine it infects, and based on investigations by Symantec [1] it was determined that every Stuxnet sample from Natanz originated from outside suppliers. 1. https://tinyurl.com/1eswo98i https://tinyurl.com/1eswo98i
    • 1MachineElf 6y ago
      Related to Stuxnet, I'd say the Equation Group's presence on hard drive firmware was/is the most sophisticated supply chain attack ever: https://en.wikipedia.org/wiki/Equation_Group#Firmware https://en.wikipedia.org/wiki/Equation_Group#Firmware
      • nyolfen 6y ago
        in the NSA ANT catalog, writing backdoored HDD firmware was literally an intern project
  • bawolff 6y ago
    I don't feel that's really a counter-argument to it being less sophisticated. Sure SolarWinds might be a better match for its makers goals, but sophistication is not the same thing as fitting its purpose.
  • frombody 6y ago
    Suggesting stuxnet's goal wasn't stealth is silly. It was so sophisticated at not being detected that it went under everyone's radar for 5+ years. Stuxnet behaved in exactly the same way.. neither did anything that would be detectable unless certain criteria was met and a secondary payload sent.
    • samstave 6y ago
      I would say that the sophistication of the Solarwinds breach is in the success of its scale, as opposed to the methods with which it used to successfully reached such scale. Stuxnet was very sophisticated to hit a relatively narrow target by comparison. So I think they are both sophisticated, but not comparing them directly.
      • mike_d 6y ago
        Stuxnet infected close to 200,000 machines, over half in Iran, before being detected. It was so extremely stealthy and well designed that it could spread widely and avoid detection while making its way to the intended targets.
        • samstave 6y ago
          I didn't know that part - that incredible. I would love to know how many machines got hit by SOlarwinds - however, its not about the machines - its about the value of the data it slurped... So even if it was one exchange server, with 10,000 treasury/nsa/whatever accounts, that one machines intel value is quite high.
• nimbius 6y ago
  Absolutely agree. Solarwinds focuses a disproportionate amount of effort in ensuring it shows up favorably in Gartner magazine reviews and trade publications. As a monitoring platform its a monolithic, expensive, slow and rather dated monitoring solution. Agile does not come to mind, and you certainly wouldnt use it for anything approaching "observability." But the concerted marketing effort pays dividends. Solarwinds is almost the only choice for government. For potential attackers its a big red arrow. Exploit a rent-seeking company that writes mediocre software and exists mostly to cash in on "best practice" lock-in with government contracts. as far as i know nobodys really addressed the elephant in the room. Solarwinds is still a preferred government purchase for monitoring. every company that was affected by it still uses it (or at least hasnt publically refuted it) and no government official has come forward to admit they will discontinue it. Solarwinds hasnt offered any remediation or major changes in their development, leadership or code. just patch, rinse, and repeat and try not to pay too much attention to the issue.
  • downwithdisease 6y ago
    >> "Solarwinds hasnt offered any remediation or major changes in their development, leadership or code." Not accurate re: leadership. A new CEO just started in January, and their CTO was either terminated or he left just after the hack news.
    • spoonjim 6y ago
      LOL the whole “fall guy” thing is how companies keep doing what they’re doing while making some symbolic penance. For a software company a fuckup of this magnitude should be: all customers leave, company dies, execs never work again. Anything less is an insufficient incentive to work extremely hard to prevent this from happening.
      • notimetorelax 6y ago
        Sorry, I can’t agree with you here. What you’re saying is basically company’s dissolution of it is hacked. If this indeed becomes the case the companies will indeed kill to keep their secrets.
• hayst4ck 6y ago
  An attack has multiple stages. Stuxenet's attack formula was: inflitrate an airgapped network -> silently spread within -> silently destroy complex unique equipment Solarwinds attack forumla seems to be: compromise central infrastructure -> silently spread to customers via compromised updates -> silently exfiltrate useful data/create an advanced persistent threat (APT). Because the initial compromise (oh a bad password, oh, a compromised remote code execution (RCE) engine) was not sophisticated this doesn't look sophisticated, but even stuxnet wasn't "sophisticated" in that sense, the initial attack vector was a USB stick in a parking lot, there's nothing sophisticated about that either. There is probably a lot of sophistication behind staying silent and the exfiltrating of data that we don't know about, even the silent exploration of multiple internal networks seems like a fairly non-trivial task to scale, especially to 18,000 potential targets, if more than a handful of them have been successfully compromised in a hard to resolve way, I would call that sophisticated. The APT/Exfiltration work is much more close to the sophistication of the virus that attacked the centrifuges than the bad password. For all we know the hack could have levereaged information gained via kaspersky, telegram, or whatever other software to do sophisticated things much the same way we asked Siemens for their help. We don't have enough information to make an assessment yet.
  • rfoo 6y ago
    > the initial attack vector was a USB stick in a parking lot That's not fair. It should sound like this: "the initial attack vector was a Windows 0day requiring 0 clicks, delivered by a USB stick in a parking lot."
    • hayst4ck 6y ago
      People are saying that the solarwinds hack is not sophisticated because it is just a supply chain attack on a vendor with woefully insufficient security. I agree, that is not a very sophisticated sounding attack. What does appear to be potentially quite sophisticated is the post compromise activity. https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/ https://arstechnica.com/information-technology/2020/12/18000... “Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.” https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... You are saying my comparison is not fair because the USB stick actually had a 0 day which implies sophistication, but the supply chain build server was producing code and was also acting as a 0 day, in fact the actual payload appears to be significantly technically complex and custom. Where do you draw the line between sophisticated and not? USB in parking lot -> 0day -> horizontal movement 0days -> vertical movement 0days -> Payload delivery. Bad admin credentials -> compromised build system -> supply chain 0day -> horizontal/vertical movement -> exfiltration of sensitive data. Are we comparing: [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system -> supply chain 0day] or [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system] or [USB in parking lot] to [Bad admin credentials -> compromised build system] We don't know the extent and complexity of [horizontal/vertical movement -> exfiltration of sensitive data] in the solarwinds saga and therefore we have insufficient information to determine its sophistication or not. Meanwhile the vast majority of the people in this post have completely written off technical sophistication that occurs directly after the solarwinds software updates.
• young_unixer 6y ago
  > compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. Which makes me think: A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. Or they could "accidentally" add a security vulnerability and exploit it. "There is another theory which states that this has already happened."
  • monkpit 6y ago
    While this is true, it’s probably MUCH easier to just exploit existing packages in some fashion.
  • gkanai 6y ago
    > A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. This often happens with Chrome browser extensions that change hands and the new owner then injects malware or crypto mining or keylogging etc. into the newly acquired extension.
• deleted 6y ago
  [deleted]
• bosswipe 6y ago
  "how many engineers have probably worked on these attacks. And the answer we came to was, well, certainly more than 1,000," A thousand engineers is a huge project. You have no better knowledge than Microsoft about the attack.
• technick 6y ago
  You're completely right, this wasn't a complicated attack at all. The two most notable items here are, Solarwinds has horrible security practices and those customers who were affected by the attack, also have horrible security practices. In a correctly secured environment it wouldn't have been possible for a infected Solarwinds server to connect out to a C2C server.
  • ed_elliott_asc 6y ago
    100% this no ports should be allowed in or out by default and every port open justified - if you can’t get out a payload is useless.
    • jannes 6y ago
      What about port 80 and 443?
      • sofixa 6y ago
        Why would monitoring servers have access to the internet?
      • PeterisP 6y ago
        Yes, a secure server should not be able to make outgoing connections to arbitrary external machines on 80/443. If there's a specific need for a specific connection (e.g. the server needs to pull updates from the vendor) then that particular connection can be whitelisted.
• miohtama 6y ago
  SolarWinds is the most sophisticated hack by Russian/China/Nirth Korea. Stuxnet was the most sophisticated hack by the US/Israel. The US does not need to hack SolarWinds because they probably could use a court order for the same outcome to distribute rigged binaries for political enemies.
• codeduck 6y ago
  I remember reading the analyses of Stuxnet and being staggered by the sophistication. Solarwinds feels like a script-kiddie job in comparison.
• robertlagrant 6y ago
  Indeed. Microsoft are blowing smoke because they were compromised.
• einpoklum 6y ago
  It was the "largest and most sophisticated attack" that Microsoft has to make excuses for right now. (And that's regardless of their culpability or lack thereof.)
• indeedmug 6y ago
  https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... You are vastly underestimating the lengths that this attack when to avoid detection. They didn't just hijack Solarwinds updates and inject malware. They did things like concealing the commands of malware in legitimate looking Solarwinds packets. When they infiltrated a place, they had the malware sleep for months. They carefully avoid standard malware detection techniques and you can only do that if you have very sophisticated engineers. This isn't just some scripts someone pulled from the internet.