3 ms·
The attack is unique in its usage of the supply chain. The malware is not 'sophisticated' in the same way stuxnet is because it has different goals. This actors
by stevemk14ebr 6y ago
The attack is unique in its usage of the supply chain. The malware is not 'sophisticated' in the same way stuxnet is because it has different goals. This actors goals align with stealth above all else, which is evident in both the design of the malware and the choice of the supply chain delivery vehicle. Also realize that the network comminication scheme used attempts to blend in with the legitimate SolarWinds software. If you design a stuxnet like malware and deploy it to 18k+ companies it will be found, because exploiting zero days left and right is super noisey. This malware was minimal. It's cool in a different way
- foolfoolz 6y agoit’s also interesting a value prop of solar winds is traffic monitoring
- mike_d 6y agoStuxnet was also a supply chain attack. The first infections were at Foolad Technic and Behpajooh, a pair of privately owned engineering firms. The malware keeps a "breadcrumb" trail of each machine it infects, and based on investigations by Symantec [1] it was determined that every Stuxnet sample from Natanz originated from outside suppliers. 1. https://tinyurl.com/1eswo98i https://tinyurl.com/1eswo98i
- 1MachineElf 6y agoRelated to Stuxnet, I'd say the Equation Group's presence on hard drive firmware was/is the most sophisticated supply chain attack ever: https://en.wikipedia.org/wiki/Equation_Group#Firmware https://en.wikipedia.org/wiki/Equation_Group#Firmware
- nyolfen 6y agoin the NSA ANT catalog, writing backdoored HDD firmware was literally an intern project
- bawolff 6y agoI don't feel that's really a counter-argument to it being less sophisticated. Sure SolarWinds might be a better match for its makers goals, but sophistication is not the same thing as fitting its purpose.
- frombody 6y agoSuggesting stuxnet's goal wasn't stealth is silly. It was so sophisticated at not being detected that it went under everyone's radar for 5+ years. Stuxnet behaved in exactly the same way.. neither did anything that would be detectable unless certain criteria was met and a secondary payload sent.
- samstave 6y agoI would say that the sophistication of the Solarwinds breach is in the success of its scale, as opposed to the methods with which it used to successfully reached such scale. Stuxnet was very sophisticated to hit a relatively narrow target by comparison. So I think they are both sophisticated, but not comparing them directly.
- mike_d 6y agoStuxnet infected close to 200,000 machines, over half in Iran, before being detected. It was so extremely stealthy and well designed that it could spread widely and avoid detection while making its way to the intended targets.
- samstave 6y agoI didn't know that part - that incredible. I would love to know how many machines got hit by SOlarwinds - however, its not about the machines - its about the value of the data it slurped... So even if it was one exchange server, with 10,000 treasury/nsa/whatever accounts, that one machines intel value is quite high.