3 ms·

An attack has multiple stages. Stuxenet's attack formula was: inflitrate an airgapped network -> silently spread within -> silently destroy complex unique eq

An attack has multiple stages. Stuxenet's attack formula was: inflitrate an airgapped network -> silently spread within -> silently destroy complex unique equipment Solarwinds attack forumla seems to be: compromise central infrastructure -> silently spread to customers via compromised updates -> silently exfiltrate useful data/create an advanced persistent threat (APT). Because the initial compromise (oh a bad password, oh, a compromised remote code execution (RCE) engine) was not sophisticated this doesn't look sophisticated, but even stuxnet wasn't "sophisticated" in that sense, the initial attack vector was a USB stick in a parking lot, there's nothing sophisticated about that either. There is probably a lot of sophistication behind staying silent and the exfiltrating of data that we don't know about, even the silent exploration of multiple internal networks seems like a fairly non-trivial task to scale, especially to 18,000 potential targets, if more than a handful of them have been successfully compromised in a hard to resolve way, I would call that sophisticated. The APT/Exfiltration work is much more close to the sophistication of the virus that attacked the centrifuges than the bad password. For all we know the hack could have levereaged information gained via kaspersky, telegram, or whatever other software to do sophisticated things much the same way we asked Siemens for their help. We don't have enough information to make an assessment yet.

rfoo 6y ago
> the initial attack vector was a USB stick in a parking lot That's not fair. It should sound like this: "the initial attack vector was a Windows 0day requiring 0 clicks, delivered by a USB stick in a parking lot."
- hayst4ck 6y ago
  People are saying that the solarwinds hack is not sophisticated because it is just a supply chain attack on a vendor with woefully insufficient security. I agree, that is not a very sophisticated sounding attack. What does appear to be potentially quite sophisticated is the post compromise activity. https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/ https://arstechnica.com/information-technology/2020/12/18000... “Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.” https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... You are saying my comparison is not fair because the USB stick actually had a 0 day which implies sophistication, but the supply chain build server was producing code and was also acting as a 0 day, in fact the actual payload appears to be significantly technically complex and custom. Where do you draw the line between sophisticated and not? USB in parking lot -> 0day -> horizontal movement 0days -> vertical movement 0days -> Payload delivery. Bad admin credentials -> compromised build system -> supply chain 0day -> horizontal/vertical movement -> exfiltration of sensitive data. Are we comparing: [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system -> supply chain 0day] or [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system] or [USB in parking lot] to [Bad admin credentials -> compromised build system] We don't know the extent and complexity of [horizontal/vertical movement -> exfiltration of sensitive data] in the solarwinds saga and therefore we have insufficient information to determine its sophistication or not. Meanwhile the vast majority of the people in this post have completely written off technical sophistication that occurs directly after the solarwinds software updates.
samstave 6y ago
>silently exfiltrate useful data/create an advanced persistent threat The chinese successfully pulled this off at Lockheed in the early 2000s They would get lists of employees who attended various conferences, then email them a trojan saying "hey we met at conference X - here is something for you to click on" And employees would fall for it. The malware would TRICKLE out data very slowly so as not to be noticed. They did this for a LONG time. At the time, lockheed only had 3 egress points to the internet - and they had 110,000 laptops. Another attack vector was the same as stuxnet - airgap; attack a supplier in taiwan, infect any USB stick put into the suppliers machines, then transfer once that USB stick was put into the Lockheed machine. When the ruse was discovered - the chinese removed the throttle and they attempted to firehose out as much data as they could before they were cut off.
jjk166 6y ago
There is no comparison. Stuxnet "worked by first causing an infected Iranian IR-1 centrifuge to increase from its normal operating speed of 1,064 hertz to 1,410 hertz for 15 minutes before returning to its normal frequency. Twenty-seven days later, the worm went back into action, slowing the infected centrifuges down to a few hundred hertz for a full 50 minutes. The stresses from the excessive, then slower, speeds caused the aluminium centrifugal tubes to expand, often forcing parts of the centrifuges into sufficient contact with each other to destroy the machine." The solar winds hack is an otherwise unremarkable trojan that spread exclusively due to the bad security measures of solarwinds.
- hayst4ck 6y ago
  Stuxnet is a well understood attack from 10 years ago and its being compared with a poorly understood attack from 1 year ago. >The solar winds hack is an otherwise unremarkable trojan that spread exclusively due to the bad security measures of solarwinds. We don't have sufficient information to say what happened after the trojan landed is unsophisticated. All we have is the idea that microsoft benefits from making their attacker seem more competent than they are, which is true.
  - jjk166 6y ago
    Sure, we could learn that they did something really impressive with the solarwinds hack that we have no idea about right now, and at that time it might be reasonable to compare it to stuxnet. The same could be said of any hack. However right now there is no evidence of sophistication anywhere near that scale, and thus calling it the largest and most sophisticated attack is clearly unwarranted, at least at this time.

rfoo 6y ago

> the initial attack vector was a USB stick in a parking lot That's not fair. It should sound like this: "the initial attack vector was a Windows 0day requiring 0 clicks, delivered by a USB stick in a parking lot."

hayst4ck 6y ago
People are saying that the solarwinds hack is not sophisticated because it is just a supply chain attack on a vendor with woefully insufficient security. I agree, that is not a very sophisticated sounding attack. What does appear to be potentially quite sophisticated is the post compromise activity. https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/ https://arstechnica.com/information-technology/2020/12/18000... “Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.” https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... You are saying my comparison is not fair because the USB stick actually had a 0 day which implies sophistication, but the supply chain build server was producing code and was also acting as a 0 day, in fact the actual payload appears to be significantly technically complex and custom. Where do you draw the line between sophisticated and not? USB in parking lot -> 0day -> horizontal movement 0days -> vertical movement 0days -> Payload delivery. Bad admin credentials -> compromised build system -> supply chain 0day -> horizontal/vertical movement -> exfiltration of sensitive data. Are we comparing: [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system -> supply chain 0day] or [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system] or [USB in parking lot] to [Bad admin credentials -> compromised build system] We don't know the extent and complexity of [horizontal/vertical movement -> exfiltration of sensitive data] in the solarwinds saga and therefore we have insufficient information to determine its sophistication or not. Meanwhile the vast majority of the people in this post have completely written off technical sophistication that occurs directly after the solarwinds software updates.

samstave 6y ago

>silently exfiltrate useful data/create an advanced persistent threat The chinese successfully pulled this off at Lockheed in the early 2000s They would get lists of employees who attended various conferences, then email them a trojan saying "hey we met at conference X - here is something for you to click on" And employees would fall for it. The malware would TRICKLE out data very slowly so as not to be noticed. They did this for a LONG time. At the time, lockheed only had 3 egress points to the internet - and they had 110,000 laptops. Another attack vector was the same as stuxnet - airgap; attack a supplier in taiwan, infect any USB stick put into the suppliers machines, then transfer once that USB stick was put into the Lockheed machine. When the ruse was discovered - the chinese removed the throttle and they attempted to firehose out as much data as they could before they were cut off.

jjk166 6y ago

There is no comparison. Stuxnet "worked by first causing an infected Iranian IR-1 centrifuge to increase from its normal operating speed of 1,064 hertz to 1,410 hertz for 15 minutes before returning to its normal frequency. Twenty-seven days later, the worm went back into action, slowing the infected centrifuges down to a few hundred hertz for a full 50 minutes. The stresses from the excessive, then slower, speeds caused the aluminium centrifugal tubes to expand, often forcing parts of the centrifuges into sufficient contact with each other to destroy the machine." The solar winds hack is an otherwise unremarkable trojan that spread exclusively due to the bad security measures of solarwinds.

hayst4ck 6y ago
Stuxnet is a well understood attack from 10 years ago and its being compared with a poorly understood attack from 1 year ago. >The solar winds hack is an otherwise unremarkable trojan that spread exclusively due to the bad security measures of solarwinds. We don't have sufficient information to say what happened after the trojan landed is unsophisticated. All we have is the idea that microsoft benefits from making their attacker seem more competent than they are, which is true.
- jjk166 6y ago
  Sure, we could learn that they did something really impressive with the solarwinds hack that we have no idea about right now, and at that time it might be reasonable to compare it to stuxnet. The same could be said of any hack. However right now there is no evidence of sophistication anywhere near that scale, and thus calling it the largest and most sophisticated attack is clearly unwarranted, at least at this time.