4 ms·

> the initial attack vector was a USB stick in a parking lot That's not fair. It should sound like this: "the initial attack vector was a Windows 0day requirin

by rfoo 6y ago

> the initial attack vector was a USB stick in a parking lot That's not fair. It should sound like this: "the initial attack vector was a Windows 0day requiring 0 clicks, delivered by a USB stick in a parking lot."

hayst4ck 6y ago
People are saying that the solarwinds hack is not sophisticated because it is just a supply chain attack on a vendor with woefully insufficient security. I agree, that is not a very sophisticated sounding attack. What does appear to be potentially quite sophisticated is the post compromise activity. https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/ https://arstechnica.com/information-technology/2020/12/18000... “Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.” https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... You are saying my comparison is not fair because the USB stick actually had a 0 day which implies sophistication, but the supply chain build server was producing code and was also acting as a 0 day, in fact the actual payload appears to be significantly technically complex and custom. Where do you draw the line between sophisticated and not? USB in parking lot -> 0day -> horizontal movement 0days -> vertical movement 0days -> Payload delivery. Bad admin credentials -> compromised build system -> supply chain 0day -> horizontal/vertical movement -> exfiltration of sensitive data. Are we comparing: [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system -> supply chain 0day] or [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system] or [USB in parking lot] to [Bad admin credentials -> compromised build system] We don't know the extent and complexity of [horizontal/vertical movement -> exfiltration of sensitive data] in the solarwinds saga and therefore we have insufficient information to determine its sophistication or not. Meanwhile the vast majority of the people in this post have completely written off technical sophistication that occurs directly after the solarwinds software updates.

by rfoo 6y ago

hayst4ck 6y ago

People are saying that the solarwinds hack is not sophisticated because it is just a supply chain attack on a vendor with woefully insufficient security. I agree, that is not a very sophisticated sounding attack. What does appear to be potentially quite sophisticated is the post compromise activity. https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/ https://arstechnica.com/information-technology/2020/12/18000... “Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.” https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... You are saying my comparison is not fair because the USB stick actually had a 0 day which implies sophistication, but the supply chain build server was producing code and was also acting as a 0 day, in fact the actual payload appears to be significantly technically complex and custom. Where do you draw the line between sophisticated and not? USB in parking lot -> 0day -> horizontal movement 0days -> vertical movement 0days -> Payload delivery. Bad admin credentials -> compromised build system -> supply chain 0day -> horizontal/vertical movement -> exfiltration of sensitive data. Are we comparing: [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system -> supply chain 0day] or [USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system] or [USB in parking lot] to [Bad admin credentials -> compromised build system] We don't know the extent and complexity of [horizontal/vertical movement -> exfiltration of sensitive data] in the solarwinds saga and therefore we have insufficient information to determine its sophistication or not. Meanwhile the vast majority of the people in this post have completely written off technical sophistication that occurs directly after the solarwinds software updates.