4 ms·

That's pretty much the concept of defense-in-depth, and breaches like Solar Winds of others like this kind of threat actors, are so sophisticated that they do w

That's pretty much the concept of defense-in-depth, and breaches like Solar Winds of others like this kind of threat actors, are so sophisticated that they do work around every single aspect of this.

pornel 6y ago
> are so sophisticated Their password was "SolarWinds123". Everyone who gets pwnd tells a story about sophisticated state actors to make it sound like some unstoppable force has hit their impenetrable defences.
- icare_1er 6y ago
  1/ The article talks about the SolarWinds hack, as the campaign that then targeted Microsoft, the DoJ and others. Not the hack "into" SolarWinds. 2/ For SolarWinds itself, the password is one tiny step along the way. I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender) and getting knowledge of the company's architecture, its internal Repos, etc. You'd have to bypass MFA too at some point, which the attackers did. 3/ If having malware than monitors developers VisualStudio console in realtime to inject a few lines into it so that it gets secretly compiled into their day-to-day work, without breaking the project, while also providing C2 capabilities; if that, is not "sophisticated", i'd be curious to see an example of "sophisticated" malware.
  - einpoklum 6y ago
    > I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines I don't think I'll believe such guarantees about a company whose update dissemination server password for a write-privileged account is CompanyName123. I mean, you could be correct, but still.
  - rndgermandude 6y ago
    >I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender) SolarWinds recommended to proactively add exceptions to your AntiVirus such as Windows Defender for their stuff[0]. They probably followed their own advice for their own systems as well. Just saying... https://twitter.com/ffforward/status/1338785034375999491 https://twitter.com/ffforward/status/1338785034375999491
- da_big_ghey 6y ago
  Yeah and often, what makes state actors so threatening is not their untold leetness but the impunity with which they can operate. Common cybercriminals usually know better than to go after certain targets, but state actors can do whatever they please and will not face legal repercussions.
- dogman144 6y ago
  Yeah the true wizardry on this/SUNBURST was not the initial breach/privesc.

That's pretty much the concept of defense-in-depth, and breaches like Solar Winds of others like this kind of threat actors, are so sophisticated that they do work around every single aspect of this.

pornel 6y ago

> are so sophisticated Their password was "SolarWinds123". Everyone who gets pwnd tells a story about sophisticated state actors to make it sound like some unstoppable force has hit their impenetrable defences.

icare_1er 6y ago
1/ The article talks about the SolarWinds hack, as the campaign that then targeted Microsoft, the DoJ and others. Not the hack "into" SolarWinds. 2/ For SolarWinds itself, the password is one tiny step along the way. I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender) and getting knowledge of the company's architecture, its internal Repos, etc. You'd have to bypass MFA too at some point, which the attackers did. 3/ If having malware than monitors developers VisualStudio console in realtime to inject a few lines into it so that it gets secretly compiled into their day-to-day work, without breaking the project, while also providing C2 capabilities; if that, is not "sophisticated", i'd be curious to see an example of "sophisticated" malware.
- einpoklum 6y ago
  > I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines I don't think I'll believe such guarantees about a company whose update dissemination server password for a write-privileged account is CompanyName123. I mean, you could be correct, but still.
- rndgermandude 6y ago
  >I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines (first you'd have to work around Windefender) SolarWinds recommended to proactively add exceptions to your AntiVirus such as Windows Defender for their stuff[0]. They probably followed their own advice for their own systems as well. Just saying... https://twitter.com/ffforward/status/1338785034375999491 https://twitter.com/ffforward/status/1338785034375999491
da_big_ghey 6y ago
Yeah and often, what makes state actors so threatening is not their untold leetness but the impunity with which they can operate. Common cybercriminals usually know better than to go after certain targets, but state actors can do whatever they please and will not face legal repercussions.
dogman144 6y ago
Yeah the true wizardry on this/SUNBURST was not the initial breach/privesc.