5 ms·

It’s nice how they equivocate over the ease of entry and their security policies: There was another unsettling report about passwords. A security researcher in

It’s nice how they equivocate over the ease of entry and their security policies: There was another unsettling report about passwords. A security researcher in Bangalore, India, named Vinoth Kumar told NPR that he had found the password to a server with SolarWinds apps and tools on a public message board and the password was: "solarwinds123." Kumar said he sent a message to SolarWinds in November and got an automated response back thanking him for his help and saying the problem had been fixed. When NPR asked SolarWinds' vice president of security, Brown, about this, he said that the password "had nothing to do with this event at all, it was a password to a FTP site." An FTP site is what you use to transfer files over the Internet. He said the password was shared by an intern and it was "not an account that was linked to our active directory."

dogman144 6y ago
How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.
- ridaj 6y ago
  I don't think they ignored it? Says it was addressed. I think it was OK to dispel the implication that the elaborate supply chain attack was allowed in the first place by sloppy pw practices. You don't want that to be the takeaway and then other companies thinking, well our pw management practice is really good so we don't have to worry about being a victim so much
  - rjzzleep 6y ago
    They did ignore it. I think it was over a year actually. I don't feel like looking it up right now but it was also discussed in another submission. Whatever the actual number was it was VERY long.
- CyberRage 6y ago
  You don't get this kind of attack because you had an exposed FTP server. The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal. They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications. The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this makes SolarWinds a prime target, one that is worth the efforts taken in this case.
  - boomboomsubban 6y ago
    >You don't get this kind of attack because you had an exposed FTP server This kind of attack needs an entry point, and an exposed FTP server provides the potential for one. Whether it actually was the entry point is a separate matter, willfully ignoring one unlocked door means there's likely to be others.
    - CyberRage 6y ago
      Initial access is part of the day-to-day these days. you can't cover all entry points, it's a matter of time for someone to make a mistake. the fact that the adversary showed these extreme levels of proficiency and dedication tells me that the vast majority of companies would have fallen for that. In fact, the backdoor was running for months on targets like Microsoft, gov agencies, security companies like Malwarebytes. These companies know a thing or two about security. Today we work with "assume breach" mentality that assumes you are already compromised.
  - freeflight 6y ago
    > You don't get this kind of attack because you had an exposed FTP server. Leaking the extremely weak login credentials to your updateserver, trough a public Github repo, is not exactly a glowing endorsement of how serious security seems to have been taken at Solwarwinds. With stuff like that being a thing, who knows where else they cut corners/got lazy. > this makes SolarWinds a prime target, one that is worth the efforts taken in this case. A prime target, yet apparently could still not be bothered to put in some minimum effort to protect themselves.
frombody 6y ago
The password was in a file that was committed to github IIRC. I think both the intern that posted the file and the person making that statement both did not realize that someone had given the user write access.. which in my opinion was the actual mistake, not the ftp or the password.
- ta9999 6y ago
  Something to remember is that these sorts of things happen in many organizations. You should always verify the data you get, be careful with complex supply chains, and avoid binaries you didn't build yourself. Don't skip these things just because "that's the way it's always been done." 10 years ago very little internet traffic was encrypted, security still means progress not the status quo.
freeflight 6y ago
> An FTP site is what you use to transfer files over the Internet. Afaik that was the updatesever and the password originally came from a public Github repo where is was stored in plaintext since at least June 2018 [0] [0] https://www.theregister.com/2020/12/16/solarwinds_github_password/ https://www.theregister.com/2020/12/16/solarwinds_github_pas...

dogman144 6y ago

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

ridaj 6y ago
I don't think they ignored it? Says it was addressed. I think it was OK to dispel the implication that the elaborate supply chain attack was allowed in the first place by sloppy pw practices. You don't want that to be the takeaway and then other companies thinking, well our pw management practice is really good so we don't have to worry about being a victim so much
- rjzzleep 6y ago
  They did ignore it. I think it was over a year actually. I don't feel like looking it up right now but it was also discussed in another submission. Whatever the actual number was it was VERY long.
CyberRage 6y ago
You don't get this kind of attack because you had an exposed FTP server. The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal. They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications. The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this makes SolarWinds a prime target, one that is worth the efforts taken in this case.
- boomboomsubban 6y ago
  >You don't get this kind of attack because you had an exposed FTP server This kind of attack needs an entry point, and an exposed FTP server provides the potential for one. Whether it actually was the entry point is a separate matter, willfully ignoring one unlocked door means there's likely to be others.
  - CyberRage 6y ago
    Initial access is part of the day-to-day these days. you can't cover all entry points, it's a matter of time for someone to make a mistake. the fact that the adversary showed these extreme levels of proficiency and dedication tells me that the vast majority of companies would have fallen for that. In fact, the backdoor was running for months on targets like Microsoft, gov agencies, security companies like Malwarebytes. These companies know a thing or two about security. Today we work with "assume breach" mentality that assumes you are already compromised.
- freeflight 6y ago
  > You don't get this kind of attack because you had an exposed FTP server. Leaking the extremely weak login credentials to your updateserver, trough a public Github repo, is not exactly a glowing endorsement of how serious security seems to have been taken at Solwarwinds. With stuff like that being a thing, who knows where else they cut corners/got lazy. > this makes SolarWinds a prime target, one that is worth the efforts taken in this case. A prime target, yet apparently could still not be bothered to put in some minimum effort to protect themselves.

frombody 6y ago

The password was in a file that was committed to github IIRC. I think both the intern that posted the file and the person making that statement both did not realize that someone had given the user write access.. which in my opinion was the actual mistake, not the ftp or the password.

ta9999 6y ago
Something to remember is that these sorts of things happen in many organizations. You should always verify the data you get, be careful with complex supply chains, and avoid binaries you didn't build yourself. Don't skip these things just because "that's the way it's always been done." 10 years ago very little internet traffic was encrypted, security still means progress not the status quo.

freeflight 6y ago

> An FTP site is what you use to transfer files over the Internet. Afaik that was the updatesever and the password originally came from a public Github repo where is was stored in plaintext since at least June 2018 [0] [0] https://www.theregister.com/2020/12/16/solarwinds_github_password/ https://www.theregister.com/2020/12/16/solarwinds_github_pas...