4 ms·

Anyone know how the software update was actually compromised in the first place?

lambdasquirrel 6y ago
It’s kinda-sorta in the article. The hackers managed to put some hack into the Solarwinds build scripts. Nice writing I guess, but, what allowed them to get into the build scripts?
matwood 6y ago
The wiki page on the attack speculates an Office360 account was hacked. Presumably it was an account from an admin, and from there I could see them probing until finding credentials for the build system.
- trashcan 6y ago
  No idea if it is related, but a SAML implementation security issue was disclosed the same (or very close) day that the SolarWinds attack became public knowledge. Maybe that gave them access to the admin account?
- trulyme 6y ago
  So they hacked MS through SW which was hacked through MS? Ironic if true.
wglb 6y ago
This has been a puzzle for a while, and I am not yet satisfied with the answer so far. The closest to an explanation is found here: https://ciexinc.com/blog/solarwinds-articles/initial.html https://ciexinc.com/blog/solarwinds-articles/initial.html. I feel like this says "well, we are not really sure".
- galaxyLogic 6y ago
  Two things, are they unsure the attack could have worked the way they describe, or are they unsure the attack actually happened that way? From the viewpoint of the public it would be important to know what made this attack possible, and how to defend against it, even if the actual attack was accomplished some other way. I guess what I'm asking is, do they know how to repeat this attack?
someguydave 6y ago
Tim Brown VP Security of Solarwinds said: “We check code out of source code control, have a TeamCity environment to kick off the build, and here the attacker looked for Orion to be built and swapped a file. It was a transient virtual machine and that’s hard to detect,” he said. https://itwire.com/security/solarwinds-speaks-out,-and-software-dev-can-never-be-the-same-again.html https://itwire.com/security/solarwinds-speaks-out,-and-softw... So it sounds like the VM host they were running builds upon was compromised - or maybe JetBrains was compromised? JetBrains claims there is no evidence they were compromised https://blog.jetbrains.com/blog/2021/01/07/an-update-on-solarwinds/ https://blog.jetbrains.com/blog/2021/01/07/an-update-on-sola...

It’s kinda-sorta in the article. The hackers managed to put some hack into the Solarwinds build scripts. Nice writing I guess, but, what allowed them to get into the build scripts?

matwood 6y ago

The wiki page on the attack speculates an Office360 account was hacked. Presumably it was an account from an admin, and from there I could see them probing until finding credentials for the build system.

trashcan 6y ago
No idea if it is related, but a SAML implementation security issue was disclosed the same (or very close) day that the SolarWinds attack became public knowledge. Maybe that gave them access to the admin account?
trulyme 6y ago
So they hacked MS through SW which was hacked through MS? Ironic if true.

wglb 6y ago

This has been a puzzle for a while, and I am not yet satisfied with the answer so far. The closest to an explanation is found here: https://ciexinc.com/blog/solarwinds-articles/initial.html https://ciexinc.com/blog/solarwinds-articles/initial.html. I feel like this says "well, we are not really sure".

galaxyLogic 6y ago
Two things, are they unsure the attack could have worked the way they describe, or are they unsure the attack actually happened that way? From the viewpoint of the public it would be important to know what made this attack possible, and how to defend against it, even if the actual attack was accomplished some other way. I guess what I'm asking is, do they know how to repeat this attack?

someguydave 6y ago

Tim Brown VP Security of Solarwinds said: “We check code out of source code control, have a TeamCity environment to kick off the build, and here the attacker looked for Orion to be built and swapped a file. It was a transient virtual machine and that’s hard to detect,” he said. https://itwire.com/security/solarwinds-speaks-out,-and-software-dev-can-never-be-the-same-again.html https://itwire.com/security/solarwinds-speaks-out,-and-softw... So it sounds like the VM host they were running builds upon was compromised - or maybe JetBrains was compromised? JetBrains claims there is no evidence they were compromised https://blog.jetbrains.com/blog/2021/01/07/an-update-on-solarwinds/ https://blog.jetbrains.com/blog/2021/01/07/an-update-on-sola...