3 ms·

"The tradecraft was phenomenal" Indeed, consider Figure 5 here [1]. A truly diabolical mastermind. But seriously, the article looks like window dressing for c

"The tradecraft was phenomenal" Indeed, consider Figure 5 here [1]. A truly diabolical mastermind. But seriously, the article looks like window dressing for common incompetence. [1] https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ https://www.microsoft.com/security/blog/2020/12/18/analyzing...

wglb 6y ago
A common way to dodge accountability is to exaggerate the size of the enemy and his cleverness and goodness he had 1000 developers working on it. Nonetheless, there are some things that are kind of impressive. Inserting their own code into the build process without touching any file. But the real level of skill, I think, is the operational discipline exercised by the attackers. For example, waiting two weeks before doing anything, erasing traces of what they did, and targeting very specific sites.
- Agingcoder 6y ago
  Security is not my line of work, but back in the days I spent a while exploring the field (I especially enjoyed reverse engineering / subverting software ). Why is this 'operational discipline' remarkable? I'd expect this to be common sense (including waiting for two weeks) , especially if I was a state actor and had spent a whole bunch of money on it? Or do you mean that the vast majority of hacking operations don't even bother to do this?
  - wglb 6y ago
    Contrast that with the smash and grab of the exchange vulnerability that followed. Yes, many operations make some kind of error that gives the whole thing away
galaxyLogic 6y ago
It seems to me to get the attack going the attackers needed to accomplish 2 things (at least): 1. Get the source-code of SolarWinds.Orion.Core.BusinessLayer.dll so they could know how to modify it 2. Get their modified source OR modified compiled DLL somehow into the build-pipeline at SolarWinds. If SolarWinds could have prevented either of these two things from happening this attack would not have worked. Am I correct?

wglb 6y ago

A common way to dodge accountability is to exaggerate the size of the enemy and his cleverness and goodness he had 1000 developers working on it. Nonetheless, there are some things that are kind of impressive. Inserting their own code into the build process without touching any file. But the real level of skill, I think, is the operational discipline exercised by the attackers. For example, waiting two weeks before doing anything, erasing traces of what they did, and targeting very specific sites.

Agingcoder 6y ago
Security is not my line of work, but back in the days I spent a while exploring the field (I especially enjoyed reverse engineering / subverting software ). Why is this 'operational discipline' remarkable? I'd expect this to be common sense (including waiting for two weeks) , especially if I was a state actor and had spent a whole bunch of money on it? Or do you mean that the vast majority of hacking operations don't even bother to do this?
- wglb 6y ago
  Contrast that with the smash and grab of the exchange vulnerability that followed. Yes, many operations make some kind of error that gives the whole thing away

galaxyLogic 6y ago

It seems to me to get the attack going the attackers needed to accomplish 2 things (at least): 1. Get the source-code of SolarWinds.Orion.Core.BusinessLayer.dll so they could know how to modify it 2. Get their modified source OR modified compiled DLL somehow into the build-pipeline at SolarWinds. If SolarWinds could have prevented either of these two things from happening this attack would not have worked. Am I correct?