8 ms·

The Untold Story of the Boldest Supply-Chain Hack Ever

156 points by SerCe 3y ago

fyhfuhfg 3y ago
why ppl call this a supply chain attack??? the simplest abuse of an all-powerful application coded by illiterate criminals who even sold company stock when things were to become public. the real attack is how they managed to sell this to so many high profile targets. that is conveniently left out of every report, including this lame one from wired. my guess, since they sold to fireeye, is that it's the same circle of people who can get these type of contracts. a shadow elite of formet NSA consultants helping each other.
sigio 3y ago
https://archive.ph/X9fqZ https://archive.ph/X9fqZ
TheJoeMan 3y ago
This story reads as merely attempting to cover for Mandiant's reputation. They are "the ones on speed dial" for customers and seem to be trying to salvage. Definitely a rare glimpse into the deep state, how many other companies have contacts at the NSA?
- nibbleshifter 3y ago
  Quite a few security companies will have back channels to the NSA. There's a revolving door between NSA and "cyber". Same shit in the UK, some of the bigger consultancies have very cosy relationships with GCHQ.
- trefoiled 3y ago
  I picked up on this too. Everyone involved has a perverse incentive to portray the narrative as the work of genius, innovative hackers. That's the issue with an article like this, where all the quoted sources are people directly involved. I would have appreciated some 3rd party analysis of just how sophisticated this attack really was, and how much of the blame should really rest on the lax standards of the victims. Mandiant in particular doesn't have much excuse.
column 3y ago
See, that's a long article I would have just skipped a year ago. Now, we get to play with its content and it's fun : Joe: So, it was late 2019 when we stumbled upon the breach at the think tank. Donald: And what did you find, Joe? Joe: Another digital security breach, nothing special. But then we found a second group of hackers, more skilled, going after specific executives, policy wonks, and IT staff. Donald: Damn, that's some precision targeting right there. Joe: Yeah, we kicked them out, but they kept coming back. We found out they had planted a backdoor three years earlier, and we never even knew. Donald: Three years?! They were playing the long game, huh? Joe: You could say that. And in June 2020, they came back. We spent days trying to figure out how they slipped in. Donald: And how did they do it? Joe: They zeroed in on a server running SolarWinds software. And that's when the Department of Justice called us. Donald: Those hackers were clever. Joe: You're damn right they were. They had gained access to the firm’s multifactor authentication system and were conducting counterintelligence against one of their biggest foes. Donald: Who was that? Joe: Mandiant. Donald: And did Mandiant catch them? Joe: Yeah, they did. But here's the thing, Don. Mandiant had investigated an intrusion on a server running the same SolarWinds software months earlier. Donald: No way. Joe: Yeah, way. And they didn't recognize the similarity between the two cases. Donald: Why not? Joe: Internal secrecy, man. And SolarWinds was the source of the hack. Donald: That's what caused all the anger, huh? Joe: You got it. And the US government won't say what the hackers did inside its networks. People are saying they don't want to admit their failures.
- mlb893 3y ago
  Great use. I'm assuming you used the API for that long of a text?
  - samstave 3y ago
    How was that summarized?
    - mlb893 3y ago
      It says something about how long the original article was.
NoMoreNicksLeft 3y ago
Do I understand correctly, that the hackers improved the dll's code deliberately, so that Orion wouldn't manifest bugs which might invite debugging scrutiny that also revealed the backdoor?
- stevenwoo 3y ago
  The way I read it, they left the other functionality unchanged and injected their source code change into the .dll source, made the build process build both the hacked version and the unhacked version (for later) and put the hacked version into the installation package and deleted evidence of the hacked dll in the build and restored the unhacked dll to it's place so no one could tell what happened just by looking at the end results and doing a dump or binary diff on just that dll. Similar to but not the same as the pirated xcode malware injection.
- GTP 3y ago
  Probably, this sounds like a plausible explanation.
- nibbleshifter 3y ago
  It used to be fairly common practice for skilled hackers to patch the way they got in, to avoid their borrowed systems from being invaded by skids.
  - ComputerGuru 3y ago
    This is different, more like putting a trap door in the ceiling and then patching all the leaks in the roof so that the homeowner won’t need to climb up on to the roof to fix those themselves and in doing so stumble on your trap door.
revelio 3y ago
Disappointing, the article doesn't say anything new or untold beyond some minor personal details about the people involved and the fact that people repeatedly missed major clues because they weren't talking to each other. Also, the article repeatedly insinuates that the attack was traced to the Russian government, in fact it says it so often a casual reader could be forgiven for thinking they had proof. But a careful reading shows that they have absolutely no idea who did the SolarWinds hack. The link to the SVR is simply that Kevin Mandia has a "hunch" based on "pattern recognition" from his work in the 1990s. Not only is no proof presented, they don't even have anything that could be called evidence. Writeups of hacks are always like this nowadays. It's the Russians. How do we know it's not the Chinese, or the Americans, or the British? We don't but if we say it's the Russians everyone will be on our side, so let's roll with that. I really wish journalists would not try to manipulate readers like that. It'd be more honest to say they don't know. Trying to slip a completely made up SVR connection past the readers like that implies the rest of the article might just be spin too.
- brabel 3y ago
  I was watching the news last night, and apparently, not only they're pretty sure it was Russia that bombed the half-Russian pipelines to Europe (NordStream2), but it was Russia (or Russian partisans, whatever they mean) that tried to kill Putin last night with a drone attack as well. You can accuse Russia of anything you want in the current climate, and everyone will take you seriously regardless of evidence.
  - stickfigure 3y ago
    When you have a history of lying and running malevolent information operations, plus invading your neighbors on multiple occasions... yeah, you kinda lose the benefit of the doubt. Your comment looks like an information operation itself. As far as I can tell, the only claims that the drones "tried to kill Putin" come from Russian state media.
    - brabel 3y ago
      When you start accusing someone or a country of everything, it's not them who are losing the benefit of the doubt. It's you who are losing any credibility. > As far as I can tell, the only claims that the drones "tried to kill Putin" come from Russian state media. Well, I was reporting what the news said, and it was definitely not the Russian media.
robszumski 3y ago
This incident and the Colonial Pipeline attack were the main drivers behind the Biden cybersecurity executive order "Executive Order on Improving the Nation’s Cybersecurity" [1] which has driven changes to policy at NIST, FDA, OMB and others [2]. My opinion is that while these policies are fuzzy and lack specifics, it's just the first round of pushing industry in the correct direction without mandating specific tools or methods. In the EU, the proposed Cyber Resilience Act has maybe cast too wide of a net, snagging any open source contributor as a software "manufacturer". 1: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action... 2: https://edgebit.io/regulations/ https://edgebit.io/regulations/
bell-cot 3y ago
I stopped reading in paragraph 9, at: > When investigators finally cracked it, they were blown away by the hack’s complexity and extreme premeditation. "Extreme premeditation?" Please. The old USSR had quite a few spies who stayed active for decades inside America's Top Secret Tent. A century ago, if a navy wanted a new battleship, it could easily be 7 years between "start spending money" and "battleship is completed and ready to use".
- Forgeties79 3y ago
  Maybe I'm naive or dumb or something but I feel like comparing a hacking attempt to the construction/crewing/deploying of a battleship doesn't make a whole lot of sense? It takes a lot of work to build a motorcycle that is roadworthy from scratch. It takes a lot of work to build a skyscraper and develop it into a used space from scratch. Talking about the latter doesn't really discount the former, right?
  - bell-cot 3y ago
    My (not so well made) point was that having a two-ish decade planning horizon for serious national security activities was old hat back when punch cards were leading-edge computer technology. Vs. from a skim of the article - the entire Solar Winds operation was less than 24 months, from plausibly-first little compromise of an employee's VPN account through detection and fix. That is "Extreme premeditation" about the same way that my hard-boiling eggs for a week's lunches every Monday morning is "Extreme premeditation". (Vs. if they'd described it as a major effort by an A-list adversary - yeah, that would have been quite reasonable.)
    - nibbleshifter 3y ago
      In a field as fast paced as information security, that is a long fucking time.
- wlitlwijatli 3y ago
  Ships and planes today take waaayyy longer than seven years to create. The F-22 took 24 years to deliver.
ahi 3y ago
It's amusing how these stories always include the breathless account of the genius hackers. It boiled down to a few thousand lines of code in a dll. There's only so much genius you can get into a few thousand lines of code. In reality, SolarWinds did something stupid, then some of their customers connected it to the internet and didn't even firewall it. Hackers will always have success not because they're brilliant, but because there will always be some marks who didn't cross their i's and dot their t's.
- munificent 3y ago
  > There's only so much genius you can get into a few thousand lines of code. Einstein's paper that introduces E=mc^2 is about three pages long.
- loxias 3y ago
  I agree in spirit, and I also share an attitude of "if you're hacked, it's your fault." It's Not That Hard to choose to not run random binaries from the internet, and keep your ports closed. > There's only so much genius you can get into a few thousand lines of code That being said, Stuxnet? So clever. edit: Depending on the language or libraries, 1000 lines is a LOT. Cleverness is frequently in reduction or rotation, not addition. Choice of data structure, etc. c.f. the 'k' or 'j' programming languages.
  - doubled112 3y ago
    > if you're hacked, it's your fault I'm on the fence about this. In a perfect world, I agree. In real life? "They" only need to get lucky once. I need to be perfect all the time, and it probably isn't going to happen. Don't get me wrong, it is always somebody's fault. If your is meant as in your business, I'd lean more to the agree side. Security basics are just a cost centre, right? And how are you supposed to vet a binary from a trusted vendor?
duped 3y ago
This article also misses the part where JetBrains got accused of being a Russian asset by tech media.
- koalacola 3y ago
  Lol what? Because they're Czech?
  - boomboomsubban 3y ago
    I believe they had a sales office in Moscow, which was enough for the rumor mill. "Had" being key, as around the same time they pulled out of Russia.
  - duped 3y ago
    This is the original article: https://archive.ph/RsZtc https://archive.ph/RsZtc It was a bunch of embarrassing speculation
lesuorac 3y ago
> The practice of placing legal teams in charge of breach investigations is a controversial one. It puts cases under attorney-client privilege in a manner that can help companies fend off regulatory inquiries and fight discovery requests in lawsuits. I wonder if the new DoJ agrees with this approach.
hnthrowaway0328 3y ago
For SolarWinds hack, there also remains the question whether there was any insider job.
mike_hearn 3y ago
Here's the sketch of a defense against such attacks. Is there anyone out there who'd buy it, if it existed? Imagine a tool that given a simple description of a server (e.g. pointed at your build system or a downloadable artifact like a container image) creates a VM that starts the app on boot, uploads that VM image to the cloud, starts it up and then performs a remote attestation protocol to verify that the remote VM is running what you think it's running, down to the last byte. Remote attestation allows you to "measure" a VM or enclave to determine a cryptographic hash of everything running on the machine in an auditable way. Sometimes the VM has encrypted RAM so you can prove that the cloud provider can't break into that machine. It could potentially have helped in this case where the attackers compromised a build system. Remote attestations can be chained together and used as signatures, so for example SolarWinds could have come with a proof that it was compiled correctly from a particular git commit hash, and then third party auditors could have been hired to monitor that the code doesn't have backdoors. Customers could then run it and get from this imaginary tool a complete audit chain all the way back to a certificate issued by a third party that says "we reviewed the code at commit <hash> and this program was compiled from that code via a build system audited via remote attestation". Now, RA isn't a silver bullet. It's still possible to transiently hack a machine such that the hack remains in memory. But if you regularly reboot and re-attest your VMs, you can wipe these hacks out on a regular basis because the entire thing is being booted from a known good image, and that image is created from known good code, etc. The pieces already exist. AMD SEV, Intel TDX, Amazon Nitro and others support RA protocols for virtual machines, Linux has support for propagation of attestations through the service stack. But there seems to be a lack of orchestration tools to bring all the parts together. If there's any interest in signing a letter of intent for such a tool please get in touch (email address in profile).
- chc4 3y ago
  Enarx/wasmcloud are pretty similar to this, and are being supported by the Linux Foundation. This design also doesn't solve supply chain issues: fundamentally you don't have a way of telling if the bytes you're running in the enclave, even though they were attested to be what was supplied by the developer, are free of supply chain backdoors. You would have attestations that you are running SolarWinds, not that the SolarWinds software you're running is free of vulnerabilities. Transiently hacking machines is also really APTs need for network penetration, since once you do that you achieve network persistence on different boxes or escape the attested services to some priviledged Exchange server on the LAN.
sakerbos 3y ago
I really enjoyed that article. I do love a good conspiracy theory and I found this piece particularly interesting: "The US Cybersecurity and Infrastructure Security Agency wanted to know whether any research labs developing Covid vaccines had been hit." Why were the Covid research labs of most concern to CISA as opposed to something like the presidential office?
- nibbleshifter 3y ago
  At the time, attacks on healthcare were very much top of mind for everyone.
this_steve_j 3y ago
I’m holding out hope for an NTSB-style investigation report by CISA that is a giant website with 1000s of pages of analyst notes and digital forensic evidence and shows exactly how they found out what they did as it happened. For all the the $100mil’s that have been spent over the course of this cyber Pearl Harbor event, there should be something monumental added to the public record that every comp sci and cybersecurity student or pro can learn from for the next 50 years. Data from these big attacks shouldn’t be limited the rarefied few folks who are lucky enough to take a $9000 SANS SEC541 course or work on a CIRT team for a Fortune-100 company whose sausage is among those roasted by the the fire.
waste_monk 3y ago
I'm not sure I agree with the title... surely Crypto AG would be bigger/more influential?

156 points by SerCe 3y ago

why ppl call this a supply chain attack??? the simplest abuse of an all-powerful application coded by illiterate criminals who even sold company stock when things were to become public. the real attack is how they managed to sell this to so many high profile targets. that is conveniently left out of every report, including this lame one from wired. my guess, since they sold to fireeye, is that it's the same circle of people who can get these type of contracts. a shadow elite of formet NSA consultants helping each other.

sigio 3y ago

https://archive.ph/X9fqZ https://archive.ph/X9fqZ

TheJoeMan 3y ago

This story reads as merely attempting to cover for Mandiant's reputation. They are "the ones on speed dial" for customers and seem to be trying to salvage. Definitely a rare glimpse into the deep state, how many other companies have contacts at the NSA?

nibbleshifter 3y ago
Quite a few security companies will have back channels to the NSA. There's a revolving door between NSA and "cyber". Same shit in the UK, some of the bigger consultancies have very cosy relationships with GCHQ.
trefoiled 3y ago
I picked up on this too. Everyone involved has a perverse incentive to portray the narrative as the work of genius, innovative hackers. That's the issue with an article like this, where all the quoted sources are people directly involved. I would have appreciated some 3rd party analysis of just how sophisticated this attack really was, and how much of the blame should really rest on the lax standards of the victims. Mandiant in particular doesn't have much excuse.

column 3y ago

See, that's a long article I would have just skipped a year ago. Now, we get to play with its content and it's fun : Joe: So, it was late 2019 when we stumbled upon the breach at the think tank. Donald: And what did you find, Joe? Joe: Another digital security breach, nothing special. But then we found a second group of hackers, more skilled, going after specific executives, policy wonks, and IT staff. Donald: Damn, that's some precision targeting right there. Joe: Yeah, we kicked them out, but they kept coming back. We found out they had planted a backdoor three years earlier, and we never even knew. Donald: Three years?! They were playing the long game, huh? Joe: You could say that. And in June 2020, they came back. We spent days trying to figure out how they slipped in. Donald: And how did they do it? Joe: They zeroed in on a server running SolarWinds software. And that's when the Department of Justice called us. Donald: Those hackers were clever. Joe: You're damn right they were. They had gained access to the firm’s multifactor authentication system and were conducting counterintelligence against one of their biggest foes. Donald: Who was that? Joe: Mandiant. Donald: And did Mandiant catch them? Joe: Yeah, they did. But here's the thing, Don. Mandiant had investigated an intrusion on a server running the same SolarWinds software months earlier. Donald: No way. Joe: Yeah, way. And they didn't recognize the similarity between the two cases. Donald: Why not? Joe: Internal secrecy, man. And SolarWinds was the source of the hack. Donald: That's what caused all the anger, huh? Joe: You got it. And the US government won't say what the hackers did inside its networks. People are saying they don't want to admit their failures.

mlb893 3y ago
Great use. I'm assuming you used the API for that long of a text?
- samstave 3y ago
  How was that summarized?
  - mlb893 3y ago
    It says something about how long the original article was.

NoMoreNicksLeft 3y ago

Do I understand correctly, that the hackers improved the dll's code deliberately, so that Orion wouldn't manifest bugs which might invite debugging scrutiny that also revealed the backdoor?

stevenwoo 3y ago
The way I read it, they left the other functionality unchanged and injected their source code change into the .dll source, made the build process build both the hacked version and the unhacked version (for later) and put the hacked version into the installation package and deleted evidence of the hacked dll in the build and restored the unhacked dll to it's place so no one could tell what happened just by looking at the end results and doing a dump or binary diff on just that dll. Similar to but not the same as the pirated xcode malware injection.
GTP 3y ago
Probably, this sounds like a plausible explanation.
nibbleshifter 3y ago
It used to be fairly common practice for skilled hackers to patch the way they got in, to avoid their borrowed systems from being invaded by skids.
- ComputerGuru 3y ago
  This is different, more like putting a trap door in the ceiling and then patching all the leaks in the roof so that the homeowner won’t need to climb up on to the roof to fix those themselves and in doing so stumble on your trap door.

revelio 3y ago

Disappointing, the article doesn't say anything new or untold beyond some minor personal details about the people involved and the fact that people repeatedly missed major clues because they weren't talking to each other. Also, the article repeatedly insinuates that the attack was traced to the Russian government, in fact it says it so often a casual reader could be forgiven for thinking they had proof. But a careful reading shows that they have absolutely no idea who did the SolarWinds hack. The link to the SVR is simply that Kevin Mandia has a "hunch" based on "pattern recognition" from his work in the 1990s. Not only is no proof presented, they don't even have anything that could be called evidence. Writeups of hacks are always like this nowadays. It's the Russians. How do we know it's not the Chinese, or the Americans, or the British? We don't but if we say it's the Russians everyone will be on our side, so let's roll with that. I really wish journalists would not try to manipulate readers like that. It'd be more honest to say they don't know. Trying to slip a completely made up SVR connection past the readers like that implies the rest of the article might just be spin too.

brabel 3y ago
I was watching the news last night, and apparently, not only they're pretty sure it was Russia that bombed the half-Russian pipelines to Europe (NordStream2), but it was Russia (or Russian partisans, whatever they mean) that tried to kill Putin last night with a drone attack as well. You can accuse Russia of anything you want in the current climate, and everyone will take you seriously regardless of evidence.
- stickfigure 3y ago
  When you have a history of lying and running malevolent information operations, plus invading your neighbors on multiple occasions... yeah, you kinda lose the benefit of the doubt. Your comment looks like an information operation itself. As far as I can tell, the only claims that the drones "tried to kill Putin" come from Russian state media.
  - brabel 3y ago
    When you start accusing someone or a country of everything, it's not them who are losing the benefit of the doubt. It's you who are losing any credibility. > As far as I can tell, the only claims that the drones "tried to kill Putin" come from Russian state media. Well, I was reporting what the news said, and it was definitely not the Russian media.

robszumski 3y ago

This incident and the Colonial Pipeline attack were the main drivers behind the Biden cybersecurity executive order "Executive Order on Improving the Nation’s Cybersecurity" [1] which has driven changes to policy at NIST, FDA, OMB and others [2]. My opinion is that while these policies are fuzzy and lack specifics, it's just the first round of pushing industry in the correct direction without mandating specific tools or methods. In the EU, the proposed Cyber Resilience Act has maybe cast too wide of a net, snagging any open source contributor as a software "manufacturer". 1: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action... 2: https://edgebit.io/regulations/ https://edgebit.io/regulations/

bell-cot 3y ago

I stopped reading in paragraph 9, at: > When investigators finally cracked it, they were blown away by the hack’s complexity and extreme premeditation. "Extreme premeditation?" Please. The old USSR had quite a few spies who stayed active for decades inside America's Top Secret Tent. A century ago, if a navy wanted a new battleship, it could easily be 7 years between "start spending money" and "battleship is completed and ready to use".

Forgeties79 3y ago
Maybe I'm naive or dumb or something but I feel like comparing a hacking attempt to the construction/crewing/deploying of a battleship doesn't make a whole lot of sense? It takes a lot of work to build a motorcycle that is roadworthy from scratch. It takes a lot of work to build a skyscraper and develop it into a used space from scratch. Talking about the latter doesn't really discount the former, right?
- bell-cot 3y ago
  My (not so well made) point was that having a two-ish decade planning horizon for serious national security activities was old hat back when punch cards were leading-edge computer technology. Vs. from a skim of the article - the entire Solar Winds operation was less than 24 months, from plausibly-first little compromise of an employee's VPN account through detection and fix. That is "Extreme premeditation" about the same way that my hard-boiling eggs for a week's lunches every Monday morning is "Extreme premeditation". (Vs. if they'd described it as a major effort by an A-list adversary - yeah, that would have been quite reasonable.)
  - nibbleshifter 3y ago
    In a field as fast paced as information security, that is a long fucking time.
wlitlwijatli 3y ago
Ships and planes today take waaayyy longer than seven years to create. The F-22 took 24 years to deliver.

ahi 3y ago

It's amusing how these stories always include the breathless account of the genius hackers. It boiled down to a few thousand lines of code in a dll. There's only so much genius you can get into a few thousand lines of code. In reality, SolarWinds did something stupid, then some of their customers connected it to the internet and didn't even firewall it. Hackers will always have success not because they're brilliant, but because there will always be some marks who didn't cross their i's and dot their t's.

munificent 3y ago
> There's only so much genius you can get into a few thousand lines of code. Einstein's paper that introduces E=mc^2 is about three pages long.
loxias 3y ago
I agree in spirit, and I also share an attitude of "if you're hacked, it's your fault." It's Not That Hard to choose to not run random binaries from the internet, and keep your ports closed. > There's only so much genius you can get into a few thousand lines of code That being said, Stuxnet? So clever. edit: Depending on the language or libraries, 1000 lines is a LOT. Cleverness is frequently in reduction or rotation, not addition. Choice of data structure, etc. c.f. the 'k' or 'j' programming languages.
- doubled112 3y ago
  > if you're hacked, it's your fault I'm on the fence about this. In a perfect world, I agree. In real life? "They" only need to get lucky once. I need to be perfect all the time, and it probably isn't going to happen. Don't get me wrong, it is always somebody's fault. If your is meant as in your business, I'd lean more to the agree side. Security basics are just a cost centre, right? And how are you supposed to vet a binary from a trusted vendor?

duped 3y ago

This article also misses the part where JetBrains got accused of being a Russian asset by tech media.

koalacola 3y ago
Lol what? Because they're Czech?
- boomboomsubban 3y ago
  I believe they had a sales office in Moscow, which was enough for the rumor mill. "Had" being key, as around the same time they pulled out of Russia.
- duped 3y ago
  This is the original article: https://archive.ph/RsZtc https://archive.ph/RsZtc It was a bunch of embarrassing speculation

lesuorac 3y ago

> The practice of placing legal teams in charge of breach investigations is a controversial one. It puts cases under attorney-client privilege in a manner that can help companies fend off regulatory inquiries and fight discovery requests in lawsuits. I wonder if the new DoJ agrees with this approach.

hnthrowaway0328 3y ago

For SolarWinds hack, there also remains the question whether there was any insider job.

mike_hearn 3y ago

Here's the sketch of a defense against such attacks. Is there anyone out there who'd buy it, if it existed? Imagine a tool that given a simple description of a server (e.g. pointed at your build system or a downloadable artifact like a container image) creates a VM that starts the app on boot, uploads that VM image to the cloud, starts it up and then performs a remote attestation protocol to verify that the remote VM is running what you think it's running, down to the last byte. Remote attestation allows you to "measure" a VM or enclave to determine a cryptographic hash of everything running on the machine in an auditable way. Sometimes the VM has encrypted RAM so you can prove that the cloud provider can't break into that machine. It could potentially have helped in this case where the attackers compromised a build system. Remote attestations can be chained together and used as signatures, so for example SolarWinds could have come with a proof that it was compiled correctly from a particular git commit hash, and then third party auditors could have been hired to monitor that the code doesn't have backdoors. Customers could then run it and get from this imaginary tool a complete audit chain all the way back to a certificate issued by a third party that says "we reviewed the code at commit <hash> and this program was compiled from that code via a build system audited via remote attestation". Now, RA isn't a silver bullet. It's still possible to transiently hack a machine such that the hack remains in memory. But if you regularly reboot and re-attest your VMs, you can wipe these hacks out on a regular basis because the entire thing is being booted from a known good image, and that image is created from known good code, etc. The pieces already exist. AMD SEV, Intel TDX, Amazon Nitro and others support RA protocols for virtual machines, Linux has support for propagation of attestations through the service stack. But there seems to be a lack of orchestration tools to bring all the parts together. If there's any interest in signing a letter of intent for such a tool please get in touch (email address in profile).

chc4 3y ago
Enarx/wasmcloud are pretty similar to this, and are being supported by the Linux Foundation. This design also doesn't solve supply chain issues: fundamentally you don't have a way of telling if the bytes you're running in the enclave, even though they were attested to be what was supplied by the developer, are free of supply chain backdoors. You would have attestations that you are running SolarWinds, not that the SolarWinds software you're running is free of vulnerabilities. Transiently hacking machines is also really APTs need for network penetration, since once you do that you achieve network persistence on different boxes or escape the attested services to some priviledged Exchange server on the LAN.

sakerbos 3y ago

I really enjoyed that article. I do love a good conspiracy theory and I found this piece particularly interesting: "The US Cybersecurity and Infrastructure Security Agency wanted to know whether any research labs developing Covid vaccines had been hit." Why were the Covid research labs of most concern to CISA as opposed to something like the presidential office?

nibbleshifter 3y ago
At the time, attacks on healthcare were very much top of mind for everyone.

this_steve_j 3y ago

I’m holding out hope for an NTSB-style investigation report by CISA that is a giant website with 1000s of pages of analyst notes and digital forensic evidence and shows exactly how they found out what they did as it happened. For all the the $100mil’s that have been spent over the course of this cyber Pearl Harbor event, there should be something monumental added to the public record that every comp sci and cybersecurity student or pro can learn from for the next 50 years. Data from these big attacks shouldn’t be limited the rarefied few folks who are lucky enough to take a $9000 SANS SEC541 course or work on a CIRT team for a Fortune-100 company whose sausage is among those roasted by the the fire.

waste_monk 3y ago

I'm not sure I agree with the title... surely Crypto AG would be bigger/more influential?