Hacker News Reader

Comment by jackconsidine | Hacker News Reader

> The adversary added a malicious version of the binary solarwinds.orion.core.businesslayer.dll into the SolarWinds software lifecycle

Can someone explain how they were able to do this?

View on HN

It was previously reported that the user name/password of the FTP server used to distributed updates was accidently uploaded to github by SolarWinds.

This is almost certainly just a funny and unfortunate coincidence. The malicious binary was signed, you can't do that with just FTP upload access. The code looks to be injected at build time according to this report by reversing labs: https://blog.reversinglabs.com/blog/sunburst-the-next-level-...

'Signing occurred within a minute of library compilation. That leaves no time for the attackers to be able to monitor the build system, replace the binary and change the metadata to match this perfectly. The simplest way for all these timestamp artifacts to align perfectly is to have the attackers’ code injected directly into the source, and then have the existing build and signing system perform the compilation and release processes as defined by the Orion software developers.'

Thanks, that's interesting.

The interesting part is it looks like they somehow got hold of the SolarWinds signing key to sign the binary.

I'm not sure why you say it's interesting, signed binaries was always known to be a useless measure against APT level threats, getting signing keys is probably the easiest thing at that level. I remember Microsoft even publicly admitted they can't do shit against APT, so all of their "security" PR is essentially not real security, but that's been a thing with all megacorps for years now.

Getting _a_ signing key is not equal to having access to SolarWind's signing key. It is interesting because it shows the extent of the breach.

They weren't verifying their build outputs against their build inputs. That or there was a rogue insider. We'll never get the full story.

Reply on news.ycombinator.com