Sealed U.S. Court Records Exposed in SolarWinds Breach
krebsonsecurity.com
krebsonsecurity.com
I haven't really kept up on the latest news about this hack so perhaps I missed an "official announcement" but I had assumed that both Microsoft and VMware were likely additional "attack vectors" as well (after initially "getting in" via Orion).
Microsoft had that NETLOGON issue (CVSS 10.0) a while back and VMware has had at least two (CVSS ~9.8+) "critical" (a.k.a. "drop everything and patch now") issues that I know of in the last several months as well.
Any one of those issues would almost certainly have given an attacker "the keys to the kingdom" (and, from my own experience at least, domain controllers, ESXi hypervisors, and vCenter servers don't typically get updated immediately!).
> I’ve fought for the federal government to create instead of buy.
Unfortunately, that just leads to the Government paying way too much for designed by committee software that isn't compatible with anything that anyone else uses. We've been there before and, IMO, the shift to COTS software was one of the best things to ever happen to U.S. Government agencies.
(On a side note, I've lost a lot of faith in VMware. For something they claim to be "secure by default", there sure have been a shitload of CVEs in the last year or two! Also, just a few months ago, they had to "re-release" patches for a 9.8 because the original patches didn't completely fix the issue!)
Attack vectors like Intel ME must die. (There are already DoD- mandated high-assurance flags to disable parts of ME; but megabyte blobs running on ring -1 must go completely so we can secure ring 0).
I have two points on this.
One. The power to sanction is losing the zest it once had. Russia has been building relationships that surpass mere political ties. They'll be fine.
Two. Maybe you don't know you're governments history. Maybe you don't care. I would say ask the middle east and South Americas, the history of any non-EU country that tried building national infrastructure using loans from the world bank and dead democratically elected presidents all over the Levant, Douth Americas and Africa.
Should I especially mention Libya? Did the US want to help Libya from being a top African/Arab nation? What about Venezuela? They're much closer. Are they helping Venezuela?
To your second point: What kind of whataboutism is this? The US does plenty of dirty deeds and should be called out for it by the rest of the world. That's no reason not to do so with Russia as well. I'm currently reading "The Divide", so I happen to recognize all those coups and dirty deeds you mention - and they are terrible, but also completely inpertinent to the question of holding Russia accountable for its actions on the world stage.
The rest of the world isn't really calling the US out on this out of fear of retaliation. Why aren't you doing it? Are you also afraid of repercussions inside your own country if you call them out? Knowing it's a crime and keeping quiet makes you complicit. Unless you don't actually care about the crime, just the perpetrator, which invalidates the premise of your comment which was:
> A government should not be able to act like that and still get to to interact normally with the rest of international society.
Obviously it can. Other government and the hundreds of millions of people they represent prove it.
I am, regularly and to anyone that will listen. And no, I live in a western democracy, so I'm not afraid of the repercussions here for doing so. Please stop your unfounded ad hominem attacks. But for the moment I would like to avoid this whataboutism - if a thread pops up criticizing the transgressions of the US rather than Russia, such as is the topic of this one, then I'll gladly participate there too.
With an opening like this:
> Can we just designate Russia as a rogue state and sanction the fuck out of them already?
I found my comment and question (which was as honest as possible) rather relevant and in no way an ad hominem attack. Based on your comments I highlighted the fact that it's a biased opinion, thus on very shaky ground and open to be challenged. An opinion that follows people/countries rather than actions/facts is not worth the pixels it's displayed with.
> completely inpertinent to the question of holding Russia accountable for its actions on the world stage
You wave the "whataboutism" flag to get out of any pinch but refuse to accept it's not whataboutism if it hits at your premise. The pertinent reason we can't/shouldn't hold one country (as per your statement) accountable on the world stage is that we don't plan on applying the same treatment fairly to everyone . This degrades the claimed intention of justice, and simply makes this look a blunt tool to be used by some countries against others in order to increase their power, legitimizing any attacks as "defensive" ("They're right to do it after being unfairly punished").
So it's exactly what I said when you "took it personally": we punish the country not the deeds, and this looks less like justice and more like something that justifies any response as defensive. Sure, you can punish selectively with the gun to everyone else's head but it just further strengthens my point.
I stand by my challenge and if you feel that taking it personally or claiming whataboutism at every step helps your case feel free to do it.
And I'll be clear on my position: all superpowers act the same to keep their power. Which is why none of them has to be allowed to get the upper hand over the others. With no checks and balances there's no superpower that will act "decently". At this point the US is the one on top of the pile trying to increase the distance. This makes me feel uneasy not because of the country (of the 3 I feel most comfortable with them there) but because of that "too much power" issue.
If you havent figured out why "the world" doesnt call out the US, then I don't know what to tell you. Perhaps you really do think/believe all that defense spending is just to fight brown people who just a year perviously were herding goats or studying. Maybe you think those gunships and M16s are water cannons and squirt guns respectively.
I don't really know.
> so I happen to recognize all those coups and dirty deeds you mention - and they are terrible,
Do you though?
And who must punish the US and what must the punishment be? Last I checked the US isn't accountable to the ICC or the UN. If you can recommend punishment for a sovereign state on the otherside of planet and claim to understand your shortcomings, what punishment do you deserve and how must it be carried out?
But this is pervasive in some cultures so it's taken for granted as a valid approach, look at judges even in free, democratic societies who punish people based on color rather than the crime. It's a similar problem albeit with different motives behind it.
There is not a nation on this planet that could so much as think of sanctioning US and come out ahead.
Modern finance still exists.
Also, how many other countries behave badly and should be "sanctioned the fuck out of"? Once you start looking at each country under a microscope, your list of countries that deviate from "interact normally" is going to get so long that you're really just walling off the G7 from the rest of the world economy - which is something Russia would love us to do.
Either way, this system is not feasible without basically a UN replacement. Until then, remember the US' long list of crimes before you call for economically crippling the Russian citizens.
Edit: Tostino, in case it wasn't clear, this was meant sarcastically, and I precisely wanted to call out the whataboutism, since that is doing Putin's errand, whether trough ignorance or malice.
Here's a hypothetical. Imagine the the Solarwinds hack had been performed by the NSA against a Russian company and the equivalent sections of government Would you call for sanctions against the US?
We're already doing these things with North Korea and Iran. I don't see any compelling argument why the actions of the Russian government shouldn't land them in the same boat.
I just wrote them in the comment you replied to: Don't "invade, murder or interfere in elections" of other countries.
So sanction the fuck out of the US too, as we still regularly engage in all three.
>And finally, the Magnitsky Act shows that we can actually effectively target those in power in Russia
>It really does feel like the past 7 years, Putin has really been testing the limits of what he can get away with, and sadly the answer so far is "as much backstabbing as he wants".
The evidence that Magnitsky acts work is dubious in the first placez as your earlier comment shows, but I really don't trust politicians issuing punishments without a trial.
>We're already doing these things with North Korea and Iran. I don't see any compelling argument why the actions of the Russian government shouldn't land them in the same boat
Decades of sanctions in those countries has never led to the kind of political upheaval you're calling for, while causing several hundred thousand deaths. Why subject Russia or yourself to that fate.
What is sauce for the goose is sauce for the gander. Or, to put it another way - One mans' terrorist is anothers' freedom-fighter.
The problem is obvious. The solution is not. Sanctions won't help, but I'm not knowledgeable enough to say what WOULD help.
Knowing this reaction of mine, every time I post something about either country, I have to be extra careful that I'm not indulging that.
Iraq and Afghanistan - who got super power'ed twice - would certainly agree with you. But their most recent concerns are not Russia.
p.s. The USA has quite a history of election meddling as well.
A long time ago I tried to start something similar in UK - http://oss4gov.org/manifesto
My contacts are in the profile if you want to chat / scheme :-)
Then Paul Manafort went on TV and gave the most unconvincing denial in the history of denials (That's what I sai... that's what he sai... that's, uhh, obviously what our position is.) Then Trump Jr preemptively tweeted soon-to-be-leaked emails detailing that they had in fact met with the Russians. Then the Muller investigation turned over a hundred other connections. Then, over the next four years, POTUS lifted the Magnitsky sanctions and turned a stubbornly blind eye every time Russia did something stinky, often directly contradicting public statements made minutes before/after from his own office.
Anyway, point is: there's an extremely powerful propaganda machine dead set on deflecting attention away from Russia, and that's concerning. More proof one way or another is always better, but this whole "there is no amount of evidence that can convince me Russia did it" trend is a problem.
> Officials and others w/ knowledge have said the evidence of Russian culpability is overwhelming and that the view in the admin is "pretty unanimous."
(That's a general comment, not directed at you or any other specific person)
I've always been a big fan of believe only half of what you see and none of what you read.
But welcome to HN
Skepticism of course stems from decades of government lies and misrepresentations of truth in order to justify horrendous actions ie. what was done to Iraq, Lybia, Syria.
(Note I'm talking about espionage in the information gathering sense, not the overthrowing of regimes action movie sense)
I really question this assessment. Russia is not USSR, not by a long shot. Russia has lost an entire generation of the most educated people it did have, and I see no evidence that it ever recovered or will ever recover. Economically tiny and outright insignificant Russia simply isn't capable of developing serious technological capabilities to rival that of the US.
It's not that the USA couldn't match them, it's just that Russia has made it more of a priority. Tactically speaking, it's an excellent force multiplier with (varying degrees of) plausible deniability.
I often skip login and reload and it logs me in as a system user. It probably shouldn’t do that.
You can ask anyone who uses Teams at work and they'll say it applies to all enterprise software.
I don't know what the answer is when balancing user acceptance/ease of use and business needs.
>Developed by network and systems engineers who know what it takes to manage today's dynamic IT environments, SolarWinds has a deep connection to the IT community.
>The result? IT management products that are effective, accessible, and easy to use.
Well yes, very accessible!
Don’t fire an engineer because they took unintentionally production down. Learn from it and fix it.
many can only hope.
https://www.justice.gov/usao-ri/pr/five-tied-millions-dollar...
The Russians or whoever it was could use this to warn individuals (ie state hackers) from flying because of sealed arrest warrants for very serious cases.
This is very serious indeed. And that’s only one scenario.
30% made it to >20 mins? Even on my best day, I can’t keep them on for more than 5 minutes.
Jim Browning fully owned the Indian scamming company (including CCTV cameras and live calls with UK people) and should be awarded for his work.
Tech support scammers are a massive problem, the US justice dept has only just scratched the surface.
"Kitboga" on YT manages to keep scammers on call for hours and hours, quite amusing that in the end he's the one gaining monetarily as his videos sometimes get millions of views.
At some point, you begin to wonder if they’ve started to script calls for max lols.
They can wreak all kinds of havoc with that information.
Like the article mentioned "informant names" seems pretty nuts.
So, no "air gapping" a tape library is called tape export, where the tapes are ejected into a port for the operator to stick on the shelf, or ship to cold storage.
A robotic tape library might fit that definition, and it might not.
Aren't thumb drives (USB) also vulnerable?
Yes.
I wonder if it is also possible to find a vulnerability in OCR software that could be triggered by a scanning maliciously formated sheet of paper.
See: hardware cryptocurrency wallets, trusted access modules, etc.
Of course, they breached Microsoft, and that one is popular all over the world. But at least until now, they are denying any larger problem.
In order to explain them more effectively, let's suppose that for the purposes of discussion that you are Mark Zuckerberg and that you run Facebook...
OK, so when you start Facebook, you make a promise to users, and that is, that their data that will be confidential, that is, only shared with parties that they give explicit permission to share that data with, and no one else, never.
In other words, that you will respect users' privacy.
This becomes part of the agreement you make with all new users, it becomes part of the user agreement -- the CONTRACT you made with them.
You engineer the system such that it will respect those rules, and you assume that nothing possible can go wrong.
But then later on, you realize that all of this was not as foolproof as you had once thought.
That's because Government, via it's Police and Lawyers, and it's NSL's and other legal instruments -- are now requesting information from you about your users, to solve criminal cases, but they're asking you to keep silent about user data you give them, basically because you were coerced by their Lawyers.
You begrudgingly turn over the data and keep silent about it, that is, you respect the Law -- but deep in your mind, in your conscience -- you know that something about this whole thing is very, very wrong.
You see, the problem that now occurs, legally, lawfully, morally and ethically -- is now that basically YOU'VE VIOLATED THAT CONTRACT YOU MADE WITH YOUR USERS.
You broke that CONTRACT.
And you also destroyed that trust.
You told people that a future set of events was going to happen (that their data would be kept private), that they relied on in making the decision of whether to give you their business or not, to give you their eyeballs or not, and YOU BETRAYED THAT TRUST.
YOU BROKE THAT CONTRACT
You didn't do it intentionally -- you had no way of knowing what future circumstances would turn out to be, but nonetheless, those circumstances resulted in YOUR BREACH OF CONTRACT.
That's because explicity or implicity or in both ways, YOU AGREED TO THAT RESPONSIBILITY.
THAT YOU WOULD PROTECT USERS
And because of circumstances, YOU DIDN'T
But nonetheless, YOU AGREED TO THAT RESPONSIBILITY.
Now, if you understand all of that... then here's the next piece of understanding...
The sealed court records -- are no different than Facebook user data in the above example.
The Court -- had a CONTRACT -- implicit, explicit (heck, I'll let Lawyers figure it out) -- TO KEEP THOSE DOCUMENTS SEALED.
Even though it was a third party, a set of circumstances, that caused the breach of that CONTRACT,
THERE STILL WAS A BREACH OF CONTRACT.
See?
Even though the players and the parts and the modes and the mechanisms are different, THERE STILL WAS A BREACH OF CONTRACT.
The Court contracted, CONTRACTED that it would keep these records confidential (compare Attorney-Client privilege), and they basically BROKE THAT CONTRACT.
What you have here is grounds for a super-big-ass CLASS ACTION LAWSUIT.
I'll let all of the Lawyers (aka "Bar Association Members") attend to that.
My point is simply this:
If you're running an online service in this day and age, if you have users, you cannot, CANNOT make any guarantees of privacy to them. Your best bet is to be honest and tell them that you'll take all the security best practices you can on your end, but at the end of the day, even that is no guarantee against a data breach, wanted or unwanted, done via lawful or unlawful means, executed by the Government or hacker group, or whomever.
YOU CANNOT GUARANTEE PRIVACY IN THIS DAY AND AGE.
It would be simpler just to be honest and up-front to all of your users and simply tell them that, EVEN IF as a result of this they stopped doing business with you, or using your website, or whatever.
You'd get a lot more sleep at night -- if you had a clear conscience...
I quote to you the 3rd Delphic Maxim:
"Surety brings ruin".
https://en.wikipedia.org/wiki/Delphic_maxims
If the Court (or any other entity, Government, Corporation, Person) makes promises to anyone else, implicitly or explicity, while those promises might not be written down, those promises constitute a CONTRACT.
On yesterday's thread it said that Team city was only used, in the intended fashion, as the delivery mechanism for the malicious payload. Kinda like blaming ftp when a hacker uses it to upload a payload.
https://blog.jetbrains.com/teamcity/2021/01/statement-on-the...
I'm sure that Solarwinds uses many more developer tools than what Jetbrains supplies. But only Jetbrains was "founded by Russians" so the NYT leads with that.
Same applies to any software. No software without a bug or an issue.