But the concerted marketing effort pays dividends. Solarwinds is almost the only choice for government. For potential attackers its a big red arrow. Exploit a rent-seeking company that writes mediocre software and exists mostly to cash in on "best practice" lock-in with government contracts.
as far as i know nobodys really addressed the elephant in the room. Solarwinds is still a preferred government purchase for monitoring. every company that was affected by it still uses it (or at least hasnt publically refuted it) and no government official has come forward to admit they will discontinue it. Solarwinds hasnt offered any remediation or major changes in their development, leadership or code. just patch, rinse, and repeat and try not to pay too much attention to the issue.
Not accurate re: leadership. A new CEO just started in January, and their CTO was either terminated or he left just after the hack news.
Second, with such negligence? They deserve to be shut down. This isn't a highly sophisticated zero day exploit, there were multiple huge failure at Solarwinds that allowed the attack to happen.
Calmly, our CEO said: 'No. If there's anyone in this company who will never make that mistake again it's him.'
I was in the room when the CEO told that (one of the nice things about small companies) and have had contact with the person responsible for a few years until he got another job. True story ;)
There were changes though: the 'two pair of eyes' principle was enforced a lot stricter from then on.
A far better system is "no fault" where the company has incentive to be open about problems and finding solutions.
I think the elephant in the room is actually a more general issue that is cross platform and independent of the product implementation.
It’s 2021 and we are still ignoring the fundamental “best practice” that we’ve known about for at least 20 years.
Systems should be isolated from each other unless there is an overwhelming need for them to be connected and everything should run with the least privilege.
Centralised credential vaults and binary artefact repositories are an obvious example.
The two computers are developed by two independent teams who are not allowed to talk to each other. Two different CPUs, two different algorithms, two different programming languages.
The idea, of course, is a design problem with one does not propagate to the other.
If one program is used in all your infrastructure, all your infrastructure is compromised when that program has a bug.
As a marine saying goes, never take two chronometers with you to the sea. Take either one or three.
1) Build servers: Maybe by keeping it possible to build one's software on a laptop — then, when it's time to release something, one can build the software at the build server plus some people's laptops and compare hashes.
2) ???
3) Different people who don't talk with each other, do security code review, independently of each other? Hmm does that make sense
And we should have checks built into the build pipelines and checksum the files that go into the build. We have Merkle trees for a long time. I think, it would be possible to detect injected code.
On April 28th 2021 they will announce Q1 2020 results. THAT's when we'll know for sure how bad this hurt them.
They may release less than sanguine guidance on Feb 25th, we'll see.
The reason why I know this stuff I will leave as an exercise to the reader. :)
But Microsoft's "system of trust" was undermined. The attacker was even inside Microsoft and Azure. No anti-virus, no "defender", no amount of basic or advanced telemetry caught this.
FireEye alone caught it... By accident.
The real "elephant in the room" is that software security continues to be marketing theatre. Closed-source software should not be trusted and consumers should not believe that any due diligence has been done to protect them.
Overall I tend to agree with your general points, but, this statement.
Would you say that seatbelts are "safety theatre" because some people die in car accidents while wearing a seatbelt?
I really don't think it's fair to attribute all software security as BS, especially given the resources state actors throw at breaking software. It's like arguing your seatbelts don't work because your 4 door sedan was hit by a bus.
Seatbelts are real security measures. Still, more than 60K people die every year in motor accidents in North America and in the EU. Seatbelts cannot save life in all cases, such as outrageous speeds, but they are a sane measure for most -- if not all -- use-cases of driving.
In this compromise, the major purveyor of OS and security products itself was compromised. No company, no $agency did due diligence. Some of these victims are supposed to be in the business of high-assurance and due diligence.
None of the systems that we are conditioned to believe to be effective actually worked. And it was a standard use-case for all the victims.
The malware keeps a "breadcrumb" trail of each machine it infects, and based on investigations by Symantec [1] it was determined that every Stuxnet sample from Natanz originated from outside suppliers.
It was so sophisticated at not being detected that it went under everyone's radar for 5+ years.
Stuxnet behaved in exactly the same way.. neither did anything that would be detectable unless certain criteria was met and a secondary payload sent.
Stuxnet was very sophisticated to hit a relatively narrow target by comparison.
So I think they are both sophisticated, but not comparing them directly.
I would love to know how many machines got hit by SOlarwinds - however, its not about the machines - its about the value of the data it slurped... So even if it was one exchange server, with 10,000 treasury/nsa/whatever accounts, that one machines intel value is quite high.
inflitrate an airgapped network -> silently spread within -> silently destroy complex unique equipment
compromise central infrastructure -> silently spread to customers via compromised updates -> silently exfiltrate useful data/create an advanced persistent threat (APT).
The APT/Exfiltration work is much more close to the sophistication of the virus that attacked the centrifuges than the bad password. For all we know the hack could have levereaged information gained via kaspersky, telegram, or whatever other software to do sophisticated things much the same way we asked Siemens for their help.
We don't have enough information to make an assessment yet.
That's not fair. It should sound like this: "the initial attack vector was a Windows 0day requiring 0 clicks, delivered by a USB stick in a parking lot."
https://arstechnica.com/information-technology/2020/12/18000...
“Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.”
https://www.fireeye.com/blog/threat-research/2020/12/evasive...
You are saying my comparison is not fair because the USB stick actually had a 0 day which implies sophistication, but the supply chain build server was producing code and was also acting as a 0 day, in fact the actual payload appears to be significantly technically complex and custom.
Where do you draw the line between sophisticated and not?
USB in parking lot -> 0day -> horizontal movement 0days -> vertical movement 0days -> Payload delivery.
Bad admin credentials -> compromised build system -> supply chain 0day -> horizontal/vertical movement -> exfiltration of sensitive data.
[USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system -> supply chain 0day] or
[USB in parking lot -> 0day] to [Bad admin credentials -> compromised build system] or
[USB in parking lot] to [Bad admin credentials -> compromised build system]
The chinese successfully pulled this off at Lockheed in the early 2000s
They would get lists of employees who attended various conferences, then email them a trojan saying "hey we met at conference X - here is something for you to click on"
And employees would fall for it.
The malware would TRICKLE out data very slowly so as not to be noticed.
They did this for a LONG time.
At the time, lockheed only had 3 egress points to the internet - and they had 110,000 laptops.
Another attack vector was the same as stuxnet - airgap; attack a supplier in taiwan, infect any USB stick put into the suppliers machines, then transfer once that USB stick was put into the Lockheed machine.
When the ruse was discovered - the chinese removed the throttle and they attempted to firehose out as much data as they could before they were cut off.
Stuxnet "worked by first causing an infected Iranian IR-1 centrifuge to increase from its normal operating speed of 1,064 hertz to 1,410 hertz for 15 minutes before returning to its normal frequency. Twenty-seven days later, the worm went back into action, slowing the infected centrifuges down to a few hundred hertz for a full 50 minutes. The stresses from the excessive, then slower, speeds caused the aluminium centrifugal tubes to expand, often forcing parts of the centrifuges into sufficient contact with each other to destroy the machine."
The solar winds hack is an otherwise unremarkable trojan that spread exclusively due to the bad security measures of solarwinds.
>The solar winds hack is an otherwise unremarkable trojan that spread exclusively due to the bad security measures of solarwinds.
We don't have sufficient information to say what happened after the trojan landed is unsophisticated. All we have is the idea that microsoft benefits from making their attacker seem more competent than they are, which is true.
Which makes me think: A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. Or they could "accidentally" add a security vulnerability and exploit it.
"There is another theory which states that this has already happened."
This often happens with Chrome browser extensions that change hands and the new owner then injects malware or crypto mining or keylogging etc. into the newly acquired extension.
You are vastly underestimating the lengths that this attack when to avoid detection. They didn't just hijack Solarwinds updates and inject malware. They did things like concealing the commands of malware in legitimate looking Solarwinds packets. When they infiltrated a place, they had the malware sleep for months. They carefully avoid standard malware detection techniques and you can only do that if you have very sophisticated engineers. This isn't just some scripts someone pulled from the internet.
The US does not need to hack SolarWinds because they probably could use a court order for the same outcome to distribute rigged binaries for political enemies.
A thousand engineers is a huge project. You have no better knowledge than Microsoft about the attack.