SolarWinds Orion Supply Chain Attack

[Phlyra]

Since the search function would appear to indicate that there is no specific thread for this topic, I thought I’d create one and share a few relevant links as it’s probably of interest to most people in this community.

Security Advisory | SolarWinds

This page covers the SolarWinds response to both SUNBURST and SUPERNOVA, and the steps we are taking in response to these incidents.

www.solarwinds.com

SolarWinds Hack Has Affected Microsoft, The Company Confirms

Microsoft has confirmed that its security systems were penetrated following the SolarWinds hack a few weeks ago. Read here.

interestingengineering.com

The Future of Software Supply Chain Security – Purism

Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.

puri.sm

If there is in fact already a thread specific to this topic, I’d be more than happy to be pointed in its direction and for this one to be closed.

 

[levi]

No, I don't recall there being a general purpose computer security thread round these parts. I think I made a thread for some copy on write bug or other back in the day, for example.

This hack seems to be a nation state thing as far as I've read, but it's not clear just yet who the target was. Of course, if your network has been compromised by the installation of this hacked software, you now have an in where you didn't have one before, so you'll need to roll back to get rid of it. But in terms of saleable secrets it's likely to only be a few companies or nation states that are affected.

 

[TeDaDeS]

There might also be a difference in incentive to publish (and fix) security issues between a commercial company and an open-source project.
Obviously with open-source you have the option to fix it yourself if you a capable of doing so. With closed-source you depend on the owner of the code to get if fixed, which probably always takes more time then doing it yourself.

There are two more issue which makes this issue worse: we rely on our digital world for almost everything now, which makes the impact of digital attacks worse. And software isn't secure by design, it's just code running on a CPU which also relies on additional code to be secure.

So I to me it's always weird to hear companies, and especially governments, claim that their software is very secure. While that security is usually added by either software or by a certain process. (But we use firewalls!)
When I hear these kind of attacks I look at how complicated it was to perform, and the SolarWinds attack actually looked like an easy one to pull off
Imagine how many others are available that haven't been made public yet.

 

[levi]

I don't honestly see how the license this software is under changes anything. The entry was a borked update server which spammed users with dodgy packages, and that's a problem that linux has battled with for a good few years now (which is why packages are mostly signed on significant distributions these days, but really that just complicates the hack slightly more but still doesn't make it impossible to achieve).

 

[Phlyra]

I guess the argument is more to do with time/ability to fix?

 

[levi]

Maybe. You could say that solarwinds ought to have noticed their update server had been compromised and done something about it, but apparently that didn't happen. In terms of fixing this, you need to reinstall the OS on all computers. That's slightly easier on linux than it is on windows (or at the very least, a lot cheaper) and I don't know about MacOS X, but that's an arfefact of the way the system's built up really. User data shouldn't be so much of a problem in this hack compared to ransomware hacks that encyrpt your user data. the only risk is that certain bits up it might have been uploaded to the bad guys. But you can't trust the OS, so reinstall that.

 

[Phlyra]

User data shouldn't be so much of a problem in this hack compared to ransomware hacks that encyrpt your user data.

Does the fact that that doesn’t appear to have happened, indicate that this was all just about scraping closed source code/seriously intimate data, rather than also trying to engage in blackmail for data restoration?

 

[levi]

Yes, though I wouldn't call it closed source, but seriously intimate data roughly gets the gist of it. There's no source involved if it's a database or a excel spreadsheet. But that's the impression I got, the solarwinds product was compromised so that it'll accept commands from outside, and those commands likely included things like navigating the server and it's connections and uploading anything that looked tasty.

 

[Phlyra]

Yes, though I wouldn't call it closed source

What about Microsoft’s source code?

 

[levi]

True, they were affected. I wouldn't pay much for the windows source code though personally, so I may be out of the loop, but I don't consider that worth much.

 

[Phlyra]

In case there are users here who were unaware of this (I only just received a notification about it ) :https://www.techtimes.com/articles/...user-files-23-000-hacked-databases-shared.htm

Maybe we should have a general cyber security thread - including how to harden our Pyras... ?

 

[Null]

including how to harden our Pyras... ?

 

[λ the β-Redex Reducer]

That reminds me of the Evil Bit RFC. Someone ought to implement an Evil Bit scanner into the Pyra.

 

[levi]

In case there are users here who were unaware of this (I only just received a notification about it ) :https://www.techtimes.com/articles/...user-files-23-000-hacked-databases-shared.htm

Maybe we should have a general cyber security thread - including how to harden our Pyras... ?

I don't think based on the date that's a solarwinds attack. That attack does stretch back a bit, but I don't think they were publishing their gains back then.

In terms of hardening our Pyras, update often and use separate strong passwords for different sites. That's about it.

 

[Phlyra]

I don't think based on the date that's a solarwinds attack. That attack does stretch back a bit, but I don't think they were publishing their gains back then.

In terms of hardening our Pyras, update often and use separate strong passwords for different sites. That's about it.

The brief description I read about it didn’t sound like the SolarWinds attack but I thought I’d put it in this thread about hacks (and hence my comment about a thread specific to cyber security - maybe I’ll change the title to be more encompassing).

Mmm but there are presumably other things we can do like Wireguard, pfsense/opensense, Adblock, Fail2ban etc. ?

 

[levi]

True. Fail2ban is presumably only actually useful if you've enabled a server on the system. And wireshark was more about exploring your local wireless network. You could argue that attack is the best form of defence, but I don't buy that in computer security at the very least. I don't run adblock myself. I run umatrix and block all scripts and all third party images since the nefarious tricks that trackers use to spy on me became clearer. I back off those restrictions only after trying leaving them enabled. It does mean I rarely feel the need to enable scripts for advertisers, so I rarely acutually see any adverts, but if they were more locally hosted and simple GIFs and JPEGs like they used to be, then I wouldn't mind and might actually enable them.

And I'm not familiar with opensense. I'll have to look into that.

 

[JDTAY]

On CBS this morning, they were arguing that since the SolarWinds attack came in part from servers inside the US, the NSA should have the right to spy on US servers.

I like how they ignored the fact that we know the NSA has already been illegally spying on US servers, from Bush to Obama to Trump, and probably still under President Biden.

I like one guy's hot take about this from back when it was first discovered, which is that we know the US does this stuff to other countries, so they probably don't want to punish other countries for it, lest turnabout becomes fair play.