SolarWinds mess flared in the holidays - company confirms malware targeted crocked Orion product
(2021/01/04)
- Reference: 1609743493
- News link: https://www.theregister.co.uk/2021/01/04/solarwinds_malware_confirmed/
- Source link:
The extent and impact of the SolarWinds hack became even more apparent – and terrifying – over the holiday break.
On New Year’s Eve, SolarWinds confirmed that it has identified malware that exploited the flaws introduced to Orion products.
We already knew about [1]“SUNBURST” , the attack that poisoned Orion.
SolarWinds’ pre-party [2]post revealed that “SUPERNOVA” is “malware that is separately placed on a server that requires unauthorized access to a customer’s network and is designed to appear to be part of a SolarWinds product.”
“The SUPERNOVA malware consisted of two components,” says SolarWinds’ advisory. “The first was a malicious, unsigned webshell .dll 'app_web_logoimagehandler.ashx.b6031896.dll' specifically written to be used on the SolarWinds Orion Platform. The second is the utilization of a vulnerability in the Orion Platform to enable deployment of the malicious code. This vulnerability in the Orion Platform has been resolved in the latest updates.”
Kremlin hackers are right now exploiting security hole in VMware software to hijack systems, NSA warns [3]READ MORE
The company’s [4]FAQ says it is yet to find a link between SUPERNOVA and SUNBURST. The last update to the FAQ was made on December 31st, 2020. Friday January 1st was a Federal holiday in the USA, followed by the weekend.
Microsoft, meanwhile, has offered further details of its brush with the attacks by [5]revealing that it had indeed fallen victim to the hack – but not in a particularly bad way. Redmond’s self-analysis “found no evidence of access to production services or customer data” and “no indications that our systems were used to attack others.”
But Microsoft’s probe did find “unusual activity with a small number of internal accounts and upon review” one of which “had been used to view source code in a number of source code repositories.”
The good news is that the account had look-don’t-touch privileges, so no code was altered, and Microsoft was able to remediate the relevant accounts.
Microsoft’s post also revealed: “our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk.”
Hopefully, other users of compromised Orion implementations were similarly cautious, because The New York Times [6]reports that it is now felt that the attackers gained access to “as many as 250 networks”. That estimate handily tops the previous assessment of “a few dozen” compromises.
Between SolarWinds’ ongoing investigations and the unknown extent of the attack’s penetration, this story is far from over. Indeed, December 30th supplemental guidance from the USA’s Cybersecurity and Infrastructure Security Agency (CISA) not only ordered 24-hour upgrades to clean versions of Orion but promised to “follow up with additional supplemental guidance, to include further clarifications and hardening requirements.” ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2020/12/21/in_brief_security/
[2] https://www.solarwinds.com/securityadvisory
[3] https://www.theregister.com/2020/12/07/nsa_vmware_russia/
[4] https://www.solarwinds.com/securityadvisory/faq#question4
[5] https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/
[6] https://www.nytimes.com/2021/01/02/us/politics/russian-hacking-government.html?searchResultPosition=1
[7] https://whitepapers.theregister.com/
On New Year’s Eve, SolarWinds confirmed that it has identified malware that exploited the flaws introduced to Orion products.
We already knew about [1]“SUNBURST” , the attack that poisoned Orion.
SolarWinds’ pre-party [2]post revealed that “SUPERNOVA” is “malware that is separately placed on a server that requires unauthorized access to a customer’s network and is designed to appear to be part of a SolarWinds product.”
“The SUPERNOVA malware consisted of two components,” says SolarWinds’ advisory. “The first was a malicious, unsigned webshell .dll 'app_web_logoimagehandler.ashx.b6031896.dll' specifically written to be used on the SolarWinds Orion Platform. The second is the utilization of a vulnerability in the Orion Platform to enable deployment of the malicious code. This vulnerability in the Orion Platform has been resolved in the latest updates.”
Kremlin hackers are right now exploiting security hole in VMware software to hijack systems, NSA warns [3]READ MORE
The company’s [4]FAQ says it is yet to find a link between SUPERNOVA and SUNBURST. The last update to the FAQ was made on December 31st, 2020. Friday January 1st was a Federal holiday in the USA, followed by the weekend.
Microsoft, meanwhile, has offered further details of its brush with the attacks by [5]revealing that it had indeed fallen victim to the hack – but not in a particularly bad way. Redmond’s self-analysis “found no evidence of access to production services or customer data” and “no indications that our systems were used to attack others.”
But Microsoft’s probe did find “unusual activity with a small number of internal accounts and upon review” one of which “had been used to view source code in a number of source code repositories.”
The good news is that the account had look-don’t-touch privileges, so no code was altered, and Microsoft was able to remediate the relevant accounts.
Microsoft’s post also revealed: “our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk.”
Hopefully, other users of compromised Orion implementations were similarly cautious, because The New York Times [6]reports that it is now felt that the attackers gained access to “as many as 250 networks”. That estimate handily tops the previous assessment of “a few dozen” compromises.
Between SolarWinds’ ongoing investigations and the unknown extent of the attack’s penetration, this story is far from over. Indeed, December 30th supplemental guidance from the USA’s Cybersecurity and Infrastructure Security Agency (CISA) not only ordered 24-hour upgrades to clean versions of Orion but promised to “follow up with additional supplemental guidance, to include further clarifications and hardening requirements.” ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2020/12/21/in_brief_security/
[2] https://www.solarwinds.com/securityadvisory
[3] https://www.theregister.com/2020/12/07/nsa_vmware_russia/
[4] https://www.solarwinds.com/securityadvisory/faq#question4
[5] https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/
[6] https://www.nytimes.com/2021/01/02/us/politics/russian-hacking-government.html?searchResultPosition=1
[7] https://whitepapers.theregister.com/
What about smaller targets for smaller criminals?
How about all the Managed Service Providers and the tools like LabTech and ScreenConnect, both now owned by a private equity firm... whose likely singular purpose in life is profit above everything else? Or LogicMonitor or Ninja if those are your flavor? (These are just the ones that I'm familiar with, there are plenty of others, so any omission is not intentional.)
These are common products installed in small to medium businesses (aka - not publicly traded) and depend on a default installation of being an admin.
As I understand it, Solarwinds was warned a few years ago that they needed a CSO and ignored it. Given that Orion customers are generally massive companies and governments who should have the capabilities to independently detect rogue behaviors and missed this... how would a smaller company like Connectwise (who might not give a shit) embedded into even smaller companies who don't have the capabilities, fare?
This supply-chain attack of Solar Winds seems like the tip of an iceberg to me.