Russian spies reportedly used SolarWinds hack to steal US counterintelligence details
- Reference: 1633635005
- News link: https://www.theregister.co.uk/2021/10/07/solarwinds_russia_us_counterintelligence_details/
- Source link:
The alarming snippet was reported by financial newswire Reuters. The SVR was [1]named and shamed in April by Britain and the US as the organisation that compromised the build systems of SolarWinds' network monitoring software Orion, used by 18,000 customers across the world. Those customers included the UK and US governments, among many, many others.
The attack is said to have led to the Russian foreign intelligence service making off with "information about counterintelligence investigations, policy on sanctioning Russian individuals and the country's response to COVID-19," according to people involved in the US government's investigation who spoke to Reuters.
[2]
It was also reported that the SVR stole software signing certificates so their software could be run on them.
[3]
[4]
The attackers compromised SolarWinds' build servers, inserting a backdoor into the next version of the software that was distributed through trusted channels as part of a scheduled, routine update. They spent months covering their tracks and lying low to see if they'd been detected; it took even US infosec behemoth FireEye months to realise what had happened on its own networks.
Russia attempted to deny involvement in the compromise of SolarWinds' Orion network management 'n' monitoring product, though there was little room for doubt in the emphatic statements issued by the UK and US in April – along with their expulsion of known Russian spies from their territories as a mark of disapproval.
[5]Autodesk was one of the 18,000 firms breached in SolarWinds attack, firm admits
[6]SolarWinds urges US judge to toss out crap infosec sueball: We got pwned by actual Russia, give us a break
[7]Microsoft names Chinese group as source of new attack on SolarWinds
[8]SolarWinds issues software update – one it wrote for a change – to patch hole exploited in the wild
Orion's compromise was first noticed by FireEye, which said it detected the Russian intrusion in [9]early December last year .
Investigations revealed that Orion had been used as a foothold into thousands of organisations [10]including the US Treasury and Department of Commerce . The software was also [11]widely used in the British public sector , though official sources speaking off the record insisted that the Orion compromise had minimal effect on the UK.
[12]
The idea that Defence Equipment and Support just wasn't of interest to a foreign intelligence agency seems too farfetched to be true.
SolarWinds' chief exec, who took the post three days before the breach became public knowledge, declared that the 18,000 organisations affected by the backdoored software [13]was a "very small number" .
The firm is currently trying to stave off a lawsuit from aggrieved shareholders who [14]claim they were misled about SolarWinds' security posture , notwithstanding that they were attacked by a hostile state actor which went to extraordinary lengths to cover its track.
[15]
A not-very-subtle campaign to blunt the SVR's ongoing exploitation attempts post-SolarWinds was mounted by Britain's National Cyber Security Centre, which spent a gleeful couple of summer months [16]telling world+dog exactly [17]what the SVR did next after having the SolarWinds breach attributed to it. ®
Get our [18]Tech Resources
[1] https://www.theregister.com/2021/04/15/solarwinds_hack_russia_apt29_positive_technologies_sanctions/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YV9uJ7Ta6QIrmZsSIfg3BAAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV9uJ7Ta6QIrmZsSIfg3BAAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YV9uJ7Ta6QIrmZsSIfg3BAAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/09/02/autodesk_solarwinds_hack_victim/
[6] https://www.theregister.com/2021/08/04/solarwinds_lawsuit_shareholders_motion_dismiss/
[7] https://www.theregister.com/2021/07/14/dev_0322_solarwinds_serv_u_zero_day/
[8] https://www.theregister.com/2021/07/12/solarwinds_patch_attack/
[9] https://www.theregister.com/2020/12/09/fireeye_tools_hacked/
[10] https://www.theregister.com/2020/12/14/solarwinds_fireeye_cozybear_us_government/
[11] https://www.theregister.com/2020/12/14/solarwinds_public_sector/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV9uJ7Ta6QIrmZsSIfg3BAAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2021/05/11/solarwinds_ceo_orion_build_system/
[14] https://www.theregister.com/2021/08/04/solarwinds_lawsuit_shareholders_motion_dismiss/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YV9uJ7Ta6QIrmZsSIfg3BAAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2021/05/07/ncsc_russia_vulns_smart_cities_china_warning/
[17] https://www.theregister.com/2021/04/27/apt29_russia_svr_tactics_cisa/
[18] https://whitepapers.theregister.com/
Re: US vs THEM
Agree. It's not a one way street. Snowdons leak goes to show that emphatically.
But I draw the line at blaming Vulture Towers for the lack of providing an icon. Instead we should revert to ASCII art like true old skoolers ;)
Re: US vs THEM
Unicode provides a few options:
✁ ✂︎ ✃ ✄
ASCII art doesn't work as well these days. Common fonts are proportional and many sites don't allow changing to a monospace font, so ascii-art comes out looking like a mess:
_ _
(_) / )
| (_/
_+/
//|\
// | )
(/ |/
Re: US vs THEM
---8<---
I know its cutting slightly the wrong way, but really...
Re: US vs THEM
Russians breaking into countries worldwide
If engineers don't have an environment to thrive, they can harbour feelings of envy that can be amplified with right propaganda - for example, it's the fault of the West that they live like that etc.
Those people then can use their talents to channel that anger and hope they can score some extra money and lift themselves and their family.
The talent in the West does not have such incentive to go rogue, because they can make relatively good living.
However, one can fear that increasingly hostile environment for small business, anti-self employment agendas, unfair taxation, increased cost of living may push some people over the edge on the West too.
Engineers see how much wealth is produced with their sweat, but that wealth is not shared back and they may want to knock the chessboard.
Why is this a surprise?
The surprise would be if they hadn't stolen counterintelligence details, surely?
"Russia attempted to deny involvement...though there was little room for doubt in the emphatic statements issued by the UK and US"
I'm not a conspiracy theorist but there was only "little room for doubt" if you accept that what the UK and US says is gospel.
US vs THEM
We see all those posts about the Russians breaking into countries worldwide ... so are they so much smarter and better at hacking than the rest of the world? Or are other counties doing the same thing but not getting caught at it because they are smarter and better at hacking than the Russians?
I have a solution to all these problems ... but El Reg is still not giving me a pair of wire-cutters icon to demonstrate Internet Security.