SolarWinds Breach 2020

December 29, 2020 | By: Tom Butler

The solarwinds attack is quite possibly the most serious cyber attack that many of us have ever seen. A nation state, thought to be Russia, infiltrating our government entities and remaining undetected for an extended period of time.. How? Are our cyber defenses faltering? Do we need to step up our offensive and defensive cyber game? How did this happen, and what can we do about it?

According to Varonis, SolarWinds Orion software update distribution channel was compromised, thereby infecting thousands of organizations. This type of an attack, known as a ‘supply chain’ attack, is especially damaging as it plants illicit code in a software package which is deployed by a trusted vendor in order to gain access to the vendor’s clients.

As explained by FireEye, the attack may have started as early as Spring 2020, even though it was not discovered until earlier this month. This attack has it’s groundwork laid in HTTP communication back to Command and Control (C&C or C2) for communication with the threat actors.

After initial infection, the malware lays dormant for two weeks according to FireEye, after which it begins receiving commands from the C&C servers which could consist of anything from file exfiltration, execution, system service alteration, etc. In order to avoid detection, the network traffic created by the malware is disguised as that of the ‘Orion Improvement Project (OIP) protocol’. Information recovered by the malware is stored in plugin configuration files, which would look legitimate to an untrained eye. Additionally, in order to avoid detection, lists of antivirus and forensics tools are utilized by the malware.

From March through May 2020 there were multiple trojanized updates for the Orion platform posted to SolarWinds website. All of these were signed by the company. This allows for a level of confidence that the software was published by SolarWinds, a legitimate vendor. Unfortunately, the update files contained weaponized DLL files that would wreak havoc on those installing these vulnerable updates.

Once in the victim network, the malware would adapt to the victim’s network, utilizing hostnames that are in line with the victim’s naming conventions, C&C servers that are within the victim’s country, etc in order to evade suspicion by security personnel / detection by intrusion detection and anti-virus software.

This is certainly daunting to think about as a consumer. What can be done to protect against these attacks? After all, a large software company was the means for distribution of this malware. Having an independent security professional overseeing your network and operational security can prove to be an invaluable asset in regard to security of your organization. 

Send us an email today to discuss ways in which we could help with the security of your organization.

Sources:

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

https://www.varonis.com/blog/solarwinds-sunburst-backdoor-inside-the-stealthy-apt-campaign/