The Massive SolarWinds Hack Explained in Context

My brother and I started a software company. Which one? SolarWinds. You started SolarWinds? You know SolarWinds? Oh, very well, thanks. That was Dave Yonts, the founder of SolarWinds, announcing to the world on television that he had poured more than $5 million into a company that makes a $350 camping cooler. This guy had just sold his company for more than $4 billion and was worth well over $100 million. Personally, the craziest part, the sharks said no. So, Dave, I don't think people in America are going to brace a $400 cooler with ice in it as an air conditioner. So I'm out. And so for those reasons, I'm out. And for that reason, I'm out. I'm out. I'm out. It's not every day that you see the founder of a technology unicorn pitching some camping gear on Shark Tank, especially when that unicorn just happens to be responsible for potentially the largest cybersecurity breach in U.S. history. John. I'm John Coogan, and today we're diving into the SolarWinds hack. I'm fascinated by this hack because I know enough about programming to follow along with what most likely happened. But to be fair, I've never worked in IT at a large company. So I'm going to try and boil down the key points in a way that anyone could understand. I'll also link to other videos and sources in case you want to go really deep into how the hack actually works. Let's start with some history. How on earth did the founder of SolarWinds wind up on Shark Tank? Well, it all starts in 1999, when Dave Yonts and his brother co founded SolarWinds in order to productize some software that would help big companies monitor the performance of their corporate networks. These types of services are important for big companies because it allows them to make sure the code that they write and the applications that they deploy are running smoothly, even during peak operating times and under heavy loads. If you've ever wondered why your Internet is slow only to realize that your roommate was trying to download all six seasons of the Sopranos in the other room, you understand one of the most basic problems that SolarWinds solves. In practice, there are tons more places where network performance monitoring is important. And that's what led to massive growth for SolarWinds. In just the first decade of growth, SolarWinds added 450 employees, raised money from Bain Capital and Insight Venture Partners, and went public on the nasdaq, all while maintaining profitability. It wasn't Long before they were acquiring other companies with adjacent products, expanding internationally and growing their customer base into the tens of thousands. And that's a big part of why the SolarWinds attack was so successful. Instead of targeting a specific US government agency, the hackers went after SolarWinds, which sells software to US government agencies. This is called a supply chain attack, and it's becoming an increasingly common attack vector. Essentially, supply chain attacks target app developers who deploy code to a wide array of companies and inject malware into their app updates. These updates are digitally signed by the originating company, so the recipient doesn't notice anything wrong when they update their apps. This is particularly harmful because the victim company is actually doing the right thing. They're keeping their apps up to date. And this also enables attacks on an unprecedented scale. Compromise just one company, and you can effectively compromise them all. But hacking into one of these supply chain companies like SolarWinds isn't easy. Software is their core business, after all, and they are aware of how important their systems are to their customers. And that's why everyone immediately assumed this had to be a state actor, most likely Russia. The patience and attention to detail in this malicious piece of code is truly staggering. If you're technical, you can actually go and look at the code yourself. The hack, which is now being referred to as Sunburst, was installed so widely that developers have shared the code publicly in order to enable the entire cyber security community to work together on a solution. I won't bore you with a detailed analysis of the code, but there are some really interesting tidbits in there. First, the hack is programmed to sit entirely dormant for two whole weeks after it gets installed. So even if you installed the update in a quarantined environment and monitor it 24 7, you would have to wait two weeks before you started noticing anything odd. And the hack is also aware of its environment. Before doing anything, it checks to make sure that the computer it has infected isn't running any of the popular diagnostic programs used by cybersecurity teams. Lastly, when the hack does finally start actually stealing data, it doesn't just copy all of the infected computer's files and send them off to Russia directly. Only small amounts of data are stolen at a time. And then the stolen data gets encrypted and then wrapped in legitimate data that looks like normal analytics traffic. It's extremely common for applications to send out analytics data to other servers. So this looks pretty normal. If you've ever seen a little pop up asking, would you like to share analytics data with the Developers of this app, you'll know what I'm talking about. Any IT professional at a large company that got infected with Sunburst probably wouldn't notice data leaving their networks because it looked just like normal Solar Winds traffic. When small time hackers figure out a way to break into a system, they usually don't have the patience to build a bigger hack that could infect more systems. The tech companies are constantly hunting down exploits, so once you discover an exploit, it's only a matter of time until the company discovers it as well and patches the software, putting you back to square one. This is why you see a lot of hacks where someone breaks into a company's servers, steals a bunch of credit card data, and then immediately starts charging those cards. But state actors like Russia can afford to be more patient. The hackers working on this project likely get paid on a regular basis like any other programmer, as opposed to an independent credit card thief that might be broke and just looking for a quick buck. Signs point to this hack first being deployed in March of 2020. But it's possible that they gained access to Solar Winds even earlier than that. But they just sat on it. So if it was Russia, what do they want with our data? Well, these hacks generally fall into two espionage and sabotage. Espionage is basically a reconnaissance mission. The hackers are spying on United States systems in order to better understand our capabilities and vulnerabilities. All signs point to the SolarWinds attack falling in this category, which is good news, because sabotage is where it gets really ugly. Cyber attacks that seek to sabotage can disable critical infrastructure, cause billions of dollars in damages, or even hypothetically launch nuclear weapons. Now, I don't want to be alarmist. Obviously, the US Government spends a disproportionate amount of time and money trying to defer sabotage missions, so in theory, they are less likely to happen. And these attacks don't happen in isolation. State actors understand that if they are caught, there will likely be a response. So a spying mission like this one might lead to increased economic sanctions, but detonating one of our nukes will likely lead to all out war, and nobody wants that. But cyberattacks aimed at sabotage do happen, and there's a lot that we can learn from them. In 2010, security researchers uncovered the Stuxnet virus, which was designed with the explicit intent of destroying Iranian nuclear centrifuges. Much like the SolarWinds hack, Stuxnet was designed to lay dormant until it landed on a specific target computer. But computers at Iranian nuclear facilities are air Gapped, meaning there is no access to the outside network, so they couldn't send data out of the facility. But that wasn't the goal of Stuxnet. Instead of merely collecting information, the Stuxnet virus would slightly change the speed at which centrifuges would spin. So when the infected computer would send a signal to the centrifuge to spin at the precise speed in order to maintain stability, the virus would slightly alter the signal in order to change that speed. This ultimately destroyed almost one fifth of Iran's nuclear centrifuges, significantly setting back their nuclear program. Crossing an air gap is no easy feat. Since computers on an air gap network can't pull updates from the Internet, any code that runs in the facility must be physically carried in. But the hackers behind Stuxnet had a solution to this problem. They scattered USB drives in the parking lots where they knew contractors who visited the facility would stop after a curious contractor picked one up. Thinking it was maybe just a free USB drive or maybe had some interesting data on it, they would inadvertently infect their own system. It's possible that this is how hackers first got access to SolarWinds. Infect one employee's laptop, and when they come into work, they will infect the rest of the network. But we don't know yet. There is another way that hackers gain access to private networks, and this technique is surprisingly low tech. They just pay off a disgruntled employee. This almost happened earlier this year to Tesla, but the plot was foiled. A Russian came to the US and tried to pay a Tesla employee $1.5 million in order to knowingly infect the Tesla network using a USB drive. The Tesla employee contacted authorities, but you can see how this strategy would have been even easier than trying to hack the company directly. So what's the takeaway for entrepreneurs? Obviously, if you're going to be selling software to lots of companies, you need to build a strong culture around cybersecurity at the earliest stage possible. State actors are more motivated than ever, and it's only a matter of time until they set their sights on you. But more generally, I think it's important to make sure that your employees are happy. As we saw with the Tesla example, things could have gone a completely different direction if that employee really hated his job and wanted to hurt the company. More broadly, gone are the days of thinking about warfare exclusively in terms of missiles and ground troops. There are three types of informational, economic, and kinetic. The United States has been able to avoid direct kinetic warfare with any of the major global powers since World War II. But increasingly, economic warfare in the form of trade deals, tariffs and sanctions have played a huge role in international stability. Now we are finally starting to see the full scope of the informational cyber war that has been going on for years. As an entrepreneur, global stability is extremely important. I want to be able to do business anywhere in the world without the fear of a relationship between two countries devolving to the point of business disruption. So I Hope that the SolarWinds hack leads to more defensive cybersecurity measures as opposed to an aggressive retaliation that could escalate things further. And what about Dave Yonts, the co founder of SolarWinds, who's now the owner and inventor of the Icy Breeze Cooler? What about him? Well, I think there's an important lesson in there too. We know he's rich enough to never work again, and he has the credentials to go start another IT company at any time. So why is he on Shark Tank? I think he's just having fun. He's made his millions, but loves tinkering and inventing things. Even though he got turned down on Shark Tank, going on TV was probably still a fun experience, and they probably sold a bunch of those coolers as soon as the show aired. And perhaps most importantly, there's zero risk that a cooler will cause information about US Nuclear weapons to fall into the hands of the Russians. I think he got out at the perfect time, and he's probably unbelievably happy that he doesn't have to deal with this whole stressful mess at SolarWinds right now. But let me know what you think in the comments. Are you going to start taking cybersecurity more seriously after watching this video? If you're interested in Learning more about SolarWinds, I've put together a YouTube playlist and will link it below. And if you enjoyed the video, please consider subscribing to the channel. Thanks for watching.