SolarWinds' monitoring software was compromised and pushed malicious updates to 18,000 customers including the Pentagon, State Department, and Treasury. FireEye discovered the breach when its own red-team tools were stolen. The speaker argues investigators are missing the real threat: attackers likely have objectives beyond espionage.
Chapters
The cybersecurity community is consumed with the scale and effectiveness of one of the biggest and potentially most important attacks against the United States in probably a decade. Unfortunately, we are missing something hugely important. It's like being fascinated with the bear tracks looking down at the ground and not looking up at the charging bear coming at you. So this is what we know so far. Uh, a company called SolarWinds has several products. One of them focuses on being able to manage and monitor servers and networks and applications within large infrastructures, and it's very, very popular. And this particular software, uh, when you install it, because it can cause some alerts and so forth, you typically exclude it out of your anti-malware antivirus scans. So it's kind of outside of what you would look for when trying to detect something bad. And the permissions and the rights that this particular tool has, well, it can do lots of different things. It can bring data in, it can exfiltrate data out, um, it can impersonate potentially users and system functions. It can gain access to data. It has unprecedented access to these systems and networks. So overall, from a hacker's perspective, this is a crowning achievement to be able to gain access to something like this. And what actually happened is an attacker, very sophisticated attacker, was able to compromise that software and then put their malicious code in it. So when it updated to their clients now the attacker had the visibility and access that they needed. So this is very, very unfortunate, not only because that could happen to one user or customer, but the fact that SolarWinds is used by a massive set of customers, including many departments of the United States, military, Office of the President, things of that sort. This is a huge deal. So let's take a look at the customer base, right? If you take a look at it, most of the Fortune 500 companies use this tool. Um, all of the big telecommunications companies use this tool. All of the military— the Pentagon uses this on their servers. You look at State Department, you look at Department of Justice, Office of the President, again, they use this tool. Accounting firms, so on and so forth. Here's a partial list. Now, out of the many thousands of customers that this SolarWinds has, they're estimated about 18,000 of them have been potentially victimized, that they have those updates, those malicious updates that would've allowed the attacker to come in and potentially do harm. Given the sophistication, and believe me, this attack was very sophisticated. This supply chain attack is not easy to pull off. Given the sophistication in some of the techniques, it's believed that it is a nation-state that is behind this attack, primarily against US interests. Now, there's only a handful of nation-states that probably would have the resources, patience, and technical know-how to actually pull this off and pull it off well. Um, out of those, we are concerned. We're concerned with anybody doing it, but when you look at the big ones, whether it be Russia or China or what have you, they probably have the skills, and that's where the fingers are being pointed right now. There's no real confirmation yet. There may never be any real confirmation, but it's based on the sophistication and the previous types of attacks and some of the methodologies. And this all came to light when the security company FireEye discovered that they had been hacked. And when they started doing the research, this is what they did, and this is what they do for their customers. They realized that some of their red team tools— these are the tools that they use for their clients to test how secure their environment is— some of those tools were stolen. Now, these are open source tools and whatnot, but They detected that, kind of figured out the root cause, and traced it back to SolarWinds. They notified SolarWinds, the authorities, and that's kicked off a slew of investigations that has just opened this, this Pandora's box of organizations and issues and potential risks. So we've seen that the Treasury Department has indicated that their email system has been compromised, and the same thing for the Commerce Department, that attackers have gone in there and they've been reading the emails and again firing FBI had their open source tools stolen. So, I mean, this is really one of the best hacks we've seen of the past decade. It is tremendous. It is something that hackers dream of being able to do. This level of compromise and access and stealth, it's truly amazing. But we're missing something here. Because this allows the capability to persist within some of these most secure environments, including intelligence agencies like the NSA, right? It allows you to undermine the confidentiality, the integrity, and the availability of systems and data and processes. It is phenomenal. And to be able to do that against an opposing government, a critical infrastructure of a country, the economic and industrial base, that is beyond anything that we've ever seen before. And the risks around that are huge. But this is where we're missing something big, because these attackers obviously are very, very smart, right? No doubt about it. Why would they squander that capability just to read some emails, just to steal some open-source hacking tools. It doesn't make sense. It doesn't add up. Sure, you might use it to gather intelligence as part of a bigger program, but we haven't seen that yet. We haven't figured that out yet. What is the endgame here? We don't know, and we have to keep digging deeper. This is part of a bigger plan that we just don't know yet. There are huge parts of this puzzle that are missing. We gotta put Columbo's trench coat on and figure this out because we have to know what the true intentions and the true objectives are. Simply put, whoever orchestrated this masterful attack against the United States They're not done, and we need to know what's coming.
