Should We Expect a Digital Coronavirus ? — FireEye Got Hacked
Tags: Unc2452, Fireeye, Solarwinds Hack, Cybersecurity, Hacking

Should We Expect a Digital Coronavirus ? — FireEye Got Hacked

# What We Know So Far:

Image Source: Google Search

On 8th December 2020, a cyber-security firm called ‘FireEye’ released a filing through U.S. Securities and Exchange Commission followed by a blog-post indicating a highly sophisticated security breach into their system.

FireEye is a publicly traded cyber security company headquartered in Milpitas, California. It has been involved in the detection and prevention of major cyber-attacks. It provides hardware, software, and services to investigate cyber security attacks, protect against malicious software, and analyse IT security risks.

Image Source: TechCrunch

Kevin Mandia, CEO of FireEye, quoted that — “Based on my 25 years in cyber security and responding to incidents, I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities. This attack is different from tens of thousands of incidents we have responded to throughout the years.”

It is believed that the hackers have used a novel combination of techniques to enter into the system and accessed ‘Red Team’ tool that FireEye use to test their customer’s security. However, FireEye has confirmed that none of the tools contain ‘zero-day’ exploits.

Red Team are kind of tools in cyber security which are used to simulate (in controlled environment) some of the vulnerable attacks which hackers can adopt as a doorway to malfunction a system.

But things got tensed when they further discovered that their tools are probably going to be used as a weapon to puncture the supply-chain worldwide via a software providing vendor called ‘SolarWinds’.

SolarWinds Inc. is an American company that develops software for businesses to help manage their networks, systems, and information technology infrastructure. Softwares designed by SolarWinds are used by the ‘Fortune 500’ companies. It is headquartered in Austin, Texas, with sales and product development offices in a number of locations in the United States and several other countries.

This implies that the threat actors are not just targeting any particular organization’s network or the U.S. agency rather those behind the campaign UNC2452 have probably gained access to numerous public and private organizations around the world.

# How It All Happened:

FireEye and SolarWinds in their investigation have found that threat actors have the access of systems from the spring of 2020. They used Red Team tools to break into SolarWinds security and then successfully deployed the malware, which the investigation team have named as SUNBURST, in SolarWinds’ customers via an update in one of the their mostly used software named Orion. This deployment was from their own servers and was digitally signed by a valid digital certificate bearing their name.

Image Source: FireEye

FireEye has stated a [.]dll file and reported that — ‘SolarWinds.Orion.Core.BusinessLayer.dll’ is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers.

FireEye in their blog post has pointed this as a state-sponsored attack but not objected towards any specific country or organization. However, experts are skeptical towards Russia, especially APT-29 aka Cozy Bear, depending upon the level of sophistication and discipline involved in this cyber-attack.

# Why ‘YOU’ Should Be Worried About This:

One of the most concerning aspect of this story is that the hackers were into the system of the firms, FireEye and SolarWinds, for months and remain undetected. (The breach was not discovered until FireEye, which itself uses SolarWinds, determined it had experienced a breach through the software) and secondly we have not seen any significant move by the threat actors till now which means they were so far just monitoring all these big firm giants and what are they planning will be transparent in the coming year, especially after the outbreak of the news.

US government officials have not yet stated which agencies were affected. But the treasury and commerce departments were confirmed to have been targeted.

FireEye, without naming any specific targets, has said it has confirmed infections in North America, Europe, Asia and the Middle East, including in the health care and oil and gas industry, and has been informing affected customers around the world.

SolarWinds took down a web page that boasted of dozens of its best-known customers, from the White House, Pentagon and the Secret Service to the McDonald’s restaurant chain and Smithsonian museums.

To give an insight of who the Cozy Bears are — They are classified by the U.S. Federal Government as APT29, is a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. In August 2015 Cozy Bear was linked to a spear-phishing cyber-attack against the Pentagon email system causing the shutdown of the entire Joint Staff unclassified email system and internet access during the investigation.

# Measures:

Experts are appreciating for being transparent about the attack and offering the information as a responsible firm, FireEye, without concerning the adverse effect on their reputation. FireEye is actively investigating in coordination with the FBI and other key partners, including Microsoft.

In their blog they stated that — Consistent with our goal to protect the community, we are proactively releasing methods and means to detect the use of our stolen Red Team tools. We have developed more than 300 countermeasures for our customers, and the community at large, to use in order to minimize the potential impact of the theft of these tools. We have seen no evidence to date that any attacker has used the stolen Red Team tools. We, as well as others in the security community, will continue to monitor for any such activity. At this time, we want to ensure that the entire security community is both aware and protected against the attempted use of these Red Team tools.

FireEye is releasing signatures to detect this threat actor and supply chain attack in the wild. These can be found on their public Github page.

# To Conclude It:

An outbreak in December 2019 engulfed the whole world in 2020. We are witnessing a similar situations in December 2020 but this time its digital. This attack is evolving as the biggest cyber threat of decade, where the threat actors have not played their best move yet. The future highly depends on the team defending the internet and the team planning to ravage it.

As a responsible active user we must be ready with the digital masks and sanitizers. Hope you are getting the chronology.

STAY SAFE!! STAY AWARE!!