Am I the Only One Freaked Out by the SolarWinds Breach?
By: Lance Ulanoff
Tags: Technology, Solarwinds, Security, Goverment, Analysis

Am I the Only One Freaked Out by the SolarWinds Breach?

Photo by NeONBRAND on Unsplash

A system servicing multiple levels of government, including the Treasury and the DoD, got played by hackers in what may be one of the most sophisticated attacks we’ve seen in years.

And if you’re not concerned, you should be.

As I was reading through the Wall Street Journal’s report on the breach, which started last spring and came to light this week, I noticed how there was no mention of a typical infiltration through, say, a social-engineering phishing attack. The hackers, most likely Russia- or China-backed, apparently didn’t send an email to the weakest link and worm their way into the system.

What happened here is far more sinister. The hackers breached SolarWinds, which was confirmed by customer FireEye, through a previously unknown vulnerability. The hack’s ultimate target was not about FireEye or SolarWinds, though. Aimed at all of SolarWinds incredibly high-profile clients, this “supply-chain attack” apparently used SolarWinds Orion platform’s own distribution and updating system to worm its way into networks at the DoD, Treasury, Commerce, and basically anywhere else where SolarWinds software was doing, among other things, “Threat Detection.”

In what could only be described as a diabolical attack, the hackers targeted the distribution side because of the assumption of trust on the client side. It’s like tainting milk at a farm to ensure that the spoiled product reaches thousands of supermarkets. We trust the farm, and the Treasury, Commerce, DoD, and others trusted SolarWinds software distribution system.

SolarWinds temporarily pulled its client list off the web, but a cached version showed clients ranging from NASA’s Johnson Space Center and the U.S. Air Force to Security software vendor Symantec, and the U.S. Postal Service. There are many of the country’s major telecommunication companies on the list like AT&T, Charter, and Comcast. Yes, even the CDC is on their client list.

Depending on how open these networks are and the level of security at email and database levels, this could be a breach with long and wide-reaching implications. Access to the CDC’s network just as the COVID-19 vaccines are rolling out is especially concerning.

As former Trump Administration Cyber Security Official Chris Krebs told the Wall Street Journal, those SolarWinds Orion Platform customers “should assume they’ve been compromised.” I think we should all assume as much.

If there’s a bright side to all this, it’s that the breach has shed light on an attack vector many of us had never heard of before. Now system managers will be trying to harden their systems against Supply Chain Attacks, though it sounds like this is akin to figuring out which of your trusted and seemingly healthy friends is actually infected with a zombie virus.

Government agencies have already shut down their SolarWinds Orion systems and I assume most other companies have done the same as they assess the damage. Still, the hackers got in, probably took what they wanted, and may, in the future, sell or use that data and intel in a variety of ways.

Basically, I doubt we’ve heard the last of this breach.

Ed Note: A previous version of this story mischaracterized FireEye as the owner of SolarWinds.