Experts say the SolarWinds hack shows that the US still has no good answers to combat “supply chain” attacks, which are “ridiculously difficult” to detect

Despite years of warning, the US still has no good answer for the sort of “supply chain” attack that let Russia run wild.

Wired 2020-12-20 Lily Hay Newman

Context & Ripple Effects

The SolarWinds intrusion has escalated quickly from a single vendor's disclosure into a government-wide incident. Treasury's hackers exploited a flaw in a SolarWinds product, which the company itself attributes to a 'supply chain attack,' and the vendor claims more than 300,000 customers. Two days later, Sen. Ron Wyden revealed that the Treasury email system used by senior leadership had been compromised since July — meaning the attackers sat inside senior-level communications for months before detection.

The deeper problem experts are flagging is not new: as far back as 2018, security coverage argued it is basically impossible to fully secure supply chains against embedded compromises, and could only recommend mitigating consequences rather than preventing them. SolarWinds is the proof case — the compromise traveled through trusted software updates that victims had every reason to trust.

First-order effects

SolarWinds' customer base — which the company puts above 300,000 — now has to assume its own networks may be compromised through the tainted update, forcing emergency audits across government and private users.
Treasury's acknowledgment, disclosed via Wyden, means senior leadership email was readable by Russian hackers for roughly five months, raising immediate counterintelligence questions about what was exposed.

Second-order effects

Every agency and contractor that ran SolarWinds products faces pressure to treat routine software updates as an attack vector, shifting procurement toward vendors who can prove the integrity of their build and distribution pipeline.
Rivals in network management software gain a selling point — 'verifiably clean updates' — while SolarWinds faces customer flight and reputational damage that outlasts any technical remediation.

Third-order effects

If detection stays this hard, the burden shifts structurally from preventing supply chain compromises to assuming them: continuous monitoring, zero-trust architectures, and eventual regulatory requirements for software bill-of-materials transparency become the baseline rather than best practice.
Nation-state adversaries have now demonstrated that one trusted vendor yields access to thousands of targets at once, making software suppliers themselves strategic targets — and US defense policy likely recalibrates around defending the software distribution layer.

The trend: Attacks on the software supply chain are becoming the preferred route for nation-state espionage because they convert one vendor compromise into mass access faster than defenders can adapt their trust models.

Discussion

@columbiasipa @columbiasipa on x
“'We need to figure out what we can do to make the defense better than the offense,' says @Jason_Healey. Until that happens, expect Russia's hacking rampage to be less of an exception than it is a blueprint.” via @WIRED https://ow.ly/...
@andrewbusey Andrew Busey on x
If I were Apple, Google, or Microsoft, I would be creating a security test set for my app store(s) that validated every app in an extremely rigorous way. This would dramatically amplify the implied benefits and value of an App Store with validation. 1/x https://twitter.com/...
@ramalhoorg @ramalhoorg on x
Einstein is not very smart. But it sure was expensive! https://www.wired.com/... via @wired https://twitter.com/...
@iethics @iethics on x
The GAO “found that none of the 23 agencies it looked at had implemented all seven fundamental best practices for cyberdefense it had identified. A majority of agencies hadn't implemented any at all”: https://www.wired.com/... #ethics #cybersec #tech #gov
@iethics @iethics on x
“Though it seems so far that the attackers accessed only unclassified systems, ... some individual pieces of unclassified information connect enough dots to rise to the level of classified material”: https://www.wired.com/... #ethics #internet #privacy #cybersec #tech #data
@avast_antivirus Avast on x
It may take months—or longer to figure out just how deeply Russian #hackers infiltrated major United States government agencies. What exactly happened? 🤔 Learn more ➤ https://www.wired.com/... via @WIRED
@authentic8 @authentic8 on x
Matt Ashburn, our Head of Strategic Initiatives and former CISO at the National Security Council, gave his input on the recent breaches to several US government agencies. https://www.wired.com/...
@jcovididdy @jcovididdy on x
@KXAN_News Yeah, this is way bigger than Austin. Russia has had access to federal, state, and local government networks undetected for 6-9 months and has built persistent connections. You can't just yank a cord and fix it. They. Are. In. There. Right. Now. https://www.wired.com/.…
@caitlin__kelly Caitlin Kelly on x
“The SolarWinds incident underscores the impossibly high stakes of these incidents—and how little has been done to prevent them.” ⁦@lilyhnewman⁩ https://www.wired.com/...
@repgallagher Rep. Mike Gallagher on x
The SolarWinds breach cannot happen again and underscores a number of the @CyberSolarium's recommendations, including empowering CISA to conduct threat hunting operations on .gov networks. Congress needs to look at this as a wake-up call for urgent action.https://www.politico.com…
@shanlonwu Shanlon Wu on x
Making America great - another record-setting achievement for the Trump administration as the deep Russian hack of US Government & related private contractors now considered “among the greatest intelligence failures of modern times.” So proud. https://www.nytimes.com/...
@lorelei_ca Ingrid on x
“Stunning,” Senator Richard Blumenthal wrote on Tuesday night. “Today's classified briefing on Russia's cyberattack left me deeply alarmed, in fact downright scared. Americans deserve to know what's going on.” https://twitter.com/...
@luispatino92 Lucho Patio on x
Do you want to read about the code part of the SolarWind security attack? This is the best post I found about the code that avoided being detected for months and reached some government systems in the USA. #100DaysOfCode https://www.microsoft.com/...
@brento Brent Ozar on x
“In an interesting turn of events, the investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product” Wow, keeps getting worse. See the “additional malware” section. https://www.microsoft.com/...
@file411 @file411 on x
Good LORD: “whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor...” https://www.microsoft.com/... https://tw…
@gossithedog Kevin Beaumont on x
In depth technical look at SolarWinds nation state activity from MS peeps, including more hunting details etc. Really proud of the teams here, everything been thrown at protecting everyone. https://www.microsoft.com/...
@file411 @file411 on x
I have to say this breach is probably one of the most flawless reverse engineering Ops I've ever read “The envelopes” passed through numerous built-in security checks. This takes meticulous planning, discipline & serious coding chops It's impressive https://www.microsoft.com/... …
@file411 @file411 on x
If I'm reading this correctly because the envelope passed the built-in security protocols the C2 Server was like: secret handshake valid, come on in Also take note of the domains too (see next tweet) https://www.microsoft.com/... https://twitter.com/...
@file411 @file411 on x
Hey remember when someone was like: Oh GOD they can accurately & quickly map out a target network. Thus they know where to hide because they can see you coming HERE. WE. ARE. Big props to @Microsoft for their transparency because this helps understand https://www.microsoft.com/..…
@msftsecintel @msftsecintel on x
Here's our analysis of the compromised DLL that led to the Solorigate attack. While the extent of the compromise is being investigated, we want to continue providing the defender community with intel, remediation guidance, and protections we have built: https://www.microsoft.com/…
@michaeldweiss Michael Weiss on x
Years is a long time to be exfiltrating data from computer systems. https://www.wsj.com/... https://twitter.com/...
@nycsouthpaw Southpaw on x
Have been thinking about these two lines in @dnvolz's story. Taken together, they seem to indicate that the public case for attributing the Solarwinds attack to Russia is: It was very well done. https://www.wsj.com/... https://twitter.com/...
@dancrenshawtx Dan Crenshaw on x
There must be government action, likely sanctions. But we can't stop there. These Russian oligarchs own property assets here in the US. Pass HR4189, which amends FSIA to allow victims of cyber attacks to sue Russia directly. We need better cyber defense, and better offense. https…
@waronprivacy WartOnPrivacy on x
“A warning that someone had used the employee's credentials to log into the company's VPN from an unrecognized device - the kind of security message that corporate workers routinely delete” Deleted because they're who logged in https://www.wsj.com/... #cybersecurity #infosec
@adryenn Adryenn Ashley on x
20 years ago was my job was to break into online banking (hired by the banks). That's when I discovered that there is no such thing as security and privacy. The hack of SolarWinds shows just how deep and insidious foreign interference into our leadership and data really is. https…
@crimealytics Jeff Asher on x
Important point raised about the strength of the public SVR attribution in this great piece from @dnvolz and @bobmcmillan. The SVR doesn't make much sense IMHO. https://www.wsj.com/... https://twitter.com/...
@dnvolz Dustin Volz on x
The suspected Russian hackers were victims of their own success and hubris. After breaching scores of targets undetected for many months, they went after a harder one: a huge cyber firm with vast investigative resources. That led to the hack's unraveling. https://www.wsj.com/...
@dnvolz Dustin Volz on x
FireEye CEO Kevin Mandia said the hack of his firm through SolarWinds was like “a sniper round through a bulletproof vest.” Once SolarWinds was suspected, FireEye analysts scoured 50,000 lines of code in search of a “needle in a stack of needles.” https://www.wsj.com/...
@datadrivenmd Jorge A. Caballero on x
Translation: the good news is that Russia isn't hacking our existing product line (::that we know of::) The bad news is that Russia may have everything it needs to hack future products. https://twitter.com/... https://twitter.com/...
@sub8u Subrahmanyam Kvj on x
Ouch... This doesn't bode well at all... First Microsoft, and now Cisco as well impacted by Solarwinds hack! The age of tech recklessness, where individuals/companies/countries focus on their selfish needs is well upon us! https://www.theverge.com/... https://www.bloomberg.com/..…
@business @business on x
Cisco was compromised as part of a suspected Russian campaign that has roiled the U.S. government and private sector https://www.bloomberg.com/...
@dangoodin001 Dan Goodin on x
Reason No. 5 gazillion why the SolarWinds hack is so impressive. The hackers had full control of SolarWinds' software build system since October 2019. We know this because the hackers performed a dry run exercise that month. Great reporting by @KimZetter https://news.yahoo.com/..…
@arstechnica @arstechnica on x
The #SolarWinds hack is shaping up as one of the worst espionage hacks of the past decade if not of all time. https://arstechnica.com/...
@buttpraxis Butt Praxis on x
Gotta appreciate that multiple hackers were targeting these guys and they made it extra easy by leaving “solarwinds123” as a password to access their update server https://www.reuters.com/...
@kimzetter Kim Zetter on x
New: SolarWinds hackers did test-run of spy operation in Oct 2019, when malicious SolarWinds files were first downloaded by customers. That version didn't have backdoor in it, however. Indicates hackers were in SolarWinds network in 2019, if not earlier. https://news.yahoo.com/..…
@craiu Costin Raiu on x
We are releasing some new findings in the #Solarwinds #Sunburst #darkhalo #unc2452 story. Our analysis plus an opensource tool that decodes and matches the UIDs from the CNAME records against publicly available pDNS data: https://securelist.com/...
@dangoodin001 Dan Goodin on x
Of the 18,000 customers who downloaded a backdoored Orion update, only a few dozen, or about 0.2%, of them received a follow on attack, according to Microsoft telemetry. This super elite group was 44% tech cos, 18% gov agencies and 18% think tanks/NGOs. https://arstechnica.com/..…
@kevincollier Kevin Collier on x
This is a slightly weird framing for how the US is thinking of attribution for the SolarWinds campaign, but I can assure you that plenty of legislators who get briefed on cyber matters miss some of the nuance of how to talk about it, esp when unclassified. https://twitter.com/...
@diakopter @diakopter on x
@thespybrief “The DOJ, FBI and DOD..., have moved routine communication onto classified networks that are believed not to have been breached, according to two people briefed on the measures. They are assuming that the non-classified networks have been accessed” https://www.reuter…
@kaspersky @kaspersky on x
While the #SolarWinds Orion IT packages reached about 18,000 customers, only a handful of these was interesting to the attackers referred to as UNC2452 or DarkHalo. @craiu and @2igosha share new findings on @Securelist. https://kas.pr/k75e https://twitter.com/...
@e_kaspersky Eugene Kaspersky on x
#Sunburst: connecting the dots in the DNS requests ⇒ https://kas.pr/j5yo TL;DR Three of the requests from FireEye's Github repository can be mapped to two domain names that belong to a government organization and a telecommunications company in the US. https://twitter.com/...
@lululemew @lululemew on x
LONDON (Reuters) - Suspected Russian hackers accessed the systems of internet provider, Cox Communications & the local government in Pima County, AZ as part of sprawling cyber-espionage campaign https://www.reuters.com/...
@bambenek John Bambenek on x
Some more updates on the Sunburst/Solarwinds breach. We have found what looks like at least two targets of interest based on my research and research by @kaspersky https://www.reuters.com/...
@profwoodward Alan Woodward on x
This kind of passive DNS work and analysis of the malware now released is what will lead to identifying where the Sunburst attacks came from - it's a slow process https://securelist.com/...
@carter_pe Phillip Carter on x
“The attack blended extraordinarily stealthy tradecraft, using cyber tools never before seen in a previous attack, with a strategy that zeroed in on a weak link in the software supply chain that all U.S. businesses and government institutions rely on...” https://twitter.com/...
@rhifionn Rhiannon Fionn-Bowman on x
Excerpt: ... effect of Thursday's revelations was confirmation that no single person or agency — including the highest reaches of the U.S. government — is certain of exactly what the hackers had infiltrated, let alone the full extent of what was taken. https://www.bloomberg.com/.…
@williamturton William Turton on x
New: Members of a consortium of major financial firms that share cybersecurity information with each other and the government, expressed concern the the US govt could be so deeply penetrated that its confidential data could be seen by Russian hackers: https://www.bloomberg.com/..…

Chronicles