SOLARWINDS ORION BREACH UPDATE
SOLARWINDS ORION BREACH FULL

SOLARWINDS ORION BREACH UPDATE

Customers simply had to log into the company's software development website, type a password and then wait for the update to land seamlessly onto their servers. It was supposed to provide the regular fare - bug fixes, performance enhancements - to the company's popular network management system, a software program called Orion that keeps a watchful eye on all the various components in a company's network. Last spring, a Texas-based company called SolarWinds made one such software update available to its customers. The next morning, rather like the shoemaker and the elves, our software is magically transformed. A pop-up window announces its arrival and all that is required of us is to plug everything in before bed. The routine software update may be one of the most familiar and least understood parts of our digital lives. 'This release includes bug fixes, increased stability and performance improvements.' If other customers of SolarWinds do not find evidence that they were under surveillance, they will take solace in the fact that the US government was too big a target to pass up.An NPR investigation into the SolarWinds attack reveals a hack unlike any other, launched by a sophisticated adversary intent on exploiting the soft underbelly of our digital lives. Silently eavesdropping on high-value targets is a labour-intensive job – particularly if the attacker wants to stay hidden, and for now it appears that the temptation to eavesdrop on internal communications at the US treasury and commerce departments was the most compelling. More broadly, cyber operations like this undermine confidence in existing security measures and hand a propaganda coup to the country directing the attack. Although journalists and the public think about the impact of attacks simply in terms of any striking secrets revealed, cyber-warfare tends to have multiple goals.Īs well as looking for ill-guarded secrets of individuals, this sort of attack can be used to map how organisations work and their structural vulnerabilities, with a view to potentially exploiting them at a later point.

The long-term impact of the hack is unlikely to be known for a while, if at all. The acting director, Brandon Wales, said the compromise “poses unacceptable risks” to the security of federal networks. Nevertheless, the US Cybersecurity and Infrastructure Security Agency issued an emergency directive late on Sunday night advising all federal civilian agencies to “review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately”. Rather than exfiltrating untold gigabytes of stolen data to peruse at their leisure, the attackers had to operate in a much more labour-intensive fashion, navigating through the government network as quietly as possible, and only uploading data already presumed to be valuable.Īt the moment it is not clear how much information was taken, and what other departments and entities the hackers chose to enter. That, investigators say, means it is unlikely that the perpetrators made the most of the widespread access they could have gained. In order to stay below the radar of the US government’s own security teams, the update was programmed to sit silently for two weeks after it was installed, and then to only upload stolen data in small quantities so that it could be disguised as normal Orion traffic.

SOLARWINDS ORION BREACH FULL

Thankfully, even then, the full attack was a technically challenging manoeuvre. By hacking SolarWind and inserting weaknesses into the Orion software at source, the attackers simply had to wait until their targets downloaded and ran a fake software security update. That breach provided the foothold the attackers needed to begin monitoring internal emails at the departments. Rather than directly attacking the US government, the attackers succeeded in compromising the automatic update function built into Orion.

The hack, attributed to Russian state actors, took the form of a so-called supply chain attack. But they are just a fraction of SolarWinds’ 300,000 global customers, which also include UK government agencies and private sector companies.įor now, we only have only confirmation from investigators that the US Treasury and commerce departments were attacked.

Solarwinds orion breach