As someone just said… 2020 is turning out to be lovely…. I’ll post more tonight https://twitter.com/BleepinComputer/status/1339706445307195392
[See the full post at: SolarWinds impact getting a bit larger]
Susan Bradley Patch Lady/Prudent patcher
|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
-
SolarWinds impact getting a bit larger
- This topic has 50 replies, 24 voices, and was last updated 4 years, 4 months ago.
AuthorViewing 27 reply threadsAuthor-
I don’t know what SolarWinds is. Yet seeing that Microsoft was hacked via this software is scary. This why I uninstall OneDrive every time it gets installed, and this is why I do not use any of Microsoft’s cloud services. This was bound to happen.
7 users thanked author for this post.
-
More about this gravest of cyber attacks (that now are said to include MS among its targets), and the implications for the national security of the USA, here in this Associated News article:
Excerpt:
“The hack compromised federal agencies and “critical infrastructure” in a sophisticated attack that was hard to detect and will be difficult to undo, the Cybersecurity and Infrastructure Security Agency said in an unusual warning message. The Department of Energy (*) acknowledged it was among those that had been hacked.
The attack, if authorities can prove it was carried out by Russia as experts believe, creates a fresh foreign policy problem for President Donald Trump in his final days in office.
Trump, whose administration has been criticized for eliminating a White House cybersecurity adviser and downplaying Russian interference in the 2016 presidential election, has made no public statements about the breach.”(*) The DoE is, among other things, responsible for nuclear weapons development and for maintaining the US nuclear weapons arsenal.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV-
-
I, for one, would really like to know how they get to 98% on a sophisticated break in like this, that went on for months.
Right now we have one paragraph in the WP that recites anonymous sources and it goes on like its 100% true.
3 users thanked author for this post.
-
-
-
I’m 98% sure any state actor would at least consider leaving false-flag breadcrumbs to deflect blame to another state actor.
1 user thanked author for this post.
-
-
-
Initially, Microsoft blamed their SolarWinds problems on hacked customers using O365 (It’s not our fault, nothing we could have done…). Then we found out that they, too, use SolarWinds’ Orion product. Even worse, while cleaning up their own SolarWinds installations, Microsoft found a SECOND backdoor into their systems.
I want to know what was done to Microsoft’s systems before they closed those backdoors. “Microsoft says it has not found evidence hackers breached customer data or used its systems to attack others” sounds like famous last words to me. Microsoft is not unhackable, and neither are their updates.
Group K(ill me now)5 users thanked author for this post.
So can we trust now Microsoft’s Windows, servers, Azur, Defender, Tuesday patches ?
1 user thanked author for this post.
-
Thats the right question. But here is the catch, thats now important: “what if you do not trust anymore? Or even if your Azure or cloud is infected? What are other options? Admins deployed Azure where recommended. Some went to O365.
And we were all bomabrded with statements, how updates are safe now secure things now are. Now we will see if its true or just marketing. There is no option to go back. Only time will tell.
“We have not found evidence of access to production services or customer data. Out investigations, which are going on, have found absolutely no indications that our systems were used to attack others”
hmmm.. absolutely no indications. aboslutely.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
4 users thanked author for this post.
Microsoft says it identified 40+ victims of the SolarWinds hack
Microsoft said it identified more than 40 of its customers that installed trojanized versions of the SolarWinds Orion platform and where hackers escalated intrusions with additional, second-stage payloads.
The OS maker said it was able to discover these intrusions using data collected by Microsoft Defender antivirus product, a free antivirus product built into all Windows installations.
Microsoft President Brad Smith said his company is now in the process of notifying all the impacted organizations, 80% of which are located in the United States, with the rest being spread across seven other countries —namely Canada, Mexico, Belgium, Spain, the UK, Israel, and the UAE….
Iylejk: “Hopefully we all aren’t bots”
About that, see here #2320608 a relevant comment by Anonymous.
@OscarCP & @SB Sad to see that my writings is wiped again without any notice; like the truth ends in the USA and this administration, like there is no collaboration between 3Eyes 5Eyes 7Eyes 11Eyes. Talking about socalled ongoing attacks is an understatement of what has happened. Secret services all around were robbed of their own breaking-in tools, and were used to plant malicious parts in software used by all. So, are we all bots? In a matter of speaking: yes, we are.!* _ ... _ *1 user thanked author for this post.
-
I guess more companies and public bodies will end up running private networks disconnected from the internet at large.
May be true. After advertising and pushing cloud solutions to everyone, different direction can grow now.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
-
You think about all the added security Microsoft has baked into Windows. Yet the bad guys have no problem getting around it. What’s worse is detection seems to be getting worse not better
Thats not coincidence. Since the complexity grows, there must be more and more weak spots in all these systems. Its impossible to remove them all. There will always be the way how to overcome security. And if all is constantly changing (neverending stream of patches and updates), you repair one thing and two others can break. Thats just reality!
Its like people sobering these days. They start to notice that security is not about nicely sounding sentences. Its about the real situation, which is different from “whats written on the paper”.
Im not surprised too much, I know that hackers are always one step ahead.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
3 users thanked author for this post.
The impact of this intrusion will not go away any time soon. Recovery is going to be expensive and may never be complete. Every attempt to fix it will be observed. It is reported that they have the access to override the recovery attempts. It is a master plan not just a hack to disrupt and do a bit of damage.
Can SolarWinds survive?
SolarWinds have several competitors in the same tech space. The competitors are no doubt doing some serious forensics right now. Private and government cyber analysts should be able to determine if they too have suffered the same fate or not. If they come out unscathed, it may mean that they were not targeted as opposed to not vulnerable. Industry, business and government need to know before they can act on any recovery processes.
1 user thanked author for this post.
I found this article on GeekWire that speaks to the response by MS to the Solar Winds breach. MS released (ta da)”Death Star” in response. Death Star????
Peace,
CAS
4 users thanked author for this post.
-
-
Very interesting reading. Seems like MSFT did whatever he could to get rig of this. Especially that part about updating Defender during night and taking the control of compromised servers sounds good.
According to SolarWinds, this malware was present as a Trojan horse in updates from March through June 2020. This means any customers who downloaded the Trojaned updates also got the malware. While not all customers who got the malware have seen it used for attacks, it has been leveraged for broader attacks against the networks of some strategically critical and sensitive organizations.
So it looks like Windows users were really affected by this issue. So its possible to hack Windows updates. Good that MSFT created this flexible updating service. I hope it will be used more effectively in the future, more than it is now.
And btw did someone confirm it was Russia? I think its just to easy blame “the biggest opponnent.” Could it be some interneational group of hacker probably?
In the end, this all reminds us how much power Microsoft has at its disposal. Between its control of the Windows operating system, its robust legal team, and its position in the industry, it has the power to change the world nearly overnight if it wants to. And when it chooses to train that power on an adversary, it really is the equivalent of the Death Star: able to completely destroy a planet in a single blast.
Yeah, how much power Microsoft has! And still MSFT is annoying us with new start menu icons, new layout and reworked control panels every half a year. Now it seems they have more important tasks, than recreating calculator and creating new “snip and sketch” tool.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
Was is not Queen Victoria who said ‘we are not amused’?
“Some of the legal and regulatory fallout may hinge on what SolarWinds knew or should have known about the incident, when, and how it responded. For example, Vinoth Kumar, a cybersecurity “bug hunter” who has earned cash bounties and recognition from multiple companies for reporting security flaws in their products and services, posted on Twitter that he notified SolarWinds in November 2019 that the company’s software download website was protected by a simple password that was published in the clear on SolarWinds’ code repository at Github.” – re: Brian Krebs article, cited by Susan.
What they should have known is how to create a password better than this one …
****123
Two mistakes in one: (1) A useless password (2) Publishing it.
4 users thanked author for this post.
-
Emergency Directive 21-01
December 13, 2020Mitigate SolarWinds Orion Code Compromise
Disconnecting affected devices, as described below in Required Action 2, is the only known mitigation measure currently available.
Read the full bulletin hereFrom link in latest Joint Statement.
PS Yahoo are now reporting the initial attempts were in October last year:
https://news.yahoo.com/hackers-last-year-conducted-a-dry-run-of-solar-winds-breach-215232815.html
4 users thanked author for this post.
Anonymous: “Any ideas of how to mitigate?”
Well, yes, some ideas, but not ones very nice to contemplate, at least according to this Associated Press article published today:
https://apnews.com/article/hacking-russia-bafff5557a8941aa1a5ef239d36c4e28
Excerpts:
“Many federal workers — and others in the private sector — must presume that unclassified networks are teeming with spies. Agencies will be more inclined to conduct sensitive government business on Signal, WhatsApp and other encrypted smartphone apps.”
“We should buckle up. This will be a long ride,” said Dmitri Alperovitch, co-founder and former chief technical officer of the leading cybersecurity firm CrowdStrike. “Cleanup is just phase one.”
“The only way to be sure a network is clean is “to burn it down to the ground and rebuild it, said Schneier.” Emphasis mine. (For what it’s worth, Bruce Schneier is described in this article as “a prominent security expert and Harvard fellow”, whatever that means)
“Imagine a computer network as a mansion you inhabit, and you are certain a serial killer has been there. “You don’t know if he’s gone. How do you get work done? You kind of just hope for the best,” he (Schneier) said.”
As to that “Russia” thing: as far as I know as I write this, still no one has declared in an official capacity this or any other country’s government guilty of the attacks, at least no one whose job would be on the line along with any possibility of future employment anywhere else if they were to accuse, le’s say Russia, unequivocally and without enough undeniable supporting evidence for such a claim. So we are still waiting to be told, in a credible way, who’s done it.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV1 user thanked author for this post.
so, what does this mean to me?
It does not affect your computer unless you are running Solar Winds – you would know if you were.
Would running a Standard User account instead of an Admin account make any difference
No, there is no chance that you will be affected because you do not run Solar Winds.
Stick to your usual precautions, backup, anti virus etc and relax in the knowledge that you are as safe as you can be.
cheers, Paul
which can lead to a loss of sensitive customer information, disruption of the manufacturing process, and could damage a company’s reputation
And this does not already happen via existing breaches, on social media and via phishing?
The attackers aren’t likely to be after your data as it’s worth too little compared to accessing internal systems of government etc.The trashing of a company’s reputation due to poor security is a good thing. It encourages all companies to make an effort.
What precautions would be appropriate to protect oneself when browsing around, from malware compromised sites might have been primed to propagate by the attackers?
This is no different to the current arrangement where every site you visit may have been compromised / host malware via advertisements etc.
Use an up to date browser and anti virus, don’t pass personal info / passwords to anyone and backup (there’s an echo in here 🙂 ).cheers, Paul
3 users thanked author for this post.
This observation suggests that there are other original access vectors besides SolarWinds Orion, and there may be others that are not yet known. Identifying the affected systems, analyzing them, and cleaning the software of the infections is likely to take months.
source: borncity
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
2 users thanked author for this post.
Quote: “You think about all the added security Microsoft has baked into Windows. Yet the bad guys have no problem getting around it. What’s worse is detection seems to be getting worse not better.”
Funny thing about that…you are aware that Microsoft shares source code with Russia and China? ZDNET:Does Microsoft’s sharing of source code with China and Russia pose a security risk?
I wouldn’t trust the statement about being “98% sure” about the source of infection, either. Spoofing is much more sophisticated these days, and anyone who pulled this off isn’t going to be sloppy about leaving clues…unless those clues are meant to misdirect. I’m more suspicious of North Korea or China (or both), with the current state of tension these days in the South China Sea.
There’s also a good possibility that third parties got access of the source code from either Russia or China, in order to cash in on vulnerable systems. Bot Nets can be VERY profitable!
Much of the issue is ourselves, though. The emphasis by the NSA and other US agencies to degrade encryption is a major factor in making things less safe. Instead of degrading protection, we should have iron proof encryption (and yes, that will be an issue in other areas). That’s the only way to protect critical systems, IMO.
Much of the issue is ourselves, though.
[@]johnf , I cannot agree more, this is right.
Even 7Eyes is “monitoring” (a political correct expression for reading-all/spying) for their partners, and than exchange the data…. So in that country itself everybody can claim they didn’t do it.
Many of these countries do think this is an acceptible way, just as buying the illegal hacking-tools/0Day-tools is accepted by parliaments. If there was a moral this has disappeared?To degrade encryption as many parliaments want to do is a major factor in making things less safe, and prompted by political and managemental fear and ignorance.
* _ ... _ *1 user thanked author for this post.
The hacking group behind the SolarWinds compromise was able to break into Microsoft Corp and access some of its source code, Microsoft said on Thursday, something experts said sent a worrying signal about the spies’ ambition…
Microsoft:
We detected unusual activity with a small number of internal accounts and upon review, we discovered one account had been used to view source code in a number of source code repositories. The account did not have permissions to modify any code or engineering systems and our investigation further confirmed no changes were made. These accounts were investigated and remediated.
3 users thanked author for this post.
At Microsoft, we have an inner source approach – the use of open source software development best practices and an open source-like culture – to making source code viewable within Microsoft. This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk.
As with many companies, we plan our security with an “assume breach” philosophy and layer in defense-in-depth protections and controls to stop attackers sooner when they do gain access.
2 users thanked author for this post.
Viewing 27 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Asking Again here (New User and Fast change only backups)
by 5 hours, 51 minutes ago
-
How much I spent on the Mac mini
by 40 minutes ago
-
How to get rid of Copilot in Microsoft 365
by 13 minutes ago
-
Spring cleanup — 2025
by 11 hours, 43 minutes ago
-
Setting up Windows 11
by 1 hour, 14 minutes ago
-
VLC Introduces Cutting-Edge AI Subtitling and Translation Capabilities
by 7 hours, 11 minutes ago
-
Powershell version?
by 8 hours, 4 minutes ago
-
SendTom Toys
by 2 hours, 44 minutes ago
-
Add shortcut to taskbar?
by 12 hours ago
-
Sycophancy in GPT-4o: What happened
by 1 day, 4 hours ago
-
How can I install Skype on Windows 7?
by 1 day, 3 hours ago
-
Logitech MK850 Keyboard issues
by 9 hours, 59 minutes ago
-
We live in a simulation
by 1 day, 18 hours ago
-
Netplwiz not working
by 1 day, 5 hours ago
-
Windows 11 24H2 is broadly available
by 2 days, 6 hours ago
-
Microsoft is killing Authenticator
by 18 hours, 33 minutes ago
-
Downloads folder location
by 2 days, 13 hours ago
-
Remove a User from Login screen
by 1 day, 8 hours ago
-
TikTok fined €530 million for sending European user data to China
by 2 days, 4 hours ago
-
Microsoft Speech Recognition Service Error Code 1002
by 2 days, 4 hours ago
-
Is it a bug or is it expected?
by 6 hours, 38 minutes ago
-
Image for Windows TBwinRE image not enough space on target location
by 2 days, 3 hours ago
-
Start menu jump lists for some apps might not work as expected on Windows 10
by 1 day, 3 hours ago
-
Malicious Go Modules disk-wiping malware
by 2 days, 17 hours ago
-
Multiple Partitions?
by 2 days, 17 hours ago
-
World Passkey Day 2025
by 14 hours, 10 minutes ago
-
Add serial device in Windows 11
by 4 days, 2 hours ago
-
Windows 11 users reportedly losing data due forced BitLocker encryption
by 2 days, 3 hours ago
-
Cached credentials is not a new bug
by 4 days, 7 hours ago
-
Win11 24H2 Slow!
by 7 hours, 13 minutes ago
Remembering Woody
