It's time for another ethical hacking in the headlines.
It's time for us to talk about one of the most sophisticated attacks of all time.
It's the SolarWinds attack of 2020.
No.
Wasn't the most devastating.
We'll talk about that one later on.
But it was one of the most interesting.
And some say one of the most, if not the most creative and elegant.
Let's talk about it.
So SolarWinds in 2020 was just going about their everyday business and they were rolling out an update
to a popular application that they have four monitoring networks called Orion.
Yeah, monitoring networks and their nodes.
So this is software that does real good for a whole bunch of companies.
So they deliver the update and the update is installed and any machines that had this update installed
that had Internet connectivity.
And as you might guess, this was an awful lot of machines were subject to the malware.
How did this happen?
Well, as incredible as this sounds, the hackers got their malicious code into the distro.
That's right.
This is a true distribution style of attack.
Yeah, they got their code, their malicious code into the update that was sent out by SolarWinds.
Oh, my gosh.
Think of how incredibly sophisticated that is.
They had to fool the software repository, the get system, and I mean, they had all these kinds of
elements in play so that they could take their code and get it in the code of the product and then have
it distributed.
Incredible.
100 companies, it is estimated, were impacted.
12 of those were government agencies, including, embarrassingly, the Cybersecurity and Infrastructure
Security Agency.
So Sisa was one of the many agencies affected.
I'd say 100 companies were affected.
That's what we know of.
And some of those were big.
Intel, Cisco, Microsoft.
Yikes.
So this was quite the attack.
In fact, there were a lot of folks mobilizing on this one because it was feared that this would be
another attack on the scale of not Petya.
We will talk about the attack in an upcoming Ethical Hacking in the Headlines segment.
Now let's talk a little bit more about just how stealthy and clever this all wants.
They had nine months of access to the compromised systems.
It does not appear they did any damage anywhere.
But can you imagine the amount of reconnaissance that was done?
The other thing, the biggest fear about this is if they successfully got their malicious code into
that software, what software updates out there are waiting to release their damaging payload.
Yikes.
So that's a huge concern about this attack.
They modified the sealed software code.
Again, that's one of the amazing things about this.
And in fact, they even engineered their own system for selecting the targets of the attack.
That's why Internet access was required.
And one of the things they did incredibly well to cover their tracks is that the functioning of the
malware mimicked the Orion protocols that are used in the actual application.
So everything that was occurring by the malware looked all completely normal to SolarWinds and SolarWinds
customers.
They also took great pains to close back doors up and just do everything they could to very effectively
make sure all of their tracks were removed.
All of this now we know, stems back to September 12th, 2019, when they successfully these Russian
hackers believed to be Russian hackers.
In September 12th of 2019, they got a harmless sample code into Orion.
Yeah, that was discovered after the fact.
So think of how clever they were.
They did a little piece of non malicious test code.
They got that into the Orion product.
That was their proof of concept back in September 12th, 2019.
And then they waited five months while they perfected the code they ended up injecting.
So what a slow, methodical, elegant, sophisticated attack.
And it's one that is often studied now, because this is absolutely something that we need to guard
against where we're having updates that might contain malicious code.
My goodness, that is a nightmare.
Think about it.
We're stressed enough when we apply updates because we don't want those updates to inadvertently knock
out services we might rely on.
I mean, we get stressed enough when it comes to updates failing.
We don't need the fear of malicious code in these sealed, digitally sealed updates.
Well, all right.
I want to thank you so much for joining me for this episode of Ethical Hacking in the Headlines.
It's always great to study what's really going on outside of academia, and we learn that all this academia
pays off because it is the very techniques that we're discussing that are employed.
Thanks so much for watching.