Schneier on Security

ResearcherZero • May 4, 2023 12:10 AM

@Andrew

May get some good aurora
‘https://www.swpc.noaa.gov/news/r1-r2-minor-moderate-events-3-may-2023

and also a meteor shower, early in the morning…

But seriously now…

As you were saying

A supply chain attack intrudes into the development environment.

In this case they swapped a file (SolarWinds.Orion.Core.BusinessLayer.dll). The update was then compiled with the modified file. It was carefully done so that it would not produce any alert, by changing flags to suppress warnings.

This meant that no one noticed that the update had been altered. It was only later when malicious traffic was detected that any initial investigation took place, but it was not suspected that it was the update to Orion at that time…

“At the time of the investigation, Volexity deduced that the likely infection was the result of the SolarWinds box on the target network; however, it was not fully understood exactly how the breach occurred (i.e., whether there was some unknown exploit in play, or other means of access), therefore Volexity was not in a position to report the circumstances surrounding the breach to SolarWinds. The machines involved in this incident had been rebooted several times prior to Volexity’s involvement in incident response efforts, meaning that a great deal of evidence that would have been in volatile memory had been lost.”
‘https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

Mandiant detected the backdoor inserted in the update a few months later…

‘https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor

The following article has a pretty simple explanation for anyone who does not understand technical terms.

‘https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack

ResearcherZero • May 8, 2023 3:07 AM

Putin stressed: “The most serious attention should be paid to information security.”

“President Donald Trump only acknowledged the hacking on Saturday almost a week after it surfaced, downplaying its importance and questioning whether the Russians were to blame. Russian state media gleefully seized on President Donald Trump’s remarks playing down the role of Russia in the hacking.”

‘https://www.dailymail.co.uk/news/article-9072833/Putin-celebrates-100th-anniversary-Russian-spy-agency-major-cyberattack.html

Trump’s comments caught the White House off guard as they attempted to square the president’s comments with Secretary of State Mike Pompeo’s remarks a day earlier saying that Russia was “pretty clearly” behind the hack, according to two officials with knowledge of the situation.

White House officials had drafted a statement assigning blame to Russia for the attack and were preparing to release it Friday afternoon but were told to stand down.
‘https://www.nbcnews.com/politics/white-house/trump-downplays-russia-hack-first-comments-massive-breach-implicates-china-n1251813

Golden SAML is a technique that allows attackers, once they have privileged access to the victim’s network, to impersonate almost any identity in the organization and acquire any type of privilege across almost all services of the organization (this depends on what services in the organization use SAML as their authentication protocol).
‘https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps