Solarwinds hack 2020 code#

SUNBURST malware was injected into SolarWind's source code base SUNBURST malware: Analytic Tool SolarFlare, a 'Kill Switch' and EINSTEIN's fail News in the fight against SUNBURST infection, domain seized Sloppiness at SolarWinds responsible for compromised software? SolarWinds products with SunBurst backdoor, cause of FireEye and US government hacks? And the case shows once again how important it is to exchange information between security specialists and to inform the specialist public at an early stage. But the analysis still has to be done by specialists, and then it depends on how quickly they get through the case. SIEM (Security Information and Event Management) systems may help to detect unusual activities. But the idea that good anti-virus software, with AI support if necessary, will fend it off is naive under the circumstances. It's true that detecting such supply chain attacks is complex. The hackers were active on these various networks for between four and nine months before the campaign was uncovered by Mandiant. Department of Justice (DOJ), Department of Defense (DoD), Department of Homeland Security, and Department of the Treasury, as well as leading technology and security companies such as Microsoft, Mandiant, Intel, Cisco, and Palo Alto Networks.

Solarwinds hack 2020 software#

This compromised Orion software subsequently infected at least nine U.S.

Solarwinds hack 2020 update#

The backdoor was installed on the systems via an update of the SolarWinds Orion software. The Orion software was used by around 18,000 of the company's customers. Because now it became known that Russian hackers had hacked the software manufacturer SolarWinds and built a backdoor into the Orion software.

In December 2020, the whole thing then made huge waves when Mandiant went public. Investigation of this incident then revealed that the hack had been via a supply chain attack on SolarWinds Orion software. It wasn't until November 2020 that Mandiant realized they had been hacked themselves. In December 2020, the hacks became public

A month later, the DOJ bought the Orion system, indicating that the agency was convinced that there was no further threat from the Orion suite, the sources said.

In July 2020, with the mystery still unsolved, communication between investigators and SolarWinds ended. But SolarWinds engineers could not find a vulnerability in their code. The software specialists asked SolarWinds for assistance in the investigation. Specialists at the hired firms suspected that the hackers had penetrated the DOJ server directly, possibly by exploiting a vulnerability in the Orion software. In addition, Microsoft was also called in, although it is not clear why they was also included in the investigation. The Justice Department commissioned security firm Mandiant to investigate whether the server had been hacked. The software, which is used by system administrators to manage and configure networks, was communicating externally with an unknown system on the Internet. That traffic was emanating from one of its servers running a test version of SolarWinds' Orion software package, sources familiar with the incident said. The suspicion was triggered when the IT staff of the ministry discovered unusual traffic. Department of Justice noticed Russian hackers on its network, but didn't realize the significance of the find until six months later, Wired writes. Wired uncovered this story in the article The DOJ Detected the SolarWinds Hack 6 Months Earlier Than First Disclosed.Īs early as the end of May 2020, the U.S. But it wasn't until six months later that there was a disclosure from Mandiant about the attackers' campaign. The IT specialists had seen signs of an intrusion into the IT systems. The following tweet reveals now that the US Department of Justice as well as big names like Microsoft, Mandiant or SW looked at the incident without really recognizing its explosive nature. The whole thing started from a supply chain attack on SolarWinds Orion software, which was used in many companies. government agencies also had their IT systems infiltrated by the Russian attackers (see US Treasury and US NTIA hacked). I had reported extensively here on the blog about the SolarWinds hack of the Orion software, see the post FireEye hacked, Red Team tools stolen and the posts linked at the end of the article.