[WARNING] SolarWinds Orion source of FireEye and USGov agencies attack.

www.volexity.com

Dark Halo Leverages SolarWinds Compromise to Breach Organizations

Volexity is releasing additional research and indicators associated with compromises impacting customers of the SolarWinds Orion software platform. Volexity has also published a guide for responding to the SolarWinds breach, and how to detect, prevent, and remediate this supply chain attack. On...
www.volexity.com www.volexity.com

To add to the paranoia...

If you're using a 3rd party MFA, you need to rotate your security keys after the breach. Otherwise the bad guys can know what your secret is, and generate any TOTP response they want!
 
Everybody still is ignoring the elephant in the room. Hackers exploited Microsoft servers first and then used multiple methods to make their own set of application keys, malware signed with the organization’s own keys, etc.

I’ve heard very little about what Microsoft has done to close the exploits that let the hackers in the door!
 
nlinecomputers said:
I’ve heard very little about what Microsoft has done to close the exploits that let the hackers in the door!
Click to expand...

And you probably will continue to hear very little, other than the briefest statement that "the issues have been addressed."

The analysis for fixing these issues is not a 3-minute task, and there is a lot of very reasonable holding-close-to-chest of the details because you really don't want every nefarious actor on the surface of the earth having the details. Security by obscurity as part of a much more robust overall security protocol still has its place.
 
We've already heard about that, because those holes were patched earlier this year. https://www.microsoft.com/security/blog/2019/12/02/spear-phishing-campaigns-sharper-than-you-think/

The original breach was an assault against Azure's authentication API, which was fixed months ago. However, if you didn't rotate your admin keys this past Summer you wound up here.

TLDR, everyone should be rotating admin login access tokens including their TOTP secrets on a recurring basis. We often don't... This is all a good reminder to do so.
 
Last edited:
From SolarWinds:


Dear MSP Partner:

As you know, our systems experienced a supply chain attack on SolarWinds® Orion® Platform software, 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1. Based upon our current investigation, we have found no evidence that our SolarWinds MSP products are vulnerable to the supply chain attack. Please note, our updated security advisory provides additional details and answers to frequently asked questions about this issue, including specific product lists: www.solarwinds.com/securityadvisory.

As a best practice, to further enhance the security of our products, we have retained third-party cybersecurity experts to assist us in these matters, guiding us in improving our processes and controls.

To that end and to provide additional assurance to all of our customers, we have made the decision to digitally re-sign our products and have requested (and received) a new digital certificate, which reflects a recertification of the authenticity of SolarWinds products, both current and future.

What to expect next:

We intend to issue new product releases containing the updated certificate beginning December 17, 2020.
The existing certificate used by MSP products will be revoked on December 21, 2020.
You should receive an update from us within the next 24 hours containing specific details as to the availability of the releases and further actions you will need to take, including product updates, to help ensure your operations are not impacted by the certificate revocation.
While we understand that this requires effort on your part, we believe that this is the right step to help ensure the security of our products and retain the trust you have in us. Please know that we are doing our very best to minimize the impact to your business and to help ensure the protection of you and your customers.

Thank you,

SolarWinds MSP Logo
John Pagliuca | President | SolarWinds MSP







SolarWinds MSP: 3030 Slater Rd, 5th Floor, Morrisville, NC 27560
 
Dear MSP Partner,

As an update to our previous notification, we have just received an extension on the revocation date of our current digital certificate to February 22, 2021, 11:59 PST.

As posted on our Release Notes site (https://status.solarwindsmsp.com/2020/12/18/digital-certificate-update-for-msp-products-2/), we made the decision to digitally re-sign some of our products and have requested (and received) a new digital certificate, which reflects a recertification of the authenticity of SolarWinds products, both current and future.

As we previously noted, for the new digital certificate, the following products will be updated, which will likely require action on your part:

SolarWinds® N-central®

SolarWinds RMM

SolarWinds Backup

SolarWinds Passportal™

SolarWinds Take Control

We will be continually updating product-specific recommendations and technical details on the Release Notes site, which serves as a centralized resource. Please subscribe for the latest updates: https://status.solarwindsmsp.com/release-notes.

Products that will not need an updated digital certificate include:

SolarWinds Mail Assure/Spam Experts

SolarWinds MSP Manager

SolarWinds Risk Intelligence

SolarWinds Threat Monitor

Thank you for your continued partnership.

Nope... good luck idiot-winds... I got my crap off N-Central about 24 hours before this junk all blew up.
 
Worth reading the following article from Bloomberg. I have to say if I were still using SW products I would have to reconsider that now.

www.bloomberg.com

SolarWinds Adviser Warned of Lax Security Years Before Hack

A former security adviser at the IT monitoring and network management company SolarWinds Corp. said he warned management of cybersecurity risks and laid out a plan to improve it that was ultimately ignored.
www.bloomberg.com www.bloomberg.com
 
You must log in or register to reply here.

Similar threads

AlexanderCS
SolarWinds Orion Security Advisory
Replies
0
Views
580
AlexanderCS
AlexanderCS
nlinecomputers
SolarWinds MSP Changing Name...again
Replies
9
Views
1K
Sky-Knight
Sky-Knight
Back
Top