SolarWinds Hack to Signal a new form of Warfare?

 The list keeps on growing... The new war. The new espionage. Call it what you will, but this was not a simple attack.

It started by manipulating SolarWinds Orion system updates hackers (state sponsored hackers, i.e. cyber warfare). This updated version allowed the hackers to access any of the servers which hosted the SolarWinds application, which is an IT monitoring and management tool used by administrators and network engineers. This allowed the hackers to have full administrator access to at least one server inside the victim's network, and download any additional malware they needed to get full access of the victims' networks. To set things in perspective, hackers breached the US nuclear weapons agency.

Source: Microsoft

The list of victims is huge. Till now, 40+ major companies or government departments and agencies have been identified. I expected the final number to reach at least a 100+ hi-profile victims. Hackers had around 9 months to do whatever they wanted without being caught. 80% of which are located in the United States, with the rest being spread across seven other countries —namely Canada, Mexico, Belgium, Spain, the UK, Israel, and the UAE. 

Companies breached so far:

- Microsoft
- SolarWinds
- Fireeye

Main US targets:

- The US Treasury Department
- The US Department of Commerce's National Telecommunications and Information Administration (NTIA)
- The Department of Health's National Institutes of Health (NIH)
- The Cybersecurity and Infrastructure Agency (CISA)
- The Department of Homeland Security (DHS)
- The US Department of State
- The National Nuclear Security Administration (NNSA)
- The US Department of Energy (DOE)
- Three US states
- City of Austin (also disclosed today)

While not the first attack of its kind, the fact that we are still at the tip of the iceberg in discovering the scale is worrisome. The types of victims, the amount of data that could have been stolen during a 9-month breach, and the fact that it is a state sponsored attack all indicate that the new wars will be fought online as well as with real weapons.


Finally, so many questions come to mind, and I am sure those would be answered within the coming days:

1. How did the hackers bypass all internal SolarWinds controls, application controls and Quality Assurance to publish such a malicious update.
2. How were they left undetected for 9 months.
3. How many companies have been really breached and what type of data has been stolen
4. What long lasting impact will this have on the cyber world, how can we ensure that software installed on our infrastructure is secure?
5. Will the US retaliate?

Thoughts About Security ~ 1

I keep being asked about what I do for a living… I answer that I work in security.

Shock!! Horror! “Poor you, you studied in the US of A to work as a security personnel? You have to protect the company from burglars and save the day when staff members fight?”

People who know me a bit know that I studied for two years in the USA to pursuit my Master’s degree.

I start with my explanation. No offense to any physical security personnel, I actually work in computer security. You know, I protect the company’s computers, data and ensure that no harm can happen from the evil guys out there. I spend minutes after minutes trying to explain what I do.

You can imagine what type of questions I am asked… Instead of questions related to security, people start asking me about anything related to computers and technology… Can I format their PCs? Should they buy phone X or phone Y? How can I fix their wireless network at home to reach the whole house? Is this printer a good printer?

Don’t get me wrong, I love technology and I love to help people, especially when I know the answer. But this is all not security!!!

Eventually and after so many attempts at explaining what I do, their eyes lighten up and I feel that they actually are relieved. All that money spent and those two years didn’t go in vain… THANK GOD!

No one really cares about computer security until he/she has been hit by a virus, lost some data or had their account stolen. Other than that, why care?

The exact same issue applies to work. Managers out there don’t care about security. All that compliance is just an additional burden… more money to pay, more workers to employ and more systems to deploy. The only thing that gets them interested is when their own company gets hit, and when it’s hit, it is usually hit hard. Just ask SONY!!!

So people please don’t wait till your accounts are stolen, or your company is attacked… Do something about it, and do it now…