SolarWinds has patched its software, but that doesn’t mean other backdoors haven’t been established. SolarWinds was the ingestion point, but their Orion® Platform users were the true victims. With that visibility and tooling in place, once these items are known, customers who had them would be able to react in real-time. Without such tools, SolarWinds would lack the visibility or history needed to hunt for these threats once the Indicators of Compromise have been identified. The key is to implement the proper tools and processes so that your organization can react quickly. The key to a successful security strategy is understanding that it’s not a matter of ‘if’, but ‘when’. This was a nation-state, advanced attack, so unfortunately not a lot. What could have been done to prevent this? SolarWinds has made assurances that they will continue to engage and provide their customers with world-class support through this situation. As such, they are limited as to what they can share at this time.

They are currently coordinating with security experts and organizations, the Federal Bureau of Investigation, the intelligence community, and other government agencies and law enforcement organizations to investigate these matters. SolarWinds investigations and remediation efforts for these matters are early and ongoing. We don’t have all the details on the intent yet. Nation-state actors often leverage supply chain vulnerabilities to get footholds into several enterprise accounts to further breach a larger set of customers with the intent of stealing data. SolarWinds has also announced the attackers are believed to be acting on behalf of a foreign government, but they have not verified the identity of the attacker. In this case, SolarWinds describes that the code was intended to be used in a targeted way as its exploitation requires manual intervention. The total number of victims has not yet been released. Known victims so far include the US Treasury, the US NTIA, and FireEye. On December 13, 2020, SolarWinds announced it was the victim of a cyberattack to its systems that inserted a vulnerability (SUNBURST) within their Orion® Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1, which, if present and activated, could potentially allow an attacker to compromise the server on which the Orion products run. This attack was a very sophisticated supply chain attack, which refers to a disruption in a standard process resulting in a compromised result with the goal of being able to attack subsequent users of the software.

Solarwinds supply chain attack