AXEL.org

solarWinds

What Else We’ve Learned About the SolarWinds Data Breach

In January, we covered a massive supply-chain data breach known as the SolarWinds attack. To get a broad overview of the incident, how the malicious agents carried out the hack, and the known victims, please read our coverage. Over the past four months, there have been new developments in the story that warrant a follow-up. Here, we go over these updates and discuss the potential for lasting fallout.

A brief synopsis

In December 2020, cybersecurity firm FireEye reported a significant flaw in the SolarWinds Orion database management software suite. When the dust settled, experts found that over 18,000 organizations had inadvertently installed a backdoor for an Advanced Persistent Threat (APT) group, likely Russian in origin. These state-sponsored actors infiltrated major corporations and high-level United States governmental agencies alike. Officials believe it to be the most widespread digital espionage campaign ever carried out against the United States. So, what have we found out since then?

More sophisticated than initially thought

From the very beginning, cybersec professionals knew the culprits were sophisticated and that the program’s scope was enormous. As it turns out, however, initial estimates seemed to have underestimated it. According to a recent analysis by RiskIQ, the infrastructure used by the threat actors was at least 56% larger than originally thought[1].

This implies the state hackers had access to significantly more computing power and probably targeted even more organizations than the known 18,000 victims. The same report also concluded that the use of United States-based infrastructure during the initial attack stage prevented the National Security Agency (NSA) from noticing the situation due to stricter laws against domestic surveillance.

Russians officially blamed

United States intelligence agencies have always blamed Russia for the attack, but it turned into more than an accusation when President Joe Biden and the United States formally sanctioned the adversarial country on March 15[2]. Provisions of the sanctions include:

  • Forbidding U.S. banks from buying bonds from or lending money to Russia’s national financial institutions after June 14.
  • Expelling 10 Russian diplomats accused of being intelligence agents from the United States.
  • Sanctioning six technology companies in Russia accused of supporting intelligence agencies.

The sanctions significantly ratchet up tensions between the two nations and mark a major departure from standard espionage protocol. Previously, the United States and other countries assumed cyber espionage campaigns were always underway from their enemies, and their enemies were under similar assumptions. This meant that there was an implicit understanding that everyone is spying on everyone else, and nobody felt real consequences for it. The sanctions set a new precedent that could result in escalation rather than diplomacy. Although, Russia pulled back troops from the Ukrainian border after the sanctions[3], so perhaps the message landed as intended. Only time will tell what ramifications this act has, but hopefully, it doesn’t increase the divide between the two largest nuclear powers.

Concurrent Chinese involvement

Although analysts blame Russia for the initial breach, it appears like Chinese state hackers also took advantage of the situation[4]. According to a report by Secureworks, some malicious agents used tactics similar to those employed by the Chinese APT, SPIRAL[5]. Furthermore, during the intrusion, the group accidentally revealed its IP, which originated from China. So, while sanctions only targeted Russia, there is evidence that China played a role too.

Of course, as we talked about in the original SolarWinds blog, it’s exceedingly difficult to analyze blame with a hundred percent certainty. State-sponsored digital espionage groups are adept at covering their tracks and obfuscating origins. And, while the United States government seems positive the Russians were the main culprits, hard evidence of this assertion hasn’t been made public. Not to mention the United States government has been wrong about some pretty bold claims before. We may never know the full truth.

Congress grills Microsoft

Interestingly, the company in the hottest water over the whole snafu isn’t SolarWinds; it’s Microsoft. Probably due to its high-profile nature, the U.S. Congress set its sights on the tech behemoth[6]. This is because, after the breach’s first stage, the hackers exploited Microsoft products and stole sensitive emails and other data from thousands of organizations.

Microsoft itself had its source code exposed to the hackers. Since source code is the lifeblood of a tech company, it shows exactly how all-encompassing the breach was. It also proves a crucial point; no matter how secure a system is, nothing can be completely safe from ill-intentioned cyberspies with the backing of an entire country’s resources. So, although House members assuredly loved grandstanding about the holes in Microsoft’s security, the truth is more complex and nuanced.

White House ramps down recovery efforts

This brings us to the conclusion of the saga. On April 19, the White House announced that several national agencies such as the FBI, CISA, and NSA would soon begin ramping down their efforts regarding SolarWinds. Combined with the Russian sanctions, it signals that the U.S. Government considers the incident largely settled. China appears unlikely to receive any formal retaliation. Hopefully, the most significant data breach of our times serves as a lesson for the future of cybersecurity. Undoubtedly similar incidents will occur in the future, but perhaps mitigation policies will improve, and potential damages will be reduced.

Security is a personal responsibility

If there’s one takeaway everyone should have about SolarWinds, it’s that relying on Big Tech’s security policies is a mistake. People should do a bit of research to find redundant cybersecurity methods for their sensitive data.

You can protect your confidential files by ditching cloud drives like Dropbox, OneDrive, and Google Drive and switch to AXEL Go. AXEL Go utilizes our decentralized, distributed files sharing network backed by blockchain and the InterPlanetary File System. This ensures your documents aren’t stored in one place with a single point of failure.

Additionally, every file you transfer via the AXEL Network gets “digitally shredded” and distributed to scattered server nodes. This means even if a malicious agent compromised a server, they wouldn’t have access to the complete file. Documents are only reconfigured for the initial user and any recipients. This system, combined with military-grade encryption, provides multiple layers of security for AXEL Go users.

You can try AXEL Go Premium with all features unlocked free for 14-days. Sign up today and see how AXEL can improve your workflow and harden your organization’s cybersecurity.

[1] “SolarWinds: Advancing the Story”, RiskIq.com, April 22, 2021, https://community.riskiq.com/article/9a515637

[2] Morgan Chalfant, Maggie Miller, “Biden administration sanctions Russia for SolarWinds hack, election interference”, April 15, 2021, https://thehill.com/homenews/administration/548367-biden-administration-unveils-sweeping-sanctions-on-russia?rl=1

[3] “Russia to pull troops back from near Ukraine”, BBC, April 22, 2021, https://www.bbc.com/news/world-europe-56842763

[4] Dan Goodin, “Chinese hackers targeted SolarWinds customers in parallel with Russian op”, Ars Technica, March 8, 2021, https://arstechnica.com/gadgets/2021/03/chinese-hackers-targeted-solarwinds-customers-in-parallel-with-russian-op/

[5] Counter Threat Unit Research Team, “SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group”, Secureworks.com, March 8, 2021, https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group

[6] Frank Bajak, “SolarWinds hacking campaign puts Microsoft in the hot seat”, The Associated Press, April 17, 2021, https://apnews.com/article/business-technology-government-and-politics-f51e53523312b87121146de8fd7c0020

The SolarWinds Beneath Hackers’ Wings

On December 13th, 2020, cybersecurity firm FireEye disclosed news of one of the most comprehensive cyber-espionage campaigns ever carried out against the United States and other global victims[1]. Since then, a significant amount of information has become public. Here, we summarize the attack, a few notable victims, and look into which hacking group could be responsible.

The infiltration

The attack happened due to an exploit in the Orion software from the company SolarWinds. The Orion Platform is an enterprise monitoring program that can manage and analyze information from traditionally separate IT domains, such as infrastructure, networking, and virtualization.

SUNSPOT

First, the hackers gained access to the SolarWinds Orion build environment. This means they could inject malware directly into the program’s source code before the company sent it to customers in the form of regular updates. It also meant they had to be sophisticated enough to conceal their tracks so that the developers didn’t notice anything out of the ordinary.

The malicious agents then used a new malware called SUNSPOT to install a backdoor into the Orion software[2].  Interestingly, the implantation of this malware required extensive knowledge of both Orion and Microsoft exploits. SUNSPOT works by monitoring the Microsoft operating system and searching for running processes involved with Orion source code compilation. It then injects the backdoor code (codename SUNBURST) into one of the Orion source files before the compiler runs and the software officially updates.

SUNBURST

After implantation, the SUNBURST backdoor has a dormancy period of approximately two weeks[3]. Disguised as a legitimate Orion plugin, the trojan payload connects to a third-party server, retrieves various commands, and executes them. These commands allow the plugin to take over the host computer completely. Now the group can:

  • Transfer files. Allows the hackers to retrieve files from the host computer as well as send more infected payloads.
  • Execute files. Allows hackers to install more malware onto the compromised systems.
  • Profile the system. Searches for more vulnerabilities and maps the network’s layout.
  • Reboot the machine. Hackers can reboot systems after malware installations.
  • Disable system services. This makes it easier to conceal activities since monitoring programs and antivirus software can be shutdown.

Analysts continue to find new malware installed by the SolarWinds hackers as they spend more time studying the breach.

The compromised

SolarWinds had over 300,000 customers. That includes 425 FORTUNE 500 companies and all five branches of the United States government[4]. While it’s unlikely the hackers actively infiltrated every organization using the software, the company believes that up to 18,000 of them using their Orion Platform could have malware installed. Full breaches did occur to many high-profile targets. Here is an abbreviated list of victims:

Microsoft

As we’ve seen, the hackers had a deep understanding of Microsoft cloud software. In fact, Microsoft representatives had to admit that the malicious agents viewed their product’s proprietary source code[5]. Although the intruders could not alter any of the code, even viewing it is a significant incident. Large tech corporations such as Microsoft keep their source code under serious security. Their intellectual property is the lifeblood of their businesses, so it goes to show how deep the hackers were in their systems.

FireEye

FireEye is one of the largest, most-respected cybersecurity firms in the world. They initially found the attack, but only because the company itself fell victim. The hackers accessed FireEye’s internal systems and stole security testing tools, but the company insists no customer data was compromised[6]. Regardless, it’s interesting that an organization whose entire business is protecting others from hackers got hacked.

Administrative Office of the U.S. Courts

Federal agencies seem to be the main targets of the perpetrators behind the hack.  The Administrative Office of the U.S. Courts has publicly confirmed being affected by the incident[7]. This is troubling because officials claim the threat actors compromised an electronic document filing system used by the Federal Judiciary. So, highly-sensitive federal court documents have been accessible to hackers since the Spring of 2020!

Department of Energy

A representative for the department confirmed that the SolarWinds malware infected systems within the Department of Energy and the National Nuclear Security Administration. Now that sounds serious! Fortunately, it does not appear that the hackers accessed networks pertaining to national security. On December 18th, DOE spokesperson Shaylyn Hynes said, “At this point, the investigation has found that the malware has been isolated to business networks only..[8]” and there have not been any updates since.

Department of Justice

The U.S. DOJ didn’t get off as easily as others. Here, the hackers moved through their network and accessed the email accounts of thousands of employees[9]. According to a DOJ spokesman, it “only” amounted to approximately 3% of the workforce, and the culprits did not breach any classified information. However, that still means over 3,000 people had their accounts infiltrated.

This is only 5 of the over 250 organizations listed by Bleeping Computer confirmed to be affected[10]. There are hundreds more, including The United States Treasury, The Department of Homeland Security, the United States Department of State, The Department of Health’s National Institutes of Health, Cisco, VMWare, Intel, and so on. It is undoubtedly the most comprehensive and dangerous hack ever known.

The perpetrators

Immediately after FireEye disclosed the attack to the public, Reuters reported that state-sponsored Russian hackers were thought to be behind it[11].  On December 14th -one day after the initial disclosure- the Washington Post went as far as to attribute it specifically to the Russian Advanced Persistent Threat group (APT), Cozy Bear[12]. Typically, the digital forensics necessary to pinpoint attribution of an attack take weeks or months, and many times it is never certain. Dedicated cybersecurity websites such as FireEye have not given direct attribution, showing the gulf of technical knowledge between the mainstream media and those with more experience. Given the geopolitical implications (U.S. politicians immediately began saber-rattling and calling the intrusion an “act of war”[13]), news outlets should wait for more facts to come out before running with the most inflammatory stories possible.

The evidence

So, what are the facts? At the moment, they’re pretty scarce. A joint statement by the FBI, CISA, NSA, and The Office of the Director of National Intelligence says that is “likely” to blame for the massive attack[14]. President Trump says [15]. Neither offer much evidence to back their claims.

The only evidence made public tying any specific group to the incident was recently published by the cybersecurity firm Kaspersky. Their researchers found code overlap between SUNBURST and the malware Kazuar[16]. The Russian-speaking hacker group Turla (note: NOT Cozy Bear) uses Kazuar. They don’t go so far as to provide any degree of certainty for the link, however. There are other potential explanations for the similarities.

The alternative explanations

The SolarWinds hackers may have purchased the Kazuar malware tools. Or, more insidiously, the perps could have purposefully inserted code to make it appear as if it were a Russian operation to conceal its true origin. That may seem too much like a Hollywood movie, but consider the tremendous technical lengths to which the hackers went to stay hidden. Adding another layer of covertness isn’t so far-fetched.

And, there is recent precedent for such tactics. In 2018, the threat actors behind the PyeongChang Olympics attack planted “false flags” within their code to obfuscate the source[17]. The Turla group itself employed deceitful methods in 2019 to pin their activities on Iran[18]. So, if Turla is capable of this, and the SolarWinds attack itself was so sophisticated and obscured, why would they leave such a calling card in their code?

This is not to claim that this attack is definitely not of Russian origin. Indeed, they have the motive and the capabilities. But, we should acknowledge that it is very uncertain at the moment. Kaspersky, FireEye, Crowdstrike, and others have gone out of their way not to blame any particular threat actor with any confidence. The mainstream media should follow suit. Let the forensic investigations continue and see where the evidence leads. At the moment, it points toward Russia, but not conclusively.

Data protection

If enormous breaches like this teach us anything, it’s that your data needs to be protected. Secure your data at rest and in motion with AXEL Go. AXEL Go is a file-sharing and storage platform that offers industry-leading security features. Utilizing technology such as blockchain, the InterPlanetary File System (IPFS), and AES 256 encryption, you can keep your sensitive documents safe from any would-be data thieves.

Sign up for our Basic, full-featured AXEL Go account and receive 2GB of free online storage and plenty of AXEL Tokens to fuel thousands of typical shares. You don’t have to live in fear of when the next breach will happen. You can secure your files with AXEL Go.

 

[1] “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor”, FireEye, Dec. 13, 2020, https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

[2] “CrowdStrike Intelligence Team”, “SUNSPOT: An Implant in the Build Process”, CrowdStrike, Jan. 11, 2021, https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/

[3] “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor”, FireEye, Dec. 13, 2020, https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

[4] Gopal Ratnam, “SolarWinds Hack Recovery May Cost Upward of $100B”, Government Technology, Jan. 12, 2021, https://www.govtech.com/security/SolarWinds-Hack-Recovery-May-Cost-Upward-of-100B.html

[5] Maggie Miller, “Microsoft says hackers viewed source code as part of SolarWinds attack”, MSN, Dec. 31, 2020, https://www.msn.com/en-us/news/politics/microsoft-says-hackers-viewed-source-code-as-part-of-solarwinds-attack/ar-BB1co3VF

[6] Mike Lennon, “FireEye Says ‘Sophisticated’ Hacker Stole Red Team Tools”, Security Week, Dec. 8, 2020, https://www.securityweek.com/fireeye-says-sophisticated-hacker-stole-red-team-tools

[7] Dustin Volz, Robert McMillan, “Federal Judiciary’s Systems Likely Breached in SolarWinds Hack”, The Wall Street Journal, Jan. 7, 2021, https://www.wsj.com/articles/federal-judiciarys-systems-likely-breached-in-solarwinds-hack-11610040175

[8] “DOE Update on Cyber Incident Related to Solar Winds Compromise”, Energy.gov, Dec. 18, 2020, https://www.energy.gov/articles/doe-update-cyber-incident-related-solar-winds-compromise

[9] Catalin Cimpanu, “SolarWinds fallout: DOJ says ahckers accessed its Microsoft O365 email server”, ZDNet, Jan. 6, 2021, https://www.zdnet.com/article/solarwinds-fallout-doj-says-hackers-accessed-its-microsoft-o365-email-server/

[10] Sergiu Gatlan, “SolarWinds victims revealed after cracking the Sunburst malware DGA”, Bleeping Computer, Dec. 22, 2020, https://www.bleepingcomputer.com/news/security/solarwinds-victims-revealed-after-cracking-the-sunburst-malware-dga/

[11] Raphael Satter, “IT company SolarWinds says it may have been hit in ‘highly sophisticated’ hack”, Reuters, Dec. 13, 2020, https://www.reuters.com/article/us-usa-solarwinds-cyber/it-company-solarwinds-says-it-may-have-been-hit-in-highly-sophisticated-hack-idUSKBN28N0Y7

[12] Ellen Nakashima, Craig Timberg, “Russian government hackers are behind a broad espionage campaign that has compromised U.S. agencies, including Treasury and Commerce”, The Washington Post, Dec. 14, 2020, https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html

[13] Maggie Miller, “Lawmakers ask whether massive hack amounted to act of war”, The Hill, Dec. 18, 2020, https://thehill.com/policy/cybersecurity/530784-lawmakers-ask-whether-massive-hack-amounted-to-act-of-war

[14] “JOINT STATEMENT BY THE FEDERAL BUREAU OF INVESTIGATION (FBI), THE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA), THE OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE (ODNI), AND THE NATIONAL SECURITY AGENCY (NSA)”, CISA.gov, Jan. 5, 2021, https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure

[15] Justin Sink, “Faced with massive suspected Russian cyber-attack on the U.S. government, Trump blames China”, Fortune, Dec. 21, 2020, https://fortune.com/2020/12/21/faced-with-massive-suspected-russian-cyber-attack-on-the-u-s-government-trump-blames-china/

[16] Tara Seals, “SolarWinds Hack Potentially Linked to Turla APT”, threat post, Jan. 11, 2021, https://threatpost.com/solarwinds-hack-linked-turla-apt/162918/

[17] Tom Spring, “Olympic Destroyer: A False Flag Confusion Bomb, threat post, March 8, 2018, https://threatpost.com/olympic-destroyer-a-false-flag-confusion-bomb/130262/

[18] Oscar Williams, “Russia’s Turla hackers used Iranian cyber weapons to “mask identity”, says NCSC”, NS Tech, Oct. 21, 2019, https://tech.newstatesman.com/security/russia-turla-iran-ncsc