The SolarWinds Supply Chain Attack: What Businesses Need to Know

What is the SolarWinds Supply Chain Attack?

SolarWinds, the Austin-based cybersecurity firm, found itself in the middle of a catastrophe due to internal security lapses. The firm recently earned headlines for making it to the list of unsuspecting service providers targeted for its elite supply chain. A week ago, the popular Cybersecurity firm confirmed falling victim to a supply chain attack, which was quite a coup for the threat actors. 

In its statement, SolarWinds confirmed two major vulnerabilities — SUNBURST and SUPERNOVA — which we shall discuss in a while. Before we dig deeper into how the threat actors pulled it off, you need to know what the Orion platform is. Simply referred to as ‘Orion’, it is the flagship IT Monitoring and Management platform of SolarWinds. 

It facilitates the implementation and scaling of the various security applications offered by SolarWinds. You can look at it as the base application used by clients to manage resources. Now that’s precisely why threat actors used it as a gateway to gain entry into the private networks of the Cybersecurity firm’s customers.

Who is responsible for the SolarWinds Supply Chain Attack?

According to Reuters, a researcher by the name Vinoth Kumar is said to have warned SolarWinds about its weak password for the update server almost a year ago. The password ‘solarwinds123’ was easy and could have been cracked with a basic Bruteforce application. While that highlights the potential flaws in the internal security system of SolarWinds, researchers state that it wasn’t the source of the current crisis. So what really happened?

Let’s find out!

How Did the SolarWinds Breach Happen?

Like any other IT service provider, SolarWinds released timely updates for its base application, Orion. However, the updates 2019.4 through 2020.2.1 which were released between March and June 2020 included malicious code that the cybercriminals inserted. Basically, “legit” updates were duly signed and released by SolarWinds had two major vulnerabilities, which Security Experts refer to as SUNBURST and SUPERNOVA. 

The SUNBURST vulnerability, which SolarWinds confirms to be present in the 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 versions create a backdoor that transmits data via the HTTP protocol and then intercepts it. The other vulnerability SUPERNOVA isn’t embedded within the Orion updates but is a distinct malware that tries to mimic SolarWinds’ proprietary products. Through this, the cybercriminals impersonated SolarWinds to gain unauthorized access.

Until a week ago, SolarWinds remained oblivious to the breach, while its unsuspecting clientele continued to download the trojanized updates and the malware. It is safe to assume these two vulnerabilities may have adversely affected thousands of Orion users. 

This is the same pattern followed in the Asus supply chain attack, wherein the OS update was corrupted. However, this security breach could be a lot more damaging because of the Austin-based cybersecurity firm’s high-profile supply chain.

Let’s try to ascertain the extent of damage this supply chain attack may have caused.

How Bad Is It?

Supply chain attacks usually affect a long list of entities, and it comes as no surprise that over 18,000 SolarWinds customers might have suffered because of this attack. The shocking part is the callousness of leaders in not planning and implementing basic strategic defensive measures. This is highlighted by the fact that several critical US government departments all engaged the same vendor — SolarWinds. 

The affected Government departments and agencies include the US Treasury, Pentagon, Homeland Security, and sources have also stated that nuclear programs which come under the US Department of Energy may have been a target. 

While many U.S. intelligence officials were quick to blame Russia for the attack, there could be others involved as well. To date, neither the US government nor any affected companies have publicly said which nation-state they think is responsible. There’s still a lot we do not know. Recently, SolarWinds removed quite a few clients from the list of customers posted on its official website, which is probably to protect their best interests. Several other measures have also been implemented, but the extent of damage is still unknown. 

Is My Organization at Risk?

In a bid to curb the mess created by hackers, SolarWinds has removed the potentially dangerous software builds from its download sites.

Organizations that have downloaded the SolarWinds malicious updates or malware remain vulnerable and must act fast. Your action depends on the update you may have downloaded. 

What Should I Do?

If you have been a victim of the SolarWinds Supply chain attack, start by figuring out which update version you have currently installed. You can do that by going to the control panel and navigating to the ‘installed updates’ section. You then need to uninstall the malicious ones and download the latest versions of Orion, which would be the 2020.2.1 HF 2 or 2019.4 HF 6. 

An even more effective measure would be to uninstall all the SolarWinds applications and reinstall them with the secure new versions. As the new version includes the security patches required to counter both the SUNBURST and SUPERNOVA vulnerabilities, it ensures better security.

The Big Takeaway from the SolarWinds Breach

Don’t look at the Solarwinds hack in isolation. Look at every one of your vendors that can push updates into your environment.

David Wolpoff, CTO of cybersecurity firm Randori

According to David Wolpoff of Randori “For security leaders, this is a good opportunity to reflect on their reliance and trust in technology solutions. These breaches are reminders of unseen risk debt: Organizations have a huge amount of potential harm built up through their providers that typically isn’t adequately hedged against… Don’t look at the Solarwinds hack in isolation. Look at every one of your vendors that can push updates into your environment.”

Nothing online is 100 percent secure, so the element of risk cannot be entirely removed. Since Organizations and Government agencies cannot survive without third-party vendors — which exposes them to the risk of supply chain attacks — the only prudent measure would be to diversify vendors to perform critical functions such as cybersecurity. Although it does not entirely eliminate the risk of a supply chain attack, it definitely distributes the risk across multiple vendors. This minimizes the amount of damage any single supply chain attack can cause. When disaster does strike, it pays to have a partner who can help you make sense of the chaos and chart a clear path forward. That’s why, for over 30 years, Chesley Brown has dedicated ourselves to helping organizations anticipate and navigate risk before it becomes a crisis. If you have serious questions about your security, our experts are always here to help.

Sign up!

For industry-leading guides and analysis sign up for our blog below.

  • This field is for validation purposes and should be left unchanged.

Latest News

A group of people walking outside to represent how Community Policing Strategies can bring communities closer

Community Policing Strategies: Building Trust and Safety

By Chesley Brown | June 11, 2024

Written by: James Hart It’s always important to remember: Private security officers aren’t police, and police aren’t security officers. The two roles are both important, but they have fundamental differences. “Security officers can’t be everywhere,…

Read More
Securing Infrastructure - A view from under a bridge looking out towards the shipping yard.

Securing Infrastructure: How to Prepare for Disruptions to Critical Services and Systems in Your Business

By Chesley Brown | June 6, 2024

Written by: James Hart Infrastructure is one of the great blessings of the modern age. Flip a switch, turn on a faucet, launch a browser window, and you can generally assume the giant invisible systems…

Read More
Two women browsing at a shopping center: Security Challenges in Shopping Centers

Security Challenges in Shopping Centers — and How to Overcome Them 

By Chesley Brown | May 28, 2024

Written by: James Hart  Overcoming the Biggest Security Challenges in Shopping Centers The retail business has never been for the faint of heart. In recent years, however, security problems have made it even more challenging…

Read More
Securing Office Buildings - The façade of a A office tower - best practices for commercial building security

Securing Office Buildings: Best Practices for Property Managers Seeking a Safer, More Secure Environment

By Chesley Brown | May 21, 2024

Written by: James Hart As competition for tenants remains high, property managers must not overlook the importance of effectively securing their office buildings, according to experts from Chesley Brown International, the security consulting and risk…

Read More
Picture of a man (Director Ray Strobel) wearing a suit standing in front of a Chesley Brown Flag.

Introducing Ray Strobel: Director of the Waterfront

By Chesley Brown | April 10, 2024

We’re thrilled to announce the promotion of Ray Strobel to the role of Public Safety Director at the Waterfront in Pittsburgh’s Steel Valley! Ray brings with him a wealth of experience and a unique perspective from his extensive background in law enforcement and service to our country. We sat down with Ray for a fun interview to get to know him better and learn about his journey with Chesley Brown and beyond.

Read More
The 7 Step Guide for Building Business Continuity Plans that Work