The SolarWinds Supply Chain Attack: What Businesses Need to Know

What is the SolarWinds Supply Chain Attack?

SolarWinds, the Austin-based cybersecurity firm, found itself in the middle of a catastrophe due to internal security lapses. The firm recently earned headlines for making it to the list of unsuspecting service providers targeted for its elite supply chain. A week ago, the popular Cybersecurity firm confirmed falling victim to a supply chain attack, which was quite a coup for the threat actors. 

In its statement, SolarWinds confirmed two major vulnerabilities — SUNBURST and SUPERNOVA — which we shall discuss in a while. Before we dig deeper into how the threat actors pulled it off, you need to know what the Orion platform is. Simply referred to as ‘Orion’, it is the flagship IT Monitoring and Management platform of SolarWinds. 

It facilitates the implementation and scaling of the various security applications offered by SolarWinds. You can look at it as the base application used by clients to manage resources. Now that’s precisely why threat actors used it as a gateway to gain entry into the private networks of the Cybersecurity firm’s customers.

Who is responsible for the SolarWinds Supply Chain Attack?

According to Reuters, a researcher by the name Vinoth Kumar is said to have warned SolarWinds about its weak password for the update server almost a year ago. The password ‘solarwinds123’ was easy and could have been cracked with a basic Bruteforce application. While that highlights the potential flaws in the internal security system of SolarWinds, researchers state that it wasn’t the source of the current crisis. So what really happened?

Let’s find out!

How Did the SolarWinds Breach Happen?

Like any other IT service provider, SolarWinds released timely updates for its base application, Orion. However, the updates 2019.4 through 2020.2.1 which were released between March and June 2020 included malicious code that the cybercriminals inserted. Basically, “legit” updates were duly signed and released by SolarWinds had two major vulnerabilities, which Security Experts refer to as SUNBURST and SUPERNOVA. 

The SUNBURST vulnerability, which SolarWinds confirms to be present in the 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 versions create a backdoor that transmits data via the HTTP protocol and then intercepts it. The other vulnerability SUPERNOVA isn’t embedded within the Orion updates but is a distinct malware that tries to mimic SolarWinds’ proprietary products. Through this, the cybercriminals impersonated SolarWinds to gain unauthorized access.

Until a week ago, SolarWinds remained oblivious to the breach, while its unsuspecting clientele continued to download the trojanized updates and the malware. It is safe to assume these two vulnerabilities may have adversely affected thousands of Orion users. 

This is the same pattern followed in the Asus supply chain attack, wherein the OS update was corrupted. However, this security breach could be a lot more damaging because of the Austin-based cybersecurity firm’s high-profile supply chain.

Let’s try to ascertain the extent of damage this supply chain attack may have caused.

How Bad Is It?

Supply chain attacks usually affect a long list of entities, and it comes as no surprise that over 18,000 SolarWinds customers might have suffered because of this attack. The shocking part is the callousness of leaders in not planning and implementing basic strategic defensive measures. This is highlighted by the fact that several critical US government departments all engaged the same vendor — SolarWinds. 

The affected Government departments and agencies include the US Treasury, Pentagon, Homeland Security, and sources have also stated that nuclear programs which come under the US Department of Energy may have been a target. 

While many U.S. intelligence officials were quick to blame Russia for the attack, there could be others involved as well. To date, neither the US government nor any affected companies have publicly said which nation-state they think is responsible. There’s still a lot we do not know. Recently, SolarWinds removed quite a few clients from the list of customers posted on its official website, which is probably to protect their best interests. Several other measures have also been implemented, but the extent of damage is still unknown. 

Is My Organization at Risk?

In a bid to curb the mess created by hackers, SolarWinds has removed the potentially dangerous software builds from its download sites.

Organizations that have downloaded the SolarWinds malicious updates or malware remain vulnerable and must act fast. Your action depends on the update you may have downloaded. 

What Should I Do?

If you have been a victim of the SolarWinds Supply chain attack, start by figuring out which update version you have currently installed. You can do that by going to the control panel and navigating to the ‘installed updates’ section. You then need to uninstall the malicious ones and download the latest versions of Orion, which would be the 2020.2.1 HF 2 or 2019.4 HF 6. 

An even more effective measure would be to uninstall all the SolarWinds applications and reinstall them with the secure new versions. As the new version includes the security patches required to counter both the SUNBURST and SUPERNOVA vulnerabilities, it ensures better security.

The Big Takeaway from the SolarWinds Breach

Don’t look at the Solarwinds hack in isolation. Look at every one of your vendors that can push updates into your environment.

David Wolpoff, CTO of cybersecurity firm Randori

According to David Wolpoff of Randori “For security leaders, this is a good opportunity to reflect on their reliance and trust in technology solutions. These breaches are reminders of unseen risk debt: Organizations have a huge amount of potential harm built up through their providers that typically isn’t adequately hedged against… Don’t look at the Solarwinds hack in isolation. Look at every one of your vendors that can push updates into your environment.”

Nothing online is 100 percent secure, so the element of risk cannot be entirely removed. Since Organizations and Government agencies cannot survive without third-party vendors — which exposes them to the risk of supply chain attacks — the only prudent measure would be to diversify vendors to perform critical functions such as cybersecurity. Although it does not entirely eliminate the risk of a supply chain attack, it definitely distributes the risk across multiple vendors. This minimizes the amount of damage any single supply chain attack can cause. When disaster does strike, it pays to have a partner who can help you make sense of the chaos and chart a clear path forward. That’s why, for over 30 years, Chesley Brown has dedicated ourselves to helping organizations anticipate and navigate risk before it becomes a crisis. If you have serious questions about your security, our experts are always here to help.

Posted by:

Sign up!

For industry-leading guides and analysis sign up for our blog below.

  • This field is for validation purposes and should be left unchanged.

Latest News

Podcast | Risk Takers Series #2 Terry Fisher — Electronic Countermeasures

By Chesley Brown | July 14, 2020

Have you ever stopped to ask yourself what it is about your business that is truly valuable? When you really think about it, any business with a product or service has something a competitor or…

Read More

risk-takers #2 Terry Fisher — Electronic Countermeasures

By Chesley Brown | July 14, 2020

Have you ever stopped to ask yourself what it is about your business that is truly valuable? When you really think about it, any business with a product or service has something a competitor or adversary could use. And if you’re being honest, you probably haven’t fully considered all the ways they might get their hands on that information. You’ve spent years building your business, but all it takes is one bad day to compromise that dream. In this week’s episode Brent sits down with FBI Special Agent (Ret.) and engineer Terry Fisher to discuss corporate espionage, electronic countermeasures (sweeps), bugging, and the common methods bad actors have used throughout history to gain access to proprietary information.

Read More

The Risk Takers Podcast Series Launches Today!

By Chesley Brown | July 9, 2020

Chesley Brown Launches the Risk Takers Podcast Series Security Risk Management experts Chesley Brown Companies today announced the launch of “The Risk Takers Podcast Series” — a highly bingeable podcast hosted by veteran risk management…

Read More

risk-takers #1 The Aldrich Ames Espionage Case

By Chesley Brown | June 26, 2020

Dell Spry, a former FBI investigator and counterespionage expert, sits down to discuss the biggest case of insider theft in U.S. History: The Aldrich Ames Case. Hear how he, along with the help of the CIA, and the fellow FBI agents used their cunning, hard work, and old fashioned investigative work to capture and convict most infamous CIA officer-turned traitor: Aldrich Hazan “Rick” Ames. Beginning in 1985 the CIA experienced the unparalleled loss of its of Soviet assets, which nearly destroyed the government’s ability to gather intelligence on the Soviet Union. In this interview Mr. Spry discusses his personal involvement in the case as the FBI’s lead investigator including many of the investigative methods they used. Hear never before details about the harrowing investigation to not only investigate and convict the highest ranking government official ever accused of spying, but to protect future Russian assets. In 1991, the quest led them to search for a Soviet spy in the CIA. They came to identify that spy as CIA Case Officer, Aldrich Hazan “Rick” Ames, a long-time CIA case officer and analyst. In February of 1994, Ames was arrested by the FBI and sentenced to life in prison.

Read More

Podcast | Risk Takers Series #1 The Aldrich Ames Espionage Case

By Chesley Brown | June 26, 2020

Dell Spry, a former FBI investigator and counterespionage expert, sits down to discuss the biggest case of insider theft in U.S. History: The Aldrich Ames Case. Hear how he, along with the help of the…

Read More
The 7 Step Guide for Building Business Continuity Plans that Work