FireEye Fallout Part II: The Plot Thickens
This article was originally published on Jan 26, 2021, written by Sarah King
As more details about the SolarWinds hack are discovered, the story only gets more complicated
This article is the second part of an ongoing story relating to the FireEye and SolarWinds hack that took place in late 2020. Read Part I of this story here.
First, a bit of a refresher. In case you’ve been living under a rock (and really, who could blame you, after the year we’ve had?), here’s what you need to know: in late 2020, the cybersecurity company FireEye announced that it had been compromised through a supply-chain attack (for a fun explanation of what that is, refer back to the first part of this story). FireEye’s offerings are often used in conjunction with Microsoft’s suite of products, and Microsoft confirmed the hack after FireEye announced it. Subsequently, it was determined that FireEye’s compromise was actually part of a much larger hack of the cybersecurity company SolarWinds, specifically their IT performance software, Orion.
As it turns out, SolarWinds Orion was being utilized by hundreds of high-profile companies (think Fortune 500, because most of them were), as well as large and important branches of, yes that’s right the U.S. government.
As the story continues to unfold, information about the SolarWinds hack is slowly dribbling out, and we are getting an incrementally clearer picture of the implications of this attack.
The biggest question that is ringing in everyone’s mind is “who did this?”
While at first, experts were tentative to name Russia as the source of the attack (opting instead for the generic “nation state”), security researchers have since found it more than likely that the attack came from Russia. Digital forensics appear to point specifically to APT29, also known as CozyBear, a hacking team with ties to the Russian government.
Security experts have given the malware that breached SolarWinds Orion the name Sunburst (har dee har har), and on Monday, researchers at Kaspersky Labs reported that Sunbursts’s code was “curiously” similar Kuzuar, a piece of malware that first came to light in 2017 and has links to Turla, one of the world’s most advanced hacking groups, whose members speak fluent Russian.
Kaspersky Labs researchers pointed to three (at least) similarities they found between Sunburst and Kuzuar:
- The algorithm they used to generate the unique victim identifiers;
- The algorithm they used to make the malware “sleep” on the infected network (aka a delayed reaction, which is a common ploy for APTs);
- Extensive use of the FNV-1a hashing algorithm to obfuscate malicious code.
Although most authorities have named SolarWinds software as the initial way hackers gained access to all of these servers, the New York Times recently reported that investigators are examining the role another software, JetBrains, may have played.
JetBrains was founded in the Czech Republic by Russian engineers, and has research labs located in Russia. Officials are looking into whether JetBrains was breached and then used as a pathway for hackers to insert backdoors into the software of countless tech companies.
Get Kalpitha S’s stories in your inbox
Join Medium for free to get updates from this writer.
The JetBrains software that investigators are focusing on is TeamCity, a software that helps developers test and exchange software code before releasing it.
“By compromising TeamCity, or exploiting gaps in how customers use the tool, cybersecurity experts say the Russian hackers could have inconspicuously planted back doors in an untold number of JetBrains’ clients,” who include no less than 79 of the Fortune 100.
On the home front, the Department of Homeland Security has released information regarding the extent of the SolarWinds breach. In an advisory published Friday, January 8, 2021, the DHS outlined the attack patterns of the hackers in question. For weeks, cybersecurity experts have been insisting that the most likely attack pattern was hackers posing as legitimate users and utilizing and abusing real credentials to gain access to government systems. Now, the DHS has confirmed it:
“First, the attackers gained initial access to a victim by taking advantage of the previously disclosed SolarWinds vulnerability or through other methods, such as password guessing…Next, the attackers sought to impersonate one or more real users in order to access an organization’s cloud services and identity management provider…”
Identity management providers, like Azure Active Directory, are often described as holding the “keys to the kingdom.” Many enterprises use identity management providers to create and manage network accounts, passwords, and privileges. When hackers gain access to such a service, there’s no telling the extent of the havoc they can wreak.
Experts point to this latest link in the SolarWinds chain of attack as an indication of the hackers’ sophistication. Things like multi-factor authentication and complex password management tools are not easy things to compromise (duh) but the SolarWinds hackers managed to compromise it all.
As we stated in Part I of this story, the only thing we know about this ongoing crisis it that we hardly know anything. We’re chipping away at the iceberg, continuing to discover more breaches, more threads in the web, and more damage to both security and trust.
One example of this loss of trust in software is the Federal Court’s move to ban e-filing of important documents. The U.S. Courts late last week posted new protocols in response to the recent SolarWinds data breach:
“Under the new procedures announced today, highly sensitive court documents (HSDs) filed with federal courts will be accepted for filing in paper form or via a secure electronic device, such as a thumb drive, and stored in a secure stand-alone computer system. These sealed HSDs will not be uploaded to CM/ECF.” (Case Management and Electronic Case Filing systems, respectively). This latest turn by the Federal Governments is but an example of how quickly trust has been lost in cybersecurity due to the SolarWinds hack.
This newest move by the federal court system also hints to what people are already starting to believe: that the federal judiciary was likely compromised in the SolarWinds hack.
This breach, which experts warn started much earlier than initially believed, could be the biggest security breach of United States networks in history. What this means for the future of cybersecurity, as well as geopolitical relations, remains to be seen.
If you suspect that you or your business has been compromised in the SolarWind hack, our business intelligence advisors at Gartner suggest a three-pronged course:
- Determine if you are currently running any of the affected versions of SolarWinds Orion software (how? compare installed versions to infected versions — 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF1.)
- Start the forensics process of determining whether you were compromised by leveraging internal or external investigative resource;
- Determine if it will be necessary to put a temporary replacement in during the forensic process by identifying the impact of not having SolarWinds Orion available during the remediation process.
As this thrilling, yet unnerving cyber-drama continues to unfold, we at DefenseArk want to keep you informed, as well as protected. While this is a developing story, we are already beginning to see the potential fallout of such a massive cyber attack, and, as an antivirus network ourselves, we know that it is our professional duty to stay ahead of this story. Likewise, we want to make sure that our users are equally well-equipped to deal with such nerve-wracking situations, which is why our products have been designed on a decentralized global network, to identify potential digital threats before they materialize on your system.
For more information on how DefenseArk can protect your system — from the home user to scalable enterprise solutions — please visit our website at https://www.defenseark.com/
