homepage
Open menu

SANS NewsBites

SolarWinds impact broader than first thought: Emergency national webcast

December 15, 2020  |  Volume XXII - Issue #98

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-12-14

SolarWinds: What is Known So Far

Hackers believed to be part of a Russian advanced persistent threat (APT) group managed to infiltrate the SolarWinds software update system and "trojanize" updates sent to customers. The backdoor installed on infected networks waited at least two weeks before contacting command and control systems, which helped the intruders evade detection. FireEye, which was one of the companies targeted, noted the operation's tactics included "some of the best operational security." The threat actors were operating from March until this past weekend, which provided lots of opportunity for information gathering. It will take a while to get a picture of what information the attackers harvested and what they left inside occupied systems. (Please note that the WSJ story is behind a paywall.)

Editor's Note

Jake Williams, a SANS NewsBites editor, and Rob Lee, SANS Curriculum Lead for Forensics and Incident Response, produced an authoritative special webcast last night providing drilldown and advice, available at https://sansurl.com/solarwinds Another excellent analysis has been published on the SANS Internet Storm Center (https://isc.sans.edu/diary/rss/26884). Fireeye and Microsoft have put out very detailed information about the attack and the SolarWinds vulnerabilities, including indicators and detection signatures. Beyond shutting down Solarwinds Orion nodes, review IOC information on the FireEye GitHub repo: https://github.com/fireeye/sunburst_countermeasures. If you are using a Network Management System product other than SolarWinds, it's still important to check the configuration and threat model so you would know if that product had been compromised. Also important to make sure you are checking that all of your suppliers that are/were using SolarWinds are doing the right mitigation and recovery.

John Pescatore
John Pescatore

Having your Network Management system compromised is a worst case scenario, and nothing that should be brushed off with a "We are not important enough to be hit". The options for an attacker are endless, and we have probably not seen most of it yet. PLEASE rebuild affected SolarWinds Orion installs from scratch. Do not just "patch and move on". It is painful to rebuild, but incident response is harder. Change passwords stored in SolarWinds while you are at it (and it isn't easy to find them all). Finally, take published indicators of compromise as a "good start" but don't assume they are complete.

Johannes Ullrich
Johannes Ullrich

2020-12-14

SolarWinds: CISA Order and Mitigations

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive instructing federal civilian agencies to disconnect from SolarWinds systems. Agencies that use SolarWinds products were required to submit a completion report to CISA by mid-day Monday, December 14. Agencies are also ordered to wait for CISA guidance before applying any fixes from SolarWinds.

Editor's Note

CISA also requested that agencies with the capability create a forensic memory image prior to shutdown, as well as identify and shutdown any threat actor created accounts. Also agencies are to block all traffic to and from external hosts where _ANY_ version of SolarWinds Orion was installed.

Lee Neely
Lee Neely

Indicators of compromise are already available; search for them in your network.

William Hugh Murray
William Hugh Murray

2020-12-14

SolarWinds: SEC Filing

In a filing with the US Securities and Exchange Commission (SEC) regarding the compromise of its software update system, Austin, Texas-based SolarWinds said it "has evidence that the vulnerability was inserted within the Orion products and existed in updates released between March and June 2020." The company notified 33,000 customers of the compromise and noted that it "believes the actual number of customers that may have had an installation of the Orion products that contained this vulnerability to be fewer than 18,000."

2020-12-14

SolarWinds: Who is Affected?

A supply chain attack has leveraged compromise of the SolarWinds software update system to infiltrate systems at numerous organizations around the world, including FireEye and the US Treasury, Commerce, and Homeland Security departments. The Register notes "that SolarWinds' Orion is used widely across the British public sector, ranging from the Home Office and Ministry of Defence through NHS hospitals and trusts, right down to local city councils."

Editor's Note

Sadly for them, we are all benefitting from FireEye being an affected customer and not only reporting but also actively sharing information relating to mitigations and recovery. If your network management system (NMS) is _NOT_ SolarWinds, there are a lot of lessons to be learned about securing NMSs, which should be applied to your NMS solution. Examples: make sure that you're not using domain accounts where unneeded, that services can only reach necessary components, including restricting Internet access to only where explicitly needed.

Lee Neely
Lee Neely

Read more in

Reuters: Suspected Russian hackers spied on U.S. Treasury emails - sources

Wired: No One Knows How Deep Russia's Hacking Rampage Goes

KrebsOnSecurity: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

ZDNet: Microsoft, FireEye confirm SolarWinds supply chain attack

Threatpost: DHS Among Those Hit in Sophisticated Cyberattack by Foreign Adversaries - Report

The Register: SolarWinds' 'breached by nation state spies' software is in wide use throughout the British public sector

Ars Technica: Russian hackers hit US government using widespread supply chain attack

FedScoop: SolarWinds' federal footprint is large, and compromise is a 'nightmare scenario' for affected agencies

The Hill: DHS hacked as part of massive cyberattack on federal agencies: report

Duo: Broad Cyber Espionage Campaign Follows Supply Chain Attack on SolarWinds

The Rest of the Week's News

2020-12-14

Prison for Disgruntled Former Cisco Employee

A US district judge in California has sentenced a man to two years in prison for deleting thousands of WebEx accounts. Sudhish Kasaba Ramesh pleaded guilty earlier this year to accessing a protected computer without authorization and recklessly damaging Cisco's network. Ramesh resigned from his position at Cisco in April 2018 after being with the company for 21 months. In September 2018, he accessed Cisco's cloud infrastructure and deleted more than 450 virtual machines hosting the WebEx Teams application, which resulted in the temporary deletion of more than 16,000 WebEx accounts.

Editor's Note

Do not grant privileges that you cannot revoke upon termination. Prefer hardware-token-based strong authentication for all employees. Consider Privileged Access Management systems.

William Hugh Murray
William Hugh Murray

2020-12-11

Fix is Available for Vulnerability in Easy WP SMTP WordPress Plugin

A vulnerability in Easy WP SMTP WordPress plugin is being actively exploited to reset admin account passwords. The plugin is installed in more than 500,000 WordPress sites. An update has been available since Monday, December 7. Users are urged to update to the most recent version of the plugin, Easy WP SMTP 1.4.4.

Editor's Note

The attack leverages both enabled directory indexing on the plugin's folder and that the SMTP plugin is used for emailing password reset links, which could then be intercepted and used nefariously. Beyond updating the plugin, disable directory indexing by adding "Options -Indexes" to the .htaccess file in the site's root directory.

Lee Neely
Lee Neely

WordPress plugins are a never-ending source of vulnerabilities. Don't just patch them. Uninstall as many of them as you can afford to.

Johannes Ullrich
Johannes Ullrich

2020-12-11

Fixes Available for PoS Terminal Vulnerabilities

Manufacturers of two widely-used point-of-sale (PoS) terminals have issued security updates for their products. Researchers found vulnerabilities in Verifone and Ingenico PoS terminals that could be exploited to steal payment card information, clone terminals, and conduct other sorts of financial fraud. The Verifone VX520 and Verifone MX series, and the Ingenico Telium 2 series devices ship with default manufacturer passwords for service modes. The service modes have "undeclared functions" which can be exploited to execute arbitrary code. Ingenico prevents users from changing the default passwords. Both Verifone and Ingenico have released patches.

Editor's Note

Developers appear to be very reluctant to give up control of their products, even after sale, shipment, and installation. They should learn from Apple how to maintain their products without putting their customers and their reputations at risk.

William Hugh Murray
William Hugh Murray

2020-12-14

Google Services Affected by Authentication System Outage

Several Google applications were temporarily unavailable on Monday morning, December 14. The outage was due to an internal storage quota issue with Google's authentication system. The outage affected YouTube, Gmail, and Google Docs. The authentication system outage began about 6:45AM ET; services were restored by 9:00AM ET.

Editor's Note

The root cause was exceeding a quota on their authentication server. The modern federated authentication services used to support Cloud, Legacy and hybrid use cases necessitates active monitoring and response as outages can have an enterprise-wide impact. Even so, consider over-provisioning these services, not only redundant implementations, but also maintaining free storage to handle surges or unexpected events.

Lee Neely
Lee Neely

This is a harsh reminder that most service level agreements do not guarantee levels of availability, they just define levels of available service hours per month below which there will be some granting of fee reduction. Google's Cloud Functions Service Level Agreement (SLA), for example, has a 99.5% monthly availability threshold before any recompense. If there were four 1-hour outages of your services in one billing month, you could file for credits equal to the cost of 3 days of service. Doesn't matter if those 4 hours were every Monday during highest usage time or in the wee hours of the morning when business might be minimally impacted. SLAs do not cover business impact - they really just provide guidance on how much backup/redundancy of critical services you need to plan for.

John Pescatore
John Pescatore

2020-12-14

Norwegian Cruise Link Hit with Cyberattack

Norwegian cruise line Hurtigruten has acknowledged that its systems were hit with a cyberattack over the weekend. The incident appears to have affected the company's global infrastructure. Hurtigruten says it was likely ransomware. The website and email systems are down as of Monday, December 14.

2020-12-14

US CISA-CERT Warns of Vulnerabilities Affecting Medtronic MyCareLink Devices

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert warning of a trio of serious vulnerabilities in some Medtronic MyCareLink medical devices. The flaws could be exploited to modify or fabricate data from certain implanted cardiac devices and remotely execute code to gain control of cardiac devices paired to vulnerable MCL Smart patient Reader devices. Medtronic has developed a firmware update to address the flaws.

Editor's Note

These are home-use devices. Make sure that the mobile app and the mobile device are both kept updated. Further, only connect the Medronic device to your private home network and only use devices from a known trusted source.

Lee Neely
Lee Neely

While these are serious vulnerabilities, they are relatively low risk. They are difficult to monetize or exploit at scale. Thorough mitigation (patching or replacing) trumps urgent.

William Hugh Murray
William Hugh Murray

2020-12-14

US Federal Trade Commission is Looking Into Social Media Company Privacy

The US Federal Trade Commission (FTC) has sent orders to nine social media and video streaming companies, seeking details about "how [they] use, track, estimate, or derive personal and demographic information; how they determine which ads and other content are shown to consumers; whether they apply algorithms or data analytics to personal information; how they measure, promote, and research user engagement; and how their practices affect children and teens." The companies that received the orders must reply within 45 days.

Editor's Note

The FTC won one of the prestigious "Difference Makers" awards back in 2013 for just this kind of enforcement and the staff there has continued to focus on making sure companies live up to their claims of privacy and safety.

John Pescatore
John Pescatore

Internet Storm Center Tech Corner

SolarWinds Followup

https://isc.sans.edu/forums/diary/SolarWinds+Breach+Used+to+Infiltrate+Customer+Networks+Solarigate/26884/

https://sansurl.com/solarwinds


Writing Yara Rules for Fun and Profit: Notes form the FireEye Breach Countermeasures

https://isc.sans.edu/forums/diary/Writing+Yara+Rules+for+Fun+and+Profit+Notes+from+the+FireEye+Breach+Countermeasures/26870/


Flash Player EoL

https://helpx.adobe.com/flash-player/release-note/fp_32_air_32_release_notes.html


Subway Marketing System Hacked to Send TrickBot Malware Emails

https://www.bleepingcomputer.com/news/security/subway-marketing-system-hacked-to-send-trickbot-malware-emails/


Apple Updates Everything

https://support.apple.com/en-us/HT201222


Sophos and Reversing Labs Release 20 Million Malware Samples

https://github.com/sophos-ai/SOREL-20M