Hacker News Reader

Comment by 1cvmask | Hacker News Reader

It’s nice how they equivocate over the ease of entry and their security policies:

There was another unsettling report about passwords. A security researcher in Bangalore, India, named Vinoth Kumar told NPR that he had found the password to a server with SolarWinds apps and tools on a public message board and the password was: "solarwinds123." Kumar said he sent a message to SolarWinds in November and got an automated response back thanking him for his help and saying the problem had been fixed.

When NPR asked SolarWinds' vice president of security, Brown, about this, he said that the password "had nothing to do with this event at all, it was a password to a FTP site." An FTP site is what you use to transfer files over the Internet. He said the password was shared by an intern and it was "not an account that was linked to our active directory."

View on HN

How a Vp security can ignore a privesc risk like that is pretty inexcusable. Ever vuln falls on a risk mgmt spectrum but that’s a really nonsense answer to give. Weak PW mgmt on a FTP server that you let interns set should raise some areas of interest.

I don't think they ignored it? Says it was addressed. I think it was OK to dispel the implication that the elaborate supply chain attack was allowed in the first place by sloppy pw practices. You don't want that to be the takeaway and then other companies thinking, well our pw management practice is really good so we don't have to worry about being a victim so much

They did ignore it. I think it was over a year actually. I don't feel like looking it up right now but it was also discussed in another submission. Whatever the actual number was it was VERY long.

You don't get this kind of attack because you had an exposed FTP server.

The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal.

They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications.

The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this makes SolarWinds a prime target, one that is worth the efforts taken in this case.

>You don't get this kind of attack because you had an exposed FTP server

This kind of attack needs an entry point, and an exposed FTP server provides the potential for one. Whether it actually was the entry point is a separate matter, willfully ignoring one unlocked door means there's likely to be others.

Initial access is part of the day-to-day these days.

you can't cover all entry points, it's a matter of time for someone to make a mistake. the fact that the adversary showed these extreme levels of proficiency and dedication tells me that the vast majority of companies would have fallen for that. In fact, the backdoor was running for months on targets like Microsoft, gov agencies, security companies like Malwarebytes.

These companies know a thing or two about security.

Today we work with "assume breach" mentality that assumes you are already compromised.

> You don't get this kind of attack because you had an exposed FTP server.

Leaking the extremely weak login credentials to your updateserver, trough a public Github repo, is not exactly a glowing endorsement of how serious security seems to have been taken at Solwarwinds.

With stuff like that being a thing, who knows where else they cut corners/got lazy.

> this makes SolarWinds a prime target, one that is worth the efforts taken in this case.

A prime target, yet apparently could still not be bothered to put in some minimum effort to protect themselves.

> could still not be bothered to put in some minimum effort to protect themselves.

What would have been the minimum effort that would have protected them?

The minimum effort starts at selecting more secure passwords than "company123".

Yeah I mean I’ve read the technical FEYE writeups, and yeah once they had a foothold it got fairly f’ing complex (hope those guys don’t end up in my CI/CD ever, yikes).

That said, foothold for this stuff more often than note comes from keys on public GitHub repos (or things like that: simple misses that are enough to throw the door open).

I hear things like “intern” and “totally unrelated” and it’s the dog whistles of policy/policy enforcement failures of these sorts of initial ways in.

So many sexy hacks start from admin123 passwords unfortunately

The password was in a file that was committed to github IIRC.

I think both the intern that posted the file and the person making that statement both did not realize that someone had given the user write access.. which in my opinion was the actual mistake, not the ftp or the password.

Something to remember is that these sorts of things happen in many organizations.

You should always verify the data you get, be careful with complex supply chains, and avoid binaries you didn't build yourself. Don't skip these things just because "that's the way it's always been done." 10 years ago very little internet traffic was encrypted, security still means progress not the status quo.

> An FTP site is what you use to transfer files over the Internet.

Afaik that was the updatesever and the password originally came from a public Github repo where is was stored in plaintext since at least June 2018 [0]

[0] https://www.theregister.com/2020/12/16/solarwinds_github_pas...

Reply on news.ycombinator.com