What does the SolarWinds attack mean to us?

Topic

New Reply

Heard about the SolarWinds attack and how attackers had access to Microsoft’s source code?  Here’s my views on the SolarWinds attack. I don’t think it
[See the full post at: What does the SolarWinds attack mean to us?]

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

OscarCP

Reply | Quote

Replies

[Alex5723]

An old build of Windows Core ‘Polaris’ has leaked online. This is the previous Core OS for the coming Windows 10X.

An early build of Polaris, a canceled SKU of Windows Core OS, has leaked online. The build is from early 2018, and includes nothing but the bare core OS, meaning there’s no composer (shell) or apps present. Windows Core OS is a modern version of Windows that powers HoloLens 2 and the upcoming Windows 10X, and has been in the works for many years…..

What does the SolarWinds attack mean to us? The attack means to any OS, software, service.. users
that governments, enterprises, service providers…don’t care so don’t invest in enough in security. This attack shouldn’t have happened if proper measures were put in place.

• This reply was modified 4 years, 3 months ago by Alex5723.

1 user thanked author for this post.

Fred

Reply | Quote

Alex5723 wrote:

An old build of Windows Core ‘Polaris’ has leaked online. This is the previous Core OS for the coming Windows 10X.

What makes you think that is in any way connected with the SolarWinds attack?

Reply | Quote

Alex5723 wrote:

This attack shouldn’t have happened if proper measures were put in place.

Yes, and ok. IT changes very fast, so security is always behind, AND not the least: to adminster that uses  very special humonoid abilities, and these people are very hard to find and keeping up to date.

Must I write “cheers” now?

* _ ... _ *

Reply | Quote

Fred wrote:

IT changes very fast, so security is always behind

You can’t justify IT Admins negligence with “fast changes”.
Each update / new version of software should be tested on test servers / test networks which are disconnected from Internet / local network.
Logs should be monitored for abnormal activities, attempts to outside connections…

Reply | Quote

Alex5723 wrote:

Logs should be monitored for abnormal activities

Assuming you have enough time / staff to perform this role.

cheers, Paul

Reply | Quote

Paul T wrote:

Assuming you have enough time / staff to perform this role.

Assuming government and major enterprises should have the stuff needed.

Reply | Quote

Here there is some more information, including more recent one, on this very serious breach into US government and business networks that still has not been fully repaired and might be, in some cases, next to impossible to repair:

https://www.washingtonpost.com/technology/2021/02/09/fireeye-hack-russia-microsoft/

In case people have difficulty reading the article in this paywalled Web site, here is an excerpt:

” Shaked Reiner, an Israeli cybersecurity expert who described the Golden SAML Attack in a 2017 blog post, said the method offers important advantages to hackers — namely its potential to enable unusually wide-ranging, long-lasting and hard-to-detect intrusions that may merit more robust defenses.

The initial blog post, made on the site of his employer, CyberArk Labs, initially generated only modest attention. News of the Russian hack, three years later, changed that. The National Security Agency cited Reiner’s post in its advisory on how to detect such intrusions on Dec. 17.

“Right away, we understood. This is what we were talking about,” Reiner said.

He added that hackers deploying the Golden SAML Attack “can pretty much impersonate any user in a network. … Detecting this type of attack can be extremely difficult.” “

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote