How to Protect Yourself from the SolarWinds Attack with Greenbone’ Solutions
It was one of the most spectacular cyber attacks of all time: hackers attacked SolarWinds in the fall of 2019 and injected malware into an update of SolarWinds’ Orion platform in the spring of 2020. Customers who installed the compromised version of the network management software got the “SUNBURST” backdoor right out of the box – including numerous U.S. government agencies and large corporations. Well camouflaged, the hackers were able to spy on data unnoticed for a long time. Here you can learn if you are affected by the SolarWinds attack and how you can protect yourself using Greenbone’ solutions.
The cyber criminals have thus pulled off an almost perfect coup. There is an element of irony to the attack since SolarWinds’ customers use the Orion platform to monitor their IT environment for suspicious behavior. The hackers were hiding in plain sight, as it were, and proceeded in a very targeted and extremely sophisticated manner. They first attacked SolarWinds with the specially developed “SUNSPOT” malware. This injected the malicious “SUNBURST” backdoor, also called “Solorigate”, into the “SolarWinds Orion Platform” update product line. The malware was embedded directly into the code where it obtained valid software signatures, making it perfectly camouflaged. With the update compromised, the backdoor could then be distributed to customers undetected.
Undetected for a Long Time
On 12th December 2020, SolarWinds was informed about the incident and launched an investigation. Security firm FireEye, which itself had been infected with the malware, published additional information about the intrusion into its network. According to its research, the cyber criminals had stolen various attack tools from FireEye, which the company use for testing its own customers’ security. Other SolarWinds customers also reported security breaches. In addition, during the investigation of the incident, security researchers found another backdoor that had apparently originated from a second, independent hacker group. The attackers had exploited the previously unknown vulnerability CVE-2020-10148 in the Orion platform to install a malicious web shell called “SUPERNOVA” on targets running the Orion platform. More recently, multiple new vulnerabilities have also been discovered, vulnerabilities that could allow full remote code execution if left unpatched.
In the Greenbone Security Manager, the Appropriate Vulnerability Tests Are Already Integrated
Around 18,000 customers have received the compromised SolarWinds update, making them particularly vulnerable to an attack. However, not all of them have been hacked by cyber criminals through the back door and have tapped into data. The hackers have so far concentrated on particularly attractive, lucrative targets. Are your networks also at risk? As a Greenbone customer, you can find out right away as we integrated corresponding vulnerability tests into the Greenbone Security Manager (GSM) as soon as the incident became known. Our vulnerability scanning will show you whether your IT environment is at risk via “SUNBURST”/”Solorigate” or CVE-2020-10148, making you one of the potential attack targets. In addition, the GSM can check whether you have already fallen victim to “SUPERNOVA”, or the additional malware tools used by the hackers “TEARDROP” or “Raindrop”.
The Situation Is Serious, but There Are Solutions out There
Anyone affected by the vulnerabilities mentioned above should work to close them immediately using the hotfixes and patches SolarWinds has published for them as the unknown hacker group is still active and at large. Only recently, the security firm Malwarebytes announced that it was the victim of a cyber attack. Obviously, the same actors are behind this as in the SolarWinds hack, although Malwarebytes itself does not use SolarWinds software at all. In this instance, the cyber criminals misused applications with privileged access to Office 365 and Azure environments as an attack vector. Fortunately, the damage was reported to be minor and Malwarebytes software was not compromised.
All these incidents have shown that we have reached a new dimension of cyber crime. Actors are carrying out perfectly planned, complex and multi-stage attacks, first hijacking trusted software to then gain access to other more lucrative victims. To ensure such attacks have as few chances as possible to succeed, it is important to identify and close vulnerabilities as soon as possible.
