U.S. Treasury, Commerce Depts. Hacked Through SolarWinds

usa

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts say the incident may be just the first of many such disclosures.

According to a Reuters story, hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury and Commerce departments. Reuters reports the attackers were able to surreptitiously tamper with updates released by SolarWinds for its Orion platform, a suite of network management tools.

In a security advisory, Austin, Texas based SolarWinds acknowledged its systems “experienced a highly sophisticated, manual supply chain attack on SolarWinds Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1, released between March 2020 and June 2020.”

In response to the intrusions at Treasury and Commerce, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) took the unusual step of issuing an emergency directive ordering all federal agencies to immediately disconnect the affected Orion products from their networks.

“Treat all hosts monitored by the SolarWinds Orion monitoring software as compromised by threat actors and assume that further persistence mechanisms have been deployed,” CISA advised.

A blog post by Microsoft says the attackers were able to add malicious code to software updates provided by SolarWinds for Orion users. “This results in the attacker gaining a foothold in the network, which the attacker can use to gain elevated credentials,” Microsoft wrote.

From there, the attackers would be able to forge single sign-on tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts on the network.

“Using highly privileged accounts acquired through the technique above or other means, attackers may add their own credentials to existing application service principals, enabling them to call APIs with the permission assigned to that application,” Microsoft explained.

Malicious code added to an Orion software update may have gone undetected by antivirus software and other security tools on host systems thanks in part to guidance from SolarWinds itself. In this support advisory, SolarWinds says its products may not work properly unless their file directories are exempted from antivirus scans and group policy object restrictions.

The Reuters story quotes several anonymous sources saying the intrusions at the Commerce and Treasury departments could be just the tip of the iceberg. That seems like a fair bet.

SolarWinds says it has over 300,000 customers including:

  • -more than 425 of the U.S. Fortune 500
  • -all ten of the top ten US telecommunications companies
  • -all five branches of the U.S. military
  • -all five of the top five U.S. accounting firms
  • -the Pentagon
  • -the State Department
  • -the National Security Agency
  • -the Department of Justice
  • -The White House.

It’s unclear how many of the customers listed on SolarWinds’ website are users of the affected Orion products. But Reuters reports the supply chain attack on SolarWinds is connected to a broad campaign that also involved the recently disclosed hack at FireEye, wherein hackers gained access to a slew of proprietary tools the company uses to help customers find security weaknesses in their computers and networks.

The compromises at the U.S. federal agencies are thought to date back to earlier this summer, and are being blamed on hackers working for the Russian government.

In its own advisory, FireEye said multiple updates poisoned with a malicious backdoor program were digitally signed with a SolarWinds certificate from March through May 2020, and posted to the SolarWinds update website.

FireEye posits the impact of the hack on SolarWinds is widespread, affecting public and private organizations around the world.

“The victims have included government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East,” the company’s analysts wrote. “We anticipate there are additional victims in other countries and verticals.”

Source: https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/

RSS Latest Press Release

  • Choosing the ‘Bestway’ is the Only Way for All Your Plumbing Needs!
    Forney, TX – Whether it is a leaking tap or the need to urgently clear blocked drains, Bestway Plumbing is the preferred choice for many clients, thanks to their world-class professional services.   Bestway Plumbing has been a central fixture of Forney and the surrounding Dallas County neighborhoods of Heath, Rockwall, Plano, and Frisco since it was […]
  • SharpBunnies Official Website is Now Live, Read Everything About SharpBunnies
    The website of SharpBunnies (NFT) is now live with up-to-date information about the project and other useful details about the project, NFTs, their features and various benefits.Those who are planning to participate in Sharp Bunnies NFT minting are advised to read the details on the website, as we have included many crucial updates as well as a […]
  • European Removal Services – An Experienced Removal Specialist Moves Families and Businesses to and From Europe
    United Kingdom, 14 January 2022: European Removal Services is an experienced removal specialist that moves families and businesses to and from Europe, along with several international destinations. They have more than 30 years of experience in moving families and businesses. They have helped thousands of families and businesses with their removals to Europe and from […]
  • Simply Plumbing & Sewer Offers Comprehensive Solutions to Your Plumbing Issues
    Hempstead, TX – When you have a leak or blocked drains, time is of the essence to achieve a rapid and correct solution. Among the best Cypress plumbers, Simply Plumbing & Sewer is the preferred choice for residential clients because of its exceptional customer service.   Led by its founder Wesley Courville, Simply Plumbing & Sewer […]