A review of our current cyber incident response
Summary of the incident
In early 2020, hackers infiltrated SolarWinds, a Texas-based software company, and slipped malicious code into its network management software, Orion. This allowed the hackers to turn a routine software update into a vehicle for a massive cyber attack. When the 18,000 SolarWinds customers that utilized Orion updated their systems in March 2020, they unknowingly created a backdoor. Hackers used this opening to install malware that enabled them to spy on users' networks. Fortune 500 companies, as well as numerous government agencies, were among the organizations breached through SolarWinds. FireEye, a cybersecurity firm, was the first to notice the hack when it realized its systems had been breached.
Investigations
On April 15, 2021, the Biden administration officially attributed the attack to Russia’s Foreign Intelligence Service (SVR) and issued sanctions against Russian technology companies and government officials. The repercussions of the attack and its implications for the cybersecurity of American federal agencies are still being examined.
On April 27, 2021, the New York Department of Financial Services released its report into the SolarWinds attack. It found that the attack's first phase took place around September 2019, when hackers first accessed Orion and tested their ability to insert malicious code into the software. After this initial test run, the hackers inserted the Sunburst malware into Orion on February 20, 2020. Between March and June of that year, SolarWinds disseminated corrupted updates for Orion to its 18,000 Orion customers.
On December 12, 2020, FireEye notified SolarWinds about the existence of Sunburst. SolarWinds responded by issuing patches that removed Sunburst on December 14 and 15. On December 24, SolarWinds announced another vulnerability, Supernova, that was found in version of Orion that had Sunburst and in those that did not.On January 25, 2021, SolarWinds released two more patches that addressed both Sunburst and Supernova.
The New York Department of Financial Services concluded that both vulnerabilities allowed hackers to access an Orion customer's internal network and its non-pubic information. The Department alerted companies about the SolarWinds hack on December 18, 2020, and advised companies to assess the risk to their systems from the SolarWinds attack and instructed its regulated companies to notify DFS, pursuant to its Cybersecurity Regulation, if they were using, or had used, any of the corrupted Orion products.
SentinelOne's Threat Intelligence and Malware Analysis Division, SentinelLabs, published an analysis of Sunburst, the trojanized version of the SolarWinds Orion plug-in that was used as a backdoor in the SolarWinds hack. They discovered that Sunburst waits 12 days before it executes. After the 12-day period, Sunburst looks for a list of processes, services, and drivers before taking action. If the code identifies any of the process on the list, namely monitoring and research tools, Sunburst exists and does not run. If Sunburst identifies any services on the list, it goes into the registry and tries to disable them. The third list contains drivers that, if identified, tell Sunburst to exit before initiating any C2 communication or enabling additional payloads.
On February 23, 2021, the House Committees on Oversight and Reform and Homeland Security held a hearing that included Sudhakar Ramakrishna, CEO of SolarWinds,Kevin Mandia,CEO of FireEye, and Brad Smith, President of Microsoft. That same day, the Senate Intelligence Committee held a hearing on the SolarWinds hack.
Recommendations and Policy Changes
In response to the SolarWinds attack, the Biden administration launched a course for policymakers worldwide on the policy and technical aspects of publicly attributing cyber incidents, which will be inaugurated in 2021 at the George C. Marshall Center in Garmisch, Germany. The administration also instructed the Department of Defense to incorporate additional allies, including the UK, France, Denmark, and Estonia, into the planning for CYBER FLAG 21-1, which is an exercise designed to improve the U.S.' defensive capabilities and resiliency in cyberspace.
The New York Department of Financial Services implored companies to fully access and address third party risk; adopt a "zero trust" approach and implement multiple layers of security; implement a vulnerability management program that prioritizes the organization’s patch testing, validation processes, and deployment – including which systems to patch and in what order they should be patched; and address supply chain compromises in incident response plans.
Government Reports
Private Sector Reports
Bueno, Felipe. “Solarwinds Attack.” June 21, 2021