Okay folks, let’s talk about SolarWinds.
For those not familiar with it, SolarWinds is a network management system (NMS). It’s probably the most ubiquitous NMS out there, so we shouldn’t jump to conclusions that FireEye and Treasury were both breached by an SolarWinds vuln. 1/
For those not familiar with it, SolarWinds is a network management system (NMS). It’s probably the most ubiquitous NMS out there, so we shouldn’t jump to conclusions that FireEye and Treasury were both breached by an SolarWinds vuln. 1/
That would be an illusory correlation. If you’re jumping to that conclusion (or that FireEye and Treasury use a common MSP), at least be clear that you’re guessing.
It’s a lot like the DC Sniper case where we focused on white vans. SolarWinds (like white vans) is everywhere 2/
It’s a lot like the DC Sniper case where we focused on white vans. SolarWinds (like white vans) is everywhere 2/
NMS are excellent targets. They have access to most (often all) systems on the network, so outbound IP ACLs are not a useful control. Netflow usually doesn’t help either since the NMS not only has access to everything, but it’s also talking A LOT. 3/
NMS are usually used to monitor network devices and critical servers. If you’ve ever seen a network map with devices shown as green/yellow/red, that was probably built by an NMS.
How does the NMS generate the map? Sometimes it’s as simple as a ping command. 4/
How does the NMS generate the map? Sometimes it’s as simple as a ping command. 4/
More often, the NMS uses SNMP (network management protocol) or an installed agent to learn the status of remote devices.
Now they’re called network MANAGEMENT systems for a reason: in addition to status, they can modify configuration, restart services, etc. 5/
Now they’re called network MANAGEMENT systems for a reason: in addition to status, they can modify configuration, restart services, etc. 5/
Not all NMS are able to change anything, and those that can don’t always allow it for all systems on the network.
The bad news is that the most critical systems are also those most likely to have change access through NMS configured. This isn’t a failure in security modeling. 6/
The bad news is that the most critical systems are also those most likely to have change access through NMS configured. This isn’t a failure in security modeling. 6/
Recall that security also includes availability (CIA triad). The more critical the system, the more likely it is that you want to ensure the availability of it.
NMS ensures availability by monitoring for things like services becoming unresponsive and restarting them. 7/
NMS ensures availability by monitoring for things like services becoming unresponsive and restarting them. 7/
This all happens before an admin even notices the service had an issue.
Even when the NMS is in monitor-only mode, it can still be used to read configurations, which often include enough information for attackers to laterally move to those systems. 8/
Even when the NMS is in monitor-only mode, it can still be used to read configurations, which often include enough information for attackers to laterally move to those systems. 8/
So suppose you have a SolarWinds NMS installed. Should you pull it offline? Not at all.
What should you do? Check log retention and archive whatever you have. I expect we’ll see specific IOCs for SW within a few weeks. You want data for eventual threat hunting. 9/
What should you do? Check log retention and archive whatever you have. I expect we’ll see specific IOCs for SW within a few weeks. You want data for eventual threat hunting. 9/
Regardless of which NMS you use, you should absolutely lock down access to the admin interfaces using access control lists.
Consider monitoring and alerting on any attempted access to the admin interface as well. 10/
Consider monitoring and alerting on any attempted access to the admin interface as well. 10/
If you have East/West netflow, consider doing some analysis of NMS traffic and looking for outliers. That won’t be easy in most cases.
I’ll close by reiterating that hitting an NMS like SolarWinds often gives attackers keys to the kingdom. It’s like domain admin++. 11/
I’ll close by reiterating that hitting an NMS like SolarWinds often gives attackers keys to the kingdom. It’s like domain admin++. 11/
But that doesn’t mean you get rid of your NMS. You just need to threat model routes to target your NMS and monitor the heck out of those.
You should probably also revisit the systems managed by the NMS and model whether the juice is worth the squeeze (it usually is). 12/
You should probably also revisit the systems managed by the NMS and model whether the juice is worth the squeeze (it usually is). 12/
However, in most orgs the NMS is configured by ops (who maximize availability) vs security (who usually maximize confidentiality). Do some threat modeling.
TL;DR - Don’t throw out the baby with the bathwater or you’ll likely be flapping in the (Solar)Wind... /FIN
TL;DR - Don’t throw out the baby with the bathwater or you’ll likely be flapping in the (Solar)Wind... /FIN
This thread brought to you by Cypher, who was a good boi and let me type this on our night walk. 
Okay, SolarWinds had a vuln.
That doesn’t change any of my recommendations. Regardless of which NMS you use, my recommendations stand. Threat model, log, and alert around your NMS. /FIN2
That doesn’t change any of my recommendations. Regardless of which NMS you use, my recommendations stand. Threat model, log, and alert around your NMS. /FIN2
https://twitter.com/razhael/status/1338267165221396480
That didn't age well...
https://twitter.com/MalwareJake/status/1338299323948421121?s=20
Okay, so everything I said about NMS stands. But since it's now apparent that there was a supply chain compromise, you should run (not walk) to start investigating your systems. It's unlikely this was used to compromise just a few networks. 13?/
https://twitter.com/MalwareJake/status/1338299323948421121?s=20
But it also probably wasn't used to target every network where SolarWinds is installed. Attackers realized what a sensitive access this was. They know that every time they use it, they risk detection. I suspect they were very choosy about where to deploy. 14/
But if the attackers knew this access was coming to an end, they likely would stop being choosy about where to install beachhead access.
That's the big unknown for me. When did the attackers learn that they were losing access and what did they do? 15/
That's the big unknown for me. When did the attackers learn that they were losing access and what did they do? 15/
Many (most?) organizations slow roll their incident responses and telegraph an investigation. If that happened here, then it's possible that the attackers moved aggressively to use their soon-to-be-gone access to target lots of orgs. 16/
But even if attackers said "let's get all the beachhead access we can right now," that's just beachhead access. If attackers went full-bore, they won't have resources to work all those accesses yet. Use their resourcing issues to your advantage and hunt now. /FIN3?
• • •
Missing some Tweet in this thread? You can try to
force a refresh
