BREAKING 🔥
New evidence suggests #SolarWinds hackers likely compromised the software build infrastructure of Orion platform & added malicious code, which was then eventually delivered within new updates that the company compiled, signed, and delivered.
thehackernews.com/2020/12/new-ev…
New evidence suggests #SolarWinds hackers likely compromised the software build infrastructure of Orion platform & added malicious code, which was then eventually delivered within new updates that the company compiled, signed, and delivered.
thehackernews.com/2020/12/new-ev…
SolarWinds attackers mimic the software developers' coding style and naming standards to blend in their malicious code with the rest of the code.
Although first version containing the backdoor was traced to 2019.4.5200.9083, new report says version 2019.4.5200.8890, from October 2019, included an empty .NET class that attackers added to verify if their modifications to the codebase were being delivered into new updates. 
While it's not immediately clear how the attackers got access to the code base, Vinoth Kumar's disclosure about SolarWinds' update server being accessible with the password "solarwinds123" assumes new significance given the overlap in timelines.
https://twitter.com/vinodsparrow/status/1338431183588188160
In a separate development, a security researcher decoded the DGA domain names and disclosed at least 4000 domains suspected to be attacked in the #SolarWinds hack—including #Intel, #NVIDIA, Kent State University, and Iowa State University.
https://twitter.com/0xrb/status/1339199268146442241
To make matters worse:
Malicious code may have gone unnoticed on targeted systems because #SolarWinds' own support advisory suggests customers to exempt its software's directories from #antivirus scans to work properly.
Details: thehackernews.com/2020/12/new-ev…
#infosec #cybersecurity
Malicious code may have gone unnoticed on targeted systems because #SolarWinds' own support advisory suggests customers to exempt its software's directories from #antivirus scans to work properly.
Details: thehackernews.com/2020/12/new-ev…
#infosec #cybersecurity
• • •
Missing some Tweet in this thread? You can try to
force a refresh
