Cracking the Sunburst / Solorigate "do not infect" domain hashes, a thread 👉
In their comprehensive analysis of Sunburst / Solorigate, Microsoft highlights an interesting fact: that certain domains are excepted from further infection. microsoft.com/security/blog/…
To quote, "The domain must not contain certain strings; the check for these strings is implemented via hashes, so at this time the domain names that are block-listed are unknown[...] If any of these checks fail, the backdoor terminates"
Actually, @megabeets_ already cracked most of these hashes several days ago, pretty impressive job, btw! We implemented the modified FNV1a 64 algorithm as well and together with @2igosha, we cracked all the remaining ones.
Here's the full list of hashes and their associated domains which are skipped by the backdoor: 
As Itay (@megabeets_ ) also pointed, these are likely internal Solarwinds domain names, potentially associated with local offices or branches around the world.
If you read this thread to the end, then it's a good opportunity to remind that tonight we are going to witness an incredible astronomic event known as the “great conjunction”, Saturn and Jupiter will appear just 0.1 degrees apart, the closest since 1623.
According to @campuscodi this astronomic event may also reveal who was behind the Solarwinds attack. As always, stay tuned :) 😇
• • •
Missing some Tweet in this thread? You can try to
force a refresh
