Thread by @KimZetter

New: SolarWinds backdoor infected at least 15 entities in critical infrastructure incl electric/oil/gas/manufacture + 3 managed service providers for crit infr. No evidence hackers used backdoor to enter but may be difficult to tell due to lack of logging theintercept.com/2020/12/24/sol…

Managed service providers can have authorized remote access directly into critical infr + privileges that let them alter network, install software, and control critical operations. This means hackers who breach a provider can potentially use that provider’s credentials and access

“If [provider] has access to a network, and it’s bi-directional, it’s usually for more sensitive equipment like turbine control, and you could actually do disruptive actions," @RobertMLee told me. "But just because you have access...doesn’t mean they can then flip off the lights”

“compromising one [provider], depending on where you compromise them, could lead to access to thousands of organizations,” Lee said. “Two of the … [providers] that have been compromised … have access to hundreds of ICS networks around the world.”

It may not be possible to know if attackers accessed the infected networks and burrowed further into industrial control networks, because critical infrastructure entities often don’t do extensive logging and monitoring of their ICS networks.

“In these ICS networks, most organizations don’t have the data and visibility to actually look for the breach. So they might determine if they are compromised, but … almost none of them have network logs to … determine if there is follow-on activity [in their network].”

.@SpauldingSez, former undersecretary for DHS overseeing critical infrastructure security, also cautions that the intentions of the SolarWinds adversary are still unknown, and even if they breached crit infra networks this isn’t the same as having ability to disrupt or damage.

"I don’t think that we can know that their objective here is reconnaissance for being in a position to potentially disrupt critical infrastructure,” @SpauldingSez says. “I do think that we should always, for planning purposes, assume that and take measures to reduce the damage...

that could be done. But we can’t know that [this is their intention]. And there’s a difference between assuming that for planning purposes and for mitigation, and assuming that for a [U.S. government] response to Russia.”