Solarwinds

Tech 12 Comments

@KimZetter Someone asked me to provide a simple description of what this SolarWinds hack is all about. So for anyone who is confused by the technical details, here’s a thread with a simplified explanation of what happened and what it means.

In a demonstration of corporate integrity, Solarwinds has pulled the page listing their customers.

Oh, and…

12 Replies to “Solarwinds”

  1. Not connected in anyway to the repositioning of 4 US Carrier Fleets off the East and West Coast. Move along.

  2. SolarWinds123??? Our local credit union recently upgraded and there was supposed to be a smith single transition from the old banking system to the new one. But any users who used complicated passwords, especially those who used autogenerated high security passwords could not transfer. Plus when you made you new password, you couldn’t use an autogenerated password because those were too complicated for the new program. Why are some companies such total idiots????

  3. I suspect people got tired of all the typing and shortened it to SW123,or sw123 which is more likely!

  5. Here’s a more detailed explanation c/o Conservative Treehouse. Be sure to check out the comments, then ask yourself if you believe there is no relationship between the Solarwinds breach and the Dominion vote machine fraud?

    Also, she perpetuates the “It was the Russians” misinformation. It’s way more likely Red China.

    https://theconservativetreehouse.com/2020/12/14/the-solarwinds-orion-data-breach-into-federal-and-civilian-organizations-highlights-a-silent-agenda-by-foreign-actors/

    1. Whoa whoa whoa! But we were assured that this was the most secure, safest, most awesomeness election ever in the history of elections. You remember, the guy (fired by Trump) was on 60 minutes and everything. So it must be true.

  6. Regarding the password, that’s not really that big a deal unless they were somehow also storing an unprotected copy of their code signing certificate on the update server. The whole point of code signing is that even if someone manages to distribute tainted binaries, they’ll fail the certification check when someone tries to install them.

    2. Ours are signed nightly during the regular build cycle. Automated and technically blind to who writes the code, as long as it’s in the right place. The certificate we use is well within our “protective circle” and not easily accessible even within it. If someone penetrated our system to do something similar by inserting malicious code into our source files or libraries, it would work if undetected. On the update server, everything is already code-signed, so entry at that point would fail.

  7. So then, Solar Winds was as easy to hack as the DNC server? These types have some odd characteristics in common …

Proudly powered by WordPress & Skyrocket Themes

MENU

Navigation