SolarWinds Orion Attacked: Corrective Measures
SolarWinds issued an Orion security advisory here, explaining that attack involved Orion builds for versions 2019.4 HF 5 through 2020.2.1, released between March 2020 and June 2020. FireEye is releasing signatures to detect this threat actor and supply chain attack in the wild. The signatures are found on FireEye's public GitHub page.SolarWinds Orion is used mainly by IT professionals to monitor corporate and government networks. It is not part of the SolarWinds MSP toolset -- which is typically used by managed IT services providers (MSPs) to monitor SMB networks. But some MSPs are known to leverage Orion for various monitoring purposes.The potential Orion vulnerability surfaces less than one week after FireEye disclosed that hackers stole FireEye's Red Team penetration testing software. At the time of that disclosure, FireEye expressed concern that the hackers will potentially use the stolen Red Team penetration testing tools to attack additional companies.SolarWinds Orion Vulnerability: CEO Kevin Thompson's Statement
SolarWinds stopped short of saying its Orion software was involved in the Treasury Department hack, but Thompson issued this statement to the news agency:"We are aware of a potential vulnerability which if present is currently believed to be related to updates which were released between March and June 2020 to our Orion monitoring products. We believe that this vulnerability is the result of a highly sophisticated, targeted and manual supply chain attack by a nation state. We are acting in close coordinate with FireEye, the Federal Bureau of Investigation, the intelligence community, and other law enforcement to investigate these matters. As such, we are limited as to what we can share at this time."
"If you’re a SolarWinds customer & use , assume compromise and immediately activate your incident response team. Odds are you’re not affected, as this may be a resource intensive hack. Focus on your Crown Jewels. You can manage this."
