“Solarwinds123”: Hacked IT Company Used Weak Password, While Backdoor Access Peddled On Underground Forums
Wed, 12/16/2020 – 10:00
Hacked Texas-based IT infrastructure provider SolarWinds was warned over weak password security last year, after security researcher Vinoth Kumar discovered that the company used “solarwinds123” to protect their update server.
“This could have been done by any attacker, easily,” said Kumar, according to Reuters.
On Monday, SolarWinds confirmed that their flagship network management software, Orion, was the target of an international cyberespionage operation which the Washington Post pinned on government-backed Russian hackers – who inserted malicious code into Orion software updates and pushed it out to almost 18,000 customers.
The malicious updates – sent between March and June, when America was hunkering down to weather the first wave of coronavirus infections – was “perfect timing for a perfect storm,” said Kim Peretti, who co-chairs Atlanta-based law firm Alston & Bird’s cybersecurity preparedness and response team.
Assessing the damage would be difficult, she said.
“We may not know the true impact for many months, if not more – if not ever,” she said. –Reuters
Included in the breach were the US Treasury, the Commerce Department’s National Telecommunications and Information Administration (NTIA) and other government agencies.
Meanwhile, Reuters also reports that “multiple criminals have offered to sell access to SolarWinds’ computers through underground forums, according to two researchers who separately had access to those forums.”
One of those offering claimed access over the Exploit forum in 2017 was known as “fxmsp” and is wanted by the FBI “for involvement in several high-profile incidents,” said Mark Arena, chief executive of cybercrime intelligence firm Intel471. Arena informed his company’s clients, which include U.S. law enforcement agencies. –Reuters
According to the report, neither the weak password or the stolen access are considered the most likely source of the current intrusion, however Kyle Hanslovan, the cofounder of Maryland-based cybersecurity company Huntress, noticed days after the SolarWinds hack that malicious updates were still available for download.
On Monday, screenshots began floating around of Dominion Voting Systems with a solarwinds logo below a login screen, implying that the 2020 US election may have been compromised by hackers, as opposed to on purpose as Trump and his allies have claimed.
Dominion Voting Systems uses SolarWinds products and it is still not powered down.
— Ron (@CodeMonkeyZ) December 14, 2020
Journalist Kim Zetter, however, pointed out that while Dominion does or did use a SolarWinds product, it wasn’t their Orion software which was compromised.
To everyone who sent me screenshot of Dominion Voting Systems web site saying it’s proof Dominion was using SolarWinds softwr and was hacked. Dominion was using an FTP software from SolarWinds, not Orion software that was compromised. Pls don’t @ me until you read entire thread https://t.co/mI6AwTkVDD
— Kim Zetter (@KimZetter) December 15, 2020
The company’s stock has fallen over 25% since Friday’s price of $23.50, currently sitting below $18. The company announced on December 9 that CEO Kevin Thompson would be replaced after 11 years at the helm with Sudhakar Ramakrishna, the former CEO of Pulse Secure.