Submit Your Work

Support the
Free-Press

English | Hindi | Urdu

Bring the
World Closer

Privacy and Surveillance

Wednesday, January 13, 2021

SolarWinds Attack and its implication for U.S. Security: Sabotage or espionage?

This article is by

Vaishnavi Krishna Mohan

Share this article

Download as PDF

Cite this Article

Article Contributor(s)

Vaishnavi Krishna Mohan

Article Title

SolarWinds Attack and its implication for U.S. Security: Sabotage or espionage?

Publisher

Global Views 360

Publication Date

January 13, 2021

URL

SolarWinds office in Texas

SolarWinds office in Texas | Source: Glassdoor

SolarWinds, a publicly listed Texas-based company with a value of more than $6 billion, has a very reputed customer list including multiple U.S. government agencies. The company develops softwares for businesses and agencies to help manage and monitor their networks, systems and IT infrastructure. The company is a service provider to over 425 of the Fortune 500 companies, top 5 U.S. accounting firms, all major U.S. telecom providers, the U.S. treasury, several global universities and educational institutions, the NSA and the White House.

A set of hackers managed to sneak a malicious code into the software update of SolarWinds for a tool called “Orion”. Earlier, in 2020, the hackers had injected malware into the updates of Orion which were released between March and June of 2020. On 5th of Jan, 2021, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure security Agency (CISA), the Office of the director of National Intelligence (ODNI) and the National Security Agency (NSA) made an official joint statement stating, "an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks". U.S. government agencies like The Pentagon, National institute of Health, FBI, DHS, the Department of Energy and the Department of Veterans affairs were some significant users of Orion. In fact, in August 2020, the Department of Veterans affairs renewed its Orion license in a 2.8-million-dollar order. The Department of Veterans affairs has been heavily involved in COVID-19 relief.

The Orion hack began as early as March 2020. Over 18,000 customers had installed the compromised software which implies that these customers were vulnerable to spy operations throughout 2020. The malware inserted in the updates provided remote access of an organization’s network to the elite hackers. Since the malware was undetected for months, it gave the hackers an opportunity to obtain information from their targets. In fact, the hackers could also monitor emails and other internal communications. FireEye, the cybersecurity company who were the first to discover the breach describes the capability of the malware, from initially lying dormant up to two weeks, to hiding in plain sight by masquerading its investigation as “Orion Activity”. In 2016, Russian Military hackers used a method called “supply chain” to infect companies performing business in Ukraine with a hard-drive wiping virus called NotPetya. This attack is considered to be one of the most damaging cyber-attacks till date. The infiltration tactic used in the current hack is also identified to be similar to the “supply chain” method.

The Orion software framework contained a backdoor that communicated via HTTP to third party servers. Cybersecurity firm, FireEye has been tracking the trojanized version of Orion plug-in as SUNBURST.

FireEye Logo

FireEye described the use of SUNBURST backdoor on one of its blogs published on 13th December 2020. It stated,

“After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.”

FireEye described the attack through the SUNBURST backdoor as “highly evasive”. Meanwhile, SolarWinds is facing a class action lawsuit filed by a stakeholder of the IT Infrastructure Management software company in the U.S. District Court for the Western District of Texas on 4th Jan 2021. The lawsuit is filed against SolarWinds’ ex-president, Kevin Thompson and chief financial officer, J. Barton Kalsu on the grounds of violating Federal Securities laws under Securities Exchange Act of 1934. The complaint states that SolarWinds Company failed to disclose that "since mid-2020, Orion monitoring products had a vulnerability that allowed hackers to compromise the server upon which the products ran". The complaint also mentioned that SolarWinds update server had a fairly weak and easily accessible password, ‘solarwinds123’.

Microsoft’s internal security research team found evidence that the same hackers had accessed some internal source code in their company’s systems. Microsoft mentioned that the attempted activities were beyond just the presence of malware SolarWinds code in their environment. Microsoft has “an open source like culture” which allows teams within Microsoft to view the source code. The company acknowledges that it is a threat model but they are downplaying the risk by saying “just viewing the source code should not cause any elevated risk”.

The Russian Hackers have also managed to breach the network of Austin City, Texas. The breach dates back to at-least mid of October 2020. The hackers have seemed to target the U.S. Treasury, Departments of Commerce and Homeland Security, The Pentagon, Cybersecurity firm FireEye, and SolarWinds. The breach of the network of the Austin city is an apparent win for Russian hackers. Theoretically, the compromise could have helped them access sensitive information in accordance with the city governance, elections, city police and by excavating deeper, the hackers can practically burrow inside energy, water and airport networks of the city.

Berserk Bear, the hacking outfit that is currently believed to be behind Austin’s breach appears to have used Austin’s network as grounds to stage larger attacks. Berserk Bear also known as BROMINE inter alia several names is believed to have been responsible for a series of breaches of significant U.S. infrastructures in the past year.

The attacks on SolarWinds, U.S. government and FireEye have been linked to another Russian group called APT29 also popularly known as Cozy Bear. Berserk Bear is allegedly a unit of Russian federal Security Service (FSB). Cozy Bear is known to be affiliated with the Russian Foreign Intelligence Service, or SVR. FSB and SVR are considered to be successors of the Committee of State Security of the Soviet-era which was widely known as the KGB.

The Austin Council seems to have been aware of the breach from October 2020. The FBI and CISA had published an initial advisory warning of “advanced persistent threat actors” (APTs) on October 9th, 2020. The advisory warned the city council of APTs targeting state and local governments. On October 22nd, a follow-up advisory was published in which both agencies accredited the breach to Berserk Bear. CISA published a heat map listing the types of organizations that were breached, scanned or targeted by Berserk Bear. The reputation of Berserk Bear of lurking fit their common pattern of espionage-oriented attacks. Sami Ruohonen, a researcher at Finnish cybersecurity firm F-Secure said that the adversaries have already been in the network for more than a couple of months before someone discovers their existence. Ruohonen also mentioned that this technique is specially preferred by APT groups because, the longer they go unnoticed, the longer they have a remote access to the network. F-Secure, in a report published in 2019, compared Berserk Bear and similar groups to the cyber equivalent of sleeper cells.

The cybersecurity experts have warned Austin city and the U.S that Berserk Bear hackers are not just involved in espionage and sabotage. They can gear up at any moment and create havoc in the United States. These Russian Hackers can cause city blackouts, disturbance in water supply and can even disrupt COVID-19 relief. Vikram Thakur, a technical director at Symantec who has tracked Berserk Bear for years quotes, “We should be cognizant of the level of information that they have, turning on valves or closing valves, things of that sort — they have the expertise to do it.”

Kevin Thomson, the ex-CEO of SolarWinds | Source: SolarWinds Facebook

SolarWinds replaced their ex-CEO Kevin Thomson with Mr Sudhakar Ramakrishnan. Unlike his predecessor Thomson, who is an accountant by training, Ramakrishnan comes from a security background having led Pulse Secure in the recent past. The new CEO publicly stated that the company will be making 5 critical changes to put security front and center. The company also hired ex-CISA chief Chris Krebs and Facebook’s former security lead, Alex Stamos. Krebs and Stamos work as independent consultants to help the company coordinate its crisis response. Krebs told the Financial Times that it could even take years to uncover the full extent of the hack. On the brighter side, the new CEO mentioned that the company has engaged several cybersecurity experts to assist SolarWinds in its efforts to become more secure. We can hope that, with better expertise, vision and understanding of threat and vulnerability management, the company is now headed towards a better future.

Support us to bring the world closer

To keep our content accessible we don't charge anything from our readers and rely on donations to continue working. Your support is critical in keeping Global Views 360 independent and helps us to present a well-rounded world view on different international issues for you. Every contribution, however big or small, is valuable for us to keep on delivering in future as well.

Share this article

Read More

February 13, 2021 8:54 PM

Black Lives Matter: Looking back at the journey of racial justice movement as a Nobel Peace Prize Nominee

The killing of George Floyd by a police officer in the state of Minnesota, has confronted the people of the United States in particular and the Western World in general about the existence of deep-rooted racism which has remained even after the Civil Rights movement and many decades of progress.

The years of racial discrimination led to the emergence of the Black Lives Matter (often abbreviated as BLM) movement. The BLM movement has been nominated for the 2021 Nobel peace prize as well.

This article explains the BLM movement, it's nomination for the Nobel Peace Prize as well as its symbolics importance in the lives of the black people. In other words, it looks back at the journey of this racial justice movement as a Nobel Peace Prize Nominee.

What is the Black Lives Matter movement?

The BLM movement started in 2013 after George Zimmerman—a white man—shot dead—black teen—Trayvon Martin—to death in 2012. The term “Black Lives Matter” was taken from the tweet of a woman named Alicia Garza, which turned into a trending hashtag and later into the name of the whole movement, co-founded by herself, Patrisse Cullors, and Opal Tometi.

The movement aims at equality and racial justice for Black people and highlights the injustices and oppression against them.

Furthermore, there is also strong resistance from the police and usage of military weapons against the black protestors as compared to the white ones, a kind of systematic racism which was clearly visible during the Storming of the Capitol Hill.

When a black person named George Floyd was killed by a white police officer in Minnesota on 25 May last year, the movement gained momentum and there were solidarity protests not only in America, around the globe—including countries like the UK, France, Australia and Germany. There were even violent protests in some parts of the US, and in some places the right wing groups clashed with these protestors.

The Movement Growing Profusely

A pro-right wing ruling government, where the President himself was criticised for being racist on several occasions and the upcoming elections led to increasing dissent—furthering the growth of the movement. George Floyd became the face of the movement along with many other black people who lost their lives before due to systematic racism—some names in the unfortunately endless list were Breonna Taylor, Ahmaud Arbery, . The movement also started getting the support of Hollywood celebrities, who supported the movement on their social media handles.

Amidst of all this, a similar killing of yet another black person, named Jacob Blake happened, which sparked the protests further.

“The group has called for defunding the police for at least five years”, Black Lives Matter Los Angeles co-founder Melina Abdullah told CNN. Some of the protestors believe that defunding the police could decrease such incidents.

In June, after pressure from BLMLA and massive protests, the Los Angeles City council unanimously approved a measure to develop an unarmed model of crisis response that would replace police officers with community-based responders for nonviolent calls.

Corrine Basabe, a black woman, started the George Floyd Justice Billboard Committee. Because of that, there are also billboards in cities like Los Angeles, New York and Washington DC, which are made for people to see regarding the Black Lives Matter movement and the killing of George Floyd. This way, many people driving through the roads could be reminded of what happened.

Featuring an oil painting by New York City artist Donald Perlis, a white, the billboards also include a quote from the Rev. Martin Luther King Jr.: "Injustice anywhere is a threat to justice everywhere." His painting was also displayed in New York’s Times Square.

When asked what she hopes for BLM's future, co-founder Patrisse Cullors said she knows the movement will win. "I know this because our work is full of love, healing and dignity," she said. "And we centre Black people's humanity and life over our death and decimation."

Backlash

The movement faced backlash from various right-wing groups like The American Patriot and Proud Boys. There was a slogan “All Lives Matter” from the Anti-BLM protestors, which minimises the problems faced by the black community in their daily lives. The then President Donald Trump also refused to condemn the right-wing groups and he defended the police instead of supporting the Black people’s cause.

In Arizona, Rep. Walt Blackman, a Black GOP member of the Arizona Legislature labelled BLM as a “terrorist organisation” in an interview with Fox News Radio affiliate KFYI.

There are a lot of post-truth narratives defaming the BLM movement.

Nomination for Nobel Peace Prize

As mentioned earlier, the BLM movement has been nominated for the 2021 Nobel peace prize, for the way they spread and called for a systematic change in the world, through non-violent protests. It has been nominated by a Norwegian MP.

In his nomination papers, the Norwegian MP Petter Eide said the movement had forced countries outside the US to tackle racism within their own societies.

“I find that one of the key challenges we have seen in America, but also in Europe and Asia, is the kind of increasing conflict based on inequality,” Eide said. “Black Lives Matter has become a very important worldwide movement to fight racial injustice. They have had a tremendous achievement in raising global awareness and consciousness about racial injustice.”

He said that one other thing that impressed him about the BLM movement was the way “they have been able to mobilise people from all groups of society, not just African-Americans, not just oppressed people, it has been a broad movement, in a way which has been different from their predecessors.” He has previously nominated human rights activists from Russia and China for the prize.

His written nomination concludes: “Awarding the peace prize to Black Lives Matter, as the strongest global force against racial injustice, will send a powerful message that peace is founded on equality, solidarity and human rights, and that all countries must respect those basic principles.”

Nominations for the Nobel peace prize are accepted from any politician serving at a national level, and they are allowed only 2,000 words to state their reasons. This year’s deadline was February 1, and the committee prepares a shortlist by the end of March. The winner is chosen in October and the award ceremony is scheduled for 10 December. The World Food Programme was the winner last year.

The movement deserves the nomination, and if it is declared the winner of the Nobel Peace Prize, then it’s going to be a huge win for the Black people and will give a push towards an ideal where there will be no racism.