Running SolarWinds Orion? Act today
Some Orion updates from this year contain a backdoor. US agencies were told to disconnect it. Here’s what to do.
On Sunday SolarWinds confirmed that some updates to its Orion monitoring platform, released between March and June this year, contained a backdoor. US agencies were ordered to disconnect or power down Orion immediately. The attack is linked to the FireEye breach announced last week.
If you run Orion:
- Check your version. The affected releases are 2019.4 HF5 through 2020.2.1 HF1.
- Isolate or shut down the Orion server if you run an affected version.
- Upgrade to the fixed release SolarWinds has published, once you’ve checked for compromise.
- Look for connections to the domains in the advisories, and for unusual logins by accounts Orion uses.
- Reset the credentials Orion stored. They had access to much of your network.
This will take weeks to understand fully. Start with the steps above today.