SolarWinds: when the update is the attack
Trojanised Orion updates reached thousands of networks. What to check if you run it, and what it means for everyone else.
The biggest security story of the holidays: attackers broke into SolarWinds’ build system and slipped a backdoor into updates for its Orion monitoring software, shipped between March and June 2020. Around 18,000 customers installed them. A much smaller number, including US government agencies and big tech companies, were then targeted further.
If you run Orion:
- Follow the SolarWinds and CISA guidance, and update to the clean versions.
- Check whether the affected versions ever ran, and whether the server talked to the domains listed in the advisories.
- If it did, assume the network is compromised, starting with your identity systems.
For everyone else, the lesson is uncomfortable. Monitoring and management tools have admin rights everywhere. So:
- Limit where they can reach, including the internet. A monitoring server rarely needs to browse the web.
- Watch their behaviour, not just their files.
- Know which vendors push code into your core systems.