{"id":19837,"date":"2020-12-21T10:07:56","date_gmt":"2020-12-21T06:07:56","guid":{"rendered":"https:\/\/techxmedia.com\/?p=19837"},"modified":"2020-12-24T11:55:02","modified_gmt":"2020-12-24T07:55:02","slug":"intrusion-33-solarwinds-unleashes-a-cyber-storm","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/intrusion-33-solarwinds-unleashes-a-cyber-storm\/","title":{"rendered":"Intrusion #33 SolarWinds unleashes a cyber storm"},"content":{"rendered":"\n

Welcome to the latest edition of Pardon The Intrusion, TNW\u2019s bi-weekly newsletter<\/a> in which we explore the wild world of security.<\/p>\n\n\n\n

Earlier this week, several major US government<\/a> agencies \u2014 including the Departments of Homeland Security, Commerce, Treasury, and State \u2014 discovered that their digital systems\u00a0had been breached<\/a>\u00a0by hackers in what\u2019s fast turning out to be a highly sophisticated supply chain attack.<\/p>\n\n\n\n

Such attacks often work by first compromising a third-party vendor with a connection to the true target.<\/p>\n\n\n\n

Infiltrating a third-party provider that has access to their customers\u2019 networks also vastly increases the scale of an attack, as a successful break-in opens up access to all those businesses that rely on it, making them all vulnerable at once.<\/p>\n\n\n\n

In this case, the attackers turned out to SolarWinds, a Texas-based IT infrastructure provider, to inject malicious code into its monitoring tool that was then pushed to nearly 18,000 of its customers as software updates.<\/p>\n\n\n\n

\"\"\/<\/figure><\/div>\n\n\n\n

SolarWinds counts several US federal agencies and Fortune 500 firms among its clients.<\/p>\n\n\n\n

According to cybersecurity firm FireEye, which also appears to have been a victim of the same attack<\/a>, called it a meticulously planned<\/a> espionage campaign that may have been ongoing at least since March 2020.<\/p>\n\n\n\n

Although there hasn\u2019t been any concrete evidence tying the attacks to a specific threat actor, multiple<\/a> media<\/a> reports have pinned the intrusions on APT29 (aka Cozy Bear), a hacker group associated with Russia\u2019s foreign intelligence service.<\/p>\n\n\n\n

It may take months to fully understand the breadth and depth of the hack, but the SolarWinds incident once again highlights the severe consequences of compromising a supply chain.<\/p>\n\n\n\n

Of course, supply chain attacks have happened<\/a> before<\/a>. What\u2019s more concerning here is how little has been done since then to prevent them from happening again.<\/p>\n\n\n\n

What\u2019s trending in security?<\/h3>\n\n\n\n

Signal added support for encrypted group calls<\/a>, the Zodiac Killer cipher was cracked<\/a> after 51 long years, and a former Cisco engineer was sentenced to 24 months in prison for deleting 16,000 Webex accounts<\/a> without authorization.<\/p>\n\n\n\n