Hello, welcome to the Tuesday, December 15th, 2020 edition of the Sandstone Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida.

First of all, sorry for a little hiccup with yesterday's podcast. I re-recorded it to add the Solar Wind story, but apparently the earlier

version actually was made live initially, so some of the early downloaders may have gotten

the version without the Solar Wind's story.

And so let's start with a quick update on Solar Winds. What do we know so far? And

what actually happened there? Well, appears that SolarWinds, the company that makes this

network monitoring system, did get compromise. And as a result, the attacker was able to inject malicious code into a critical

library that is being shipped with Solar Winds or Rhine. And with Fire Eye being one of the victims

and apparently the company that also tipped off solar winds off this compromise.

We do have a great blog post by Fire Eye with plenty of indicators of compromise that you can check.

The compromise apparently did last from March to July of this year and affected our versions 2019.4 through 2020.2.2.1 Hot Fix 1.

If you are using one of the affected versions, then you likely do have the malicious DLL

installed. The big question of course is whether or not

the attacker did take advantage of the malicious DLL. And so far it looks like only very specific

organizations were actually then compromised using the back door that this DLL implemented.

End point protection providers are adding signatures for the respective malicious files,

so you may see some alerts pop up from those systems.

However, they just focus on the actual compromised solar winds install.

They don't necessarily detect any kind of additional matter that was installed just in your

specific organization. So you have to be really careful how you deal with this particular incident.

Effected Solar Winds installs should be considered as compromised, should probably be removed

from the network until you have a chance to closely investigate the particular system.

...