Anatomy of the SolarWinds Hack: Who What Where When How

Feb 1, 2021

Join Joel de la Garza, a former CISO and current a16z operating partner for security, and Steven Adair, founder of Volexity, as they delve into the massive SolarWinds hack. They unravel the art of cyber espionage, discussing the sophisticated tactics used by attackers and the extensive supply chain vulnerabilities. The conversation highlights critical security oversights, the importance of proactive measures, and strategies for navigating third-party risks. Ultimately, they emphasize that cybersecurity must be integral to business operations, not just an afterthought.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

ANECDOTE

Initial Infiltration Test

The SolarWinds attackers first tested their ability to modify the software in late 2019.
This test involved non-malicious changes to confirm their access and went undetected.

INSIGHT

Malware Terminology

Avoiding common malware terms is not sophistication but a basic evasion tactic.
Attackers use tools to check their code for detectability before deploying.

INSIGHT

Expired Domains Tactic

The SolarWinds attackers showed patience and stealth by using expired domains for command and control.
These domains had a history, making them less suspicious, indicating long-term planning.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

In this special “3x”-long episode of our (otherwise shortform) news analysis show 16 Minutes -- past such 2-3X explainer episodes have covered section 230, Tiktok, GPT-3, the opioid crisis, more -- we cover the SolarWinds hack, one of the largest (if not the largest!) publicly known hacks of all time... and the ripple effects are only now starting to be revealed. Just this week, the U.S. Cybersecurity and Infrastructure Security Agency shared (as reported in the Wall Street Journal) that approximately 30% of both private-sector and government victims linked to the hack had no direct connection to SolarWinds. So who was compromised, do they even know, can they even know?!

Because this hack is a supply-chain compromise involving various third-party software and services all connected together in a "chain of chains", the knock-on effects of it will be revealed (or not!) for years to come. So what do companies -- whether large enterprise, mid-sized startup, or small business -- do? What actually happened, and when does the timeline really begin? While first publicly revealed in December 2020 -- we first covered the news in episode #49 here when it first broke, and there have been countless headlines since (about early known government agency victims, company investigations, other tool investigations, debates over who and how and so on) -- the hack actually began not just a few months but years earlier, involving early tests, legit domains, and a very long game.

We help cut through the headline fatigue of it all, tease apart what's hype/ what's real, and do an "anatomy of a hack" step-by-step teardown -- the who, what, where, when, how; from the chess moves to technical details -- in an in-depth yet accessible way with Sonal Chokshi in conversation with a16z expert and former CSO Joel de la Garza and outside expert Steven Adair, founder and president of Volexity. The information security firm (which specializes in incident response, digital forensics/ memory analysis, network monitoring, and more) not only posted guidance for responding to such attacks, but also an analysis based on working three separate incidents involving the SolarWinds hackers. But how did they know it was the same group? And why was it not quite the perfect crime?

image: Heliophysics Systems Observatory spacecraft characterize, in the highest cadence, the constant stream of particles exploding from the sun affect Earth, the planets, and beyond via NASA Goddard Space Flight Center / Flickr