Solorigate Executive Summary

Last Update: 12/28/2020

This write-up provides an executive-style summary addressing the critical questions surrounding the Who, What, Where, Why, and How of the recent Solorigate attack. The analysis leverages information from trusted sources, including CISA, Microsoft, FireEye, and the SANS Institute.

Relevant MITRE ATT&CK Framework Techniques

Initial Compromise and Execution

• T1195: Supply Chain Compromise (relevant to SolarWinds development pipeline compromise)
• T1569.002: Service Execution (execution of malicious SolarWinds DLL)

Privilege Escalation and Credential Access

• T1078.004: Cloud Accounts (Azure AD compromise through privileged accounts)
• T1550.004: Web Session Cookie (potential abuse of session tokens)
• T1556.004: Forge SAML Tokens (key technique for cloud impersonation)
• T1003.001: LSASS Memory (credential extraction from memory)
• T1003.004: LSA Secrets (access to sensitive tokens or secrets)

Lateral Movement and Persistence

• T1606.002: Create Federation Trust (manipulation of Azure AD trusts for persistence)
• T1574: Hijack Execution Flow (modification of SolarWinds DLL code for persistence)

Collection

• T1114.002: Remote Email Collection (targeted data collection of emails via OAuth application permissions)

Command and Control

• T1568.001: Fast Flux DNS (malicious C2 communication via DNS)

Discovery

• T1082: System Information Discovery (discovery of the network environment)

Preparation and Tool Usage

• T1588.002: Tool Acquisition (e.g., stolen FireEye tools used for further attacks)
• T1566.002: Spearphishing Link (possible initial compromise vector)

What is the Solorigate Attack?

Solorigate refers to a sophisticated supply chain attack involving malicious code inserted into SolarWinds’ Orion network management software. The compromise, attributed to a nation-state actor, dates back to at least March 2020 and persisted until June 2020. The attackers infiltrated SolarWinds’ development pipeline, implanting a trojan horse within the Orion platform.

Get Paul Volosen’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Due to the elevated privileges of the SolarWinds Orion software and its trusted digital signatures, the malicious code enabled attackers to:

• Exfiltrate sensitive data.
• Compromise on-premises and cloud-based systems, including Microsoft Azure.

Approximately 18,000 customers using affected versions of the Orion platform were potentially impacted.

Breakdown of the Attack

Key Steps in the Attack Vector:

1. Initial Intrusion: Malicious code was embedded in the SolarWinds.Orion.Core.BusinessLayer.dll component.
2. Privilege Escalation: Once deployed, attackers gained administrative permissions on affected networks.
3. Lateral Movement: Using compromised credentials or forged SAML tokens, attackers infiltrated on-premises and cloud environments.
4. Data Exfiltration: Attackers accessed sensitive data, including emails, files, and administrative credentials.

Attack Diagram:

Microsoft has detailed the general attack flow, highlighting:

• The use of compromised token signing certificates to forge SAML tokens.
• Gaining unauthorized access to both on-premises and cloud-based resources.

Technical Details

• Malicious Code: A few benign-looking lines were added to the SolarWinds.Orion.Core.BusinessLayer.dll file, enabling execution and persistence.
• Digital Signature Exploitation: The malicious DLL was signed with SolarWinds’ trusted certificate, granting it the ability to execute privileged actions without raising suspicion.
• Affected Versions: SolarWinds platforms including 2019.4 HF 5, 2020.2 (no hotfix), and 2020.2 HF 1 were targeted.

Cloud Impact

Attackers leveraged the compromised SAML token signing certificates to:

• Forge SAML tokens and impersonate high-privilege accounts in Azure AD.
• Create federation trusts and modify existing ones for long-term access.
• Access email and sensitive data by exploiting OAuth application permissions.

Detection and Response

When Was It Detected?

The attack was first identified by FireEye on December 8, 2020, and publicly disclosed on December 13, 2020.

Why Did It Go Undetected for So Long?

• Malicious code was embedded in trusted software with a legitimate digital signature.
• Anti-malware solutions were instructed to exclude SolarWinds files.
• Extensive anti-detection mechanisms terminated execution in virtualized or analysis environments.

How to Determine If You Are Affected:

• Verify if your organization uses SolarWinds Orion versions within the affected range.
• Look for signs of compromise, such as anomalous DNS queries or suspicious SAML token activity.

What Should Organizations Do?

Immediate Actions: Follow vendor-specific and government-issued guidance.

Investigation Steps:

• Segregate SolarWinds systems from critical assets.
• Conduct memory dumps and analyze network traffic for anomalies.
• Use a clean environment to investigate command-and-control (C2) activities.

Response Plan:

1. Establish secure communication channels for key personnel.
2. Investigate persistence and initial access points.
3. Monitor continuously while recovering administrative control.
4. Strengthen security posture by enabling recommended features and best practices.

Additional Notes:

FireEye Breach Connection:

FireEye’s discovery of stolen proprietary security tools led to the investigation uncovering the SolarWinds attack.

Known Malicious Infrastructure:

The list of malicious domains and C2 infrastructure is available on FireEye’s GitHub page.

Resources:

• CISA Guidance
• Microsoft Security Documentation
• FireEye Analysis
• SolarWinds Security Advisory

Summary

Organizations using SolarWinds Orion should assume potential compromise and deploy incident response measures immediately. Prioritize secure communications, investigate potential breaches, and follow authoritative guidance to mitigate risk and strengthen defenses against future threats.