Speaker 1: Welcome to tech Stuff, a production from I Heart Radio.
Speaker 1: Pay there and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio
Speaker 1: and a love of all things tech, and today I've
Speaker 1: got something special for you guys. I'm going to be
Speaker 1: talking with Shannon Morse, my good friend, hacker extraordinaire, incredible
Speaker 1: tech communicator, and she and I are going to break
Speaker 1: down the solar winds hack, a hack that was dominating
Speaker 1: the news for late December into January. It will likely
Speaker 1: be a part of the news cycle in the tech
Speaker 1: space for months and possibly years to come, as it
Speaker 1: was a particularly effective and potentially devastating attack, one that
Speaker 1: will take quite a long time to repair. And I
Speaker 1: wanted to bring Shannon on to the show because while
Speaker 1: I can do a lot of research into this stuff,
Speaker 1: I come at this as the same as anyone else would, really,
Speaker 1: anyone who's not in the the info sex space. I
Speaker 1: would look at it as an outsider trying to learn
Speaker 1: as best I can. But Shannon has been working in
Speaker 1: the hacker sphere for many years and has a particularly
Speaker 1: uh strong point of view when it comes to such
Speaker 1: things and is able to see things that I just don't.
Speaker 1: So I was very glad that she took the time
Speaker 1: out of her schedule to jump on this episode. And
Speaker 1: so now here is my conversation with Shannon Morris about
Speaker 1: the solar winds hack. I hope you enjoy it. Shannon,
Speaker 1: Welcome back to tech Stuff. It has been too long.
Speaker 1: Thank you for joining me. Thank you for having me. Jonathan,
Speaker 1: how are you. I'm well, It's always a pleasure to
Speaker 1: have you on even and we have to talk about
Speaker 1: terrifying existential threats, but this one is a fun one.
Speaker 1: This one is interesting, fun for us to talk about. Yeah, well,
Speaker 1: because it's it is different from a lot of of
Speaker 1: malware threats and hacker threats that we typically hear about. So, Shannon,
Speaker 1: you're the expert, you let me know if I'm way
Speaker 1: off base. I'm going to give kind of my take
Speaker 1: on what the typical hacker attack tends to be and
Speaker 1: the way we tend to see, at least the ones
Speaker 1: that we hear about. Um, if it's not something like
Speaker 1: someone taking advantage of a security vulnerability in a system
Speaker 1: or using social engineering to get access to someone's system,
Speaker 1: what we usually hear about our malware attacks where there's
Speaker 1: like an email attachment or someone has uploaded and infected
Speaker 1: file through some sort of distribution point where it might
Speaker 1: be a peer to peer network, it might be a database,
Speaker 1: or it might be that you go to some website
Speaker 1: that you've been directed to and you click on something
Speaker 1: that then installs malware to your system. And in this
Speaker 1: sort of attack, you've got hackers that are kind of
Speaker 1: taking a shotgun approach, right. They don't know who's going
Speaker 1: to end up getting this malware. It's more like, let's
Speaker 1: try and spread it as far and wide as we
Speaker 1: possibly can, taking a pretty brute force kind of tactic.
Speaker 1: Is that more or less accurate for the general types
Speaker 1: of stuff we hear about? Yeah, pretty much. I mean
Speaker 1: usually you hear about the very consumer oriented hacks. You know,
Speaker 1: an app gets installed from Google Play and it turns
Speaker 1: out it has hundreds of thousands of downloads and everybody
Speaker 1: all of a sudden has malware and they have to
Speaker 1: get rid of it. Blah blah blah blah blah. So
Speaker 1: you see a lot of targeted assaults happening towards consumers,
Speaker 1: but in this case, with a supply chain attack, as
Speaker 1: what it's called, uh you see a a attack that's
Speaker 1: very targeted towards a specific type of brand or a
Speaker 1: vendor that happens to work with a whole bunch of people.
Speaker 1: So the attackers don't necessarily know of the whole bunch
Speaker 1: of people these businesses, clients that this vendor works with.
Speaker 1: They don't know who's actually going to install it in
Speaker 1: order for them to be able to attack all these
Speaker 1: different brands. They just know, we know this vendor works
Speaker 1: with thousands of thousands of really important businesses, so let's
Speaker 1: just attack this one brand and then see what happens. Yeah,
Speaker 1: and in this case, the Solar Winds hack a lot
Speaker 1: of people. I'm sure the average person had never heard
Speaker 1: about solar Winds before the news broke about the actual hack.
Speaker 1: Because this is a business to business sort of enterprise.
Speaker 1: They create software packages for businesses, typically really big businesses
Speaker 1: are really big organizations to use to do things like
Speaker 1: just monitor their network system. So it's not the kind
Speaker 1: of thing that the average person would ever have to
Speaker 1: come in contact with unless you happen to be like
Speaker 1: the I T. Person at a big company or a
Speaker 1: government agency exactly. So I give an example of when
Speaker 1: I used to work at a bank and forward facing.
Speaker 1: When I was working at that bank, you know, I
Speaker 1: was talking to customers all the time, and I had
Speaker 1: my own little register where I had the money and everything,
Speaker 1: and I had my own computer. But that computer was
Speaker 1: running Windows, and it was running software on Windows. But
Speaker 1: behind the scenes, for that entire branch and for all
Speaker 1: the different branches and all the different cities for this
Speaker 1: company that I worked at, they had servers that were
Speaker 1: connected to all the different physical locations for this bank,
Speaker 1: and on those servers is where you would see these
Speaker 1: kind of platforms being used, these kind of operating systems.
Speaker 1: So if you're just working at a very like consumer
Speaker 1: facing or an office oriented job, then you don't necessarily
Speaker 1: run into this, even if you're an employee. A lot
Speaker 1: of times it's just happening on the back end for
Speaker 1: like the network administrators, the I T security and from
Speaker 1: Asian security, like those are the kind of people that
Speaker 1: would be using this kind of uh networking product. Yeah. So,
Speaker 1: so like if you're a company that does products that
Speaker 1: are like software as a service, where you need to
Speaker 1: keep a really close eye on things like network loads
Speaker 1: because you might have to react uh nimbly and and
Speaker 1: quickly to changing demands on your system. Solar Winds makes
Speaker 1: the kind of software that allows you to have that
Speaker 1: that top level look at what's going on with your networks.
Speaker 1: So again not something that most of us would run into,
Speaker 1: but it is really important software. And that's why nearly
Speaker 1: every company that's on the Fortune five list is a
Speaker 1: client of Solar Winds, and several high level government agencies,
Speaker 1: particularly in the United States, like the Department of Justice,
Speaker 1: the Department of Homeland Security, Department of the Treasury, the
Speaker 1: Department of Energy, like big national security level organizations are
Speaker 1: all client of Solar Winds, and in particular, they have
Speaker 1: a product that's called Oriyan, and this is specifically to
Speaker 1: monitor stuff like network traffic and network assets and where
Speaker 1: you might need to make adjustments on the fly. And
Speaker 1: that ends up being the bulls eye of the target
Speaker 1: for the hackers who created the Solar Winds hack, which
Speaker 1: is also sometimes called sunbursts, the particular malware that was used,
Speaker 1: and um, this is where we get into that supply
Speaker 1: chain attack. And I think an easy way for people
Speaker 1: to understand it is that it's unfortunate that it's an
Speaker 1: attack that that takes advantage of something that we typically
Speaker 1: tell people to do, which is, when a patch comes
Speaker 1: out for your software, you install it. Because typically patches
Speaker 1: do things like they address previous vulnerabilities in software and
Speaker 1: they close down an avenue of attack for hackers. But
Speaker 1: if a hacker were able to target that that actual software,
Speaker 1: whatever it might be, like, if they were able to
Speaker 1: target Windows and insert the malicious code into the Windows
Speaker 1: code so that when the patch notes go out, when
Speaker 1: the patches go out, the malicious code hitchhikes along. And
Speaker 1: then when you install your patch, as you do as
Speaker 1: a good user, you have just installed the malware that
Speaker 1: is the supply chain attack, and it's devastating. It's yeah,
Speaker 1: it's very very scary because the it kind of focuses
Speaker 1: on the inherent trust that a lot of clients have
Speaker 1: with the vendors that they use for this distributed software
Speaker 1: that they might use on their back end for for
Speaker 1: their network or whatever it might be. So by having
Speaker 1: that inherent trust, you are trusting as a business that
Speaker 1: when you do these auto updates, when you physically go
Speaker 1: in and you know, update your firmware or whatever it
Speaker 1: might be, that you are going to be protecting yourself
Speaker 1: because you're on top of it, you're downloading that stuff
Speaker 1: every single time there's a new version that comes out.
Speaker 1: But in this case, because the attackers were targeting the
Speaker 1: vendor itself and not the specific clients, they were distributing
Speaker 1: that malware, two thousands upon thousands of potential customers, and
Speaker 1: it's the ones that were updating like they should be
Speaker 1: that ended up being kind of caught in the crosshairs. Yeah,
Speaker 1: this is one of those cases where you say, I
Speaker 1: did everything right and you still screwed me. Uh yeah.
Speaker 1: So oriyan Orian is a platform that's very popular. Around
Speaker 1: thirty three thousand of solar Wind's clients have some version
Speaker 1: of Orian running on their system. Out of that thirty
Speaker 1: three thousand, solar Winds said, approximately eighteen thousand had the
Speaker 1: versions that were specifically affected when the malicious code had
Speaker 1: been inserted and those patches had been pushed out to
Speaker 1: the clients and they had actually installed it. Out of
Speaker 1: those eighteen thousand, however, we later learned that a very
Speaker 1: very small number were followed up on because, as it
Speaker 1: turns out, that sunburst attack was just stage one. It
Speaker 1: was not it was not the end all. It wasn't like,
Speaker 1: oh we snug some malicious code into a legitimate product.
Speaker 1: High fives all around. That was just the beginning. Yeah,
Speaker 1: So in this case, the attackers were like, let's just
Speaker 1: get it out there and see who gets caught in
Speaker 1: the crosshairs. And then they started following up and they
Speaker 1: were like, Okay, well, who who matters the most to us?
Speaker 1: Which ones might be financially motivated for us to hack?
Speaker 1: Who might be the ones that have the biggest and
Speaker 1: best data sets that we could potentially pilfer off and
Speaker 1: sell to a third party. Like, we don't necessarily know
Speaker 1: what their end goal is, but a lot of times
Speaker 1: with hacks like this, especially if they are distributed towards
Speaker 1: Fortune five hundreds and government and sectors like that, they
Speaker 1: are state sponsored or they are very very financially motivated.
Speaker 1: So that would be my general like hypothesis as far
Speaker 1: as what their their motivations were behind it and why
Speaker 1: they specifically target, you know, the government sector. The very
Speaker 1: few that they actually did out of the eighteen thousand, Yeah,
Speaker 1: I think the last report I read said that it
Speaker 1: looked like it was around forty systems out of eighteen thousand.
Speaker 1: That's less than that's less than less like point two
Speaker 1: of all the different systems that they hit that they
Speaker 1: followed up on, and it does say that there was
Speaker 1: a very concentrated, focused effort to look at very specific systems.
Speaker 1: Most of the ones that they targeted were out of
Speaker 1: big tech and then government agencies and then some non
Speaker 1: government offices outside of that, like think tanks and things
Speaker 1: like that. UM I've seen speculation that, as you say,
Speaker 1: it was very likely a state backed attack, and that
Speaker 1: the evidence seems to point, but it does not necessarily
Speaker 1: indicate proof positive that Russia was behind the attack. At least, yes,
Speaker 1: there appears that that's what all the signs point to,
Speaker 1: but then there's also always the possibility of what is
Speaker 1: called a false flag operation exactly. So it's very interesting
Speaker 1: when people start kind of laying blame on specific groups
Speaker 1: of attackers or groups of hackers and saying like, hey,
Speaker 1: because the code looks this way, we think that it's,
Speaker 1: you know, backed by Russia or whoever, it might be
Speaker 1: backed by China and North Korea. Those are usually the
Speaker 1: ones that we see in the news. Uh. In this case,
Speaker 1: they found samples of code that could be very very
Speaker 1: closely linked to a previous attacker group from Russia. So
Speaker 1: they made that tie and they were like, hey, we
Speaker 1: think that this is the same group. But there is
Speaker 1: always the potential that somebody could have copied previous malware
Speaker 1: and used samples of that for new quote code for
Speaker 1: solar winds for the sunburst. So it's entirely possible that
Speaker 1: it's not the same group, but it's plausible, right. So
Speaker 1: again you can't draw any firm conclusions. But when you
Speaker 1: start thinking about this as a potential state backed attack
Speaker 1: that largely gives hackers high level access to systems once
Speaker 1: they deliver that second payload of malware, which specifically allows
Speaker 1: them to move laterally across networks, not just hit a
Speaker 1: specific server, but then to kind of infiltrate across an
Speaker 1: entire system. A lot of the reports we've seen have
Speaker 1: shown that the hackers were at least able to read
Speaker 1: material to see what what material was around. They could
Speaker 1: look at source code at Microsoft, for example, or they
Speaker 1: can look at emails that had been both sent and
Speaker 1: received through a particular system. A lot of this kind
Speaker 1: of leads you down the path to thinking one potential
Speaker 1: purpose for this attack could be espionage. That it literally
Speaker 1: is another part of cyber espionage where you're spying on
Speaker 1: UM an enemy or or adversary, and that fits the
Speaker 1: narrative really well. Again, we can't draw that conclusion conclusively
Speaker 1: to be redundant, but we can at least we can
Speaker 1: at least say like that is a potential answer to
Speaker 1: why this has happened. Yeah, So I like to lay
Speaker 1: out a lot of caveats because it's it's very dangerous
Speaker 1: to speak in absolutes when you come to something like this,
Speaker 1: because it may turn out yes, ongoing. So we still
Speaker 1: have a lot of questions. But I am glad that
Speaker 1: we have companies like Microsoft, for example, with Office three
Speaker 1: and the fact that they were able to see source code,
Speaker 1: the attackers were able to see source code. I'm glad
Speaker 1: they're coming forward these clients that were attacked and we're targeted,
Speaker 1: because it's giving us a clear perspective of what was
Speaker 1: actually targeted in this assault. And in Microsoft's case, it was,
Speaker 1: or at least they believe that it was the source code,
Speaker 1: because the attackers did get access to that information. Now,
Speaker 1: were they also like collecting the source code? Were they
Speaker 1: taking it from Microsoft and collecting it into their own
Speaker 1: data set? Maybe? Probably, I mean, they did have access
Speaker 1: to it, so it's entirely plausible as well. But again
Speaker 1: it's that plausibility of like all these questions that we
Speaker 1: currently have with an active attack where there's still being
Speaker 1: discoveries happening. This is Jonathan outside the interview here. I'm
Speaker 1: just interrupting so that we can take a quick break,
Speaker 1: but we'll be right back. So we know that the
Speaker 1: nature of the attack allowed for a lot of access
Speaker 1: to things from a certain level, but in most cases
Speaker 1: that we've heard about, the companies are saying no one
Speaker 1: was able to actually make any changes to anything. They
Speaker 1: might have seen it, they might have copied it, but
Speaker 1: they could not modify anything. However, part of what I
Speaker 1: would think would be useful if you're looking at source
Speaker 1: code for products like Office three six five, which has
Speaker 1: incredible distribution to millions of systems around the world, consumer level,
Speaker 1: enterprise level, everything in between, that now that you have
Speaker 1: that source code, you can start looking at ways to
Speaker 1: exploit that. You essentially have a playground, a sandbox that
Speaker 1: you can work in with the actual source code of
Speaker 1: the product, at least from that particular era until Microsoft
Speaker 1: makes changes to it, and then you have a way
Speaker 1: of of practicing on that to try and develop malware
Speaker 1: that could potentially be used out in other distributions using
Speaker 1: perhaps totally different attack vectors. Is that something that could
Speaker 1: actually be possible or my addled by Hollywood, That's entirely possible.
Speaker 1: And that's one of the reasons why we have seen
Speaker 1: supply chain attacks targeting very specific like firmware versions or
Speaker 1: or the back ends for these really large clients like
Speaker 1: Microsoft UH in order to be able to steal source
Speaker 1: code and stuff like that, because oftentimes, even though new
Speaker 1: versions might come out of an operating system or of
Speaker 1: software or firmware UH, they will use previous generations of
Speaker 1: that firmware in order to maintain like consistency across all
Speaker 1: of the different platforms that their product might be installed onto.
Speaker 1: So there might be a few changes for future versions
Speaker 1: or future releases, but the source code might remain pretty
Speaker 1: similar to previous installations, and it's so much work to
Speaker 1: change things on a fundamental level that it's impractical. Right,
Speaker 1: There's there's almost no possibility, especially for programs that typically
Speaker 1: they typically grow larger. I don't know if you've noticed this, Shannon,
Speaker 1: but I have, even from like a programming perspective, which
Speaker 1: I am not a programmer. But I have done some
Speaker 1: coding in the past, and I know that there is
Speaker 1: a lot of turnover at companies, and oftentimes they will
Speaker 1: forcibly not change a lot of the code in order
Speaker 1: to make sure that it still works with new employees
Speaker 1: if there is like a new codeer that comes in
Speaker 1: or a new programmer. Uh and sometimes you won't find
Speaker 1: notes in the in the code for future programmers, so
Speaker 1: they just choose not to break anything by not changing anything,
Speaker 1: so code will remain the same for years and years
Speaker 1: and years before somebody actually goes in and bravely changes anything. Right, So,
Speaker 1: if you if you are someone who's creating a uh
Speaker 1: some malware and you want to target users of a
Speaker 1: specific type of of software, whatever it may be, whether
Speaker 1: it's an operating system or something entirely different, then being
Speaker 1: able to make a change to like a fundamental part
Speaker 1: of that code, one that is not likely to have
Speaker 1: been altered because it's it's sort of a pillar of
Speaker 1: the software, then that's a pretty decent bet that your malware,
Speaker 1: if you're able to inject it into the actual real
Speaker 1: software on whatever the vendor side is, that that will
Speaker 1: then get rolled out through various patches and updates or
Speaker 1: even just new installations of that that product as people
Speaker 1: come on board, and the longer you can keep that
Speaker 1: on the d L, the more systems you can infect
Speaker 1: without anyone being the wiser. As it turns out with
Speaker 1: with the solar winds hack, we now know that the
Speaker 1: attacks started no later than October two thousand nineteen. It
Speaker 1: may have been insane. Yeah, So that that was for
Speaker 1: a full year plus a couple of months before we
Speaker 1: were made aware of it. And it was another security
Speaker 1: firm called fire Eye that noticed something hinky was going on.
Speaker 1: Something hinky. Yeah, but it's kind of but it was hanky,
Speaker 1: It's true. They were They were like, hey, what's this
Speaker 1: wise our network being weird? I call it jankie. But
Speaker 1: they just like, some odd is going on, Like we're
Speaker 1: getting some red flags. And we didn't know at the
Speaker 1: time that it was Sunburst, that we didn't know that
Speaker 1: it was a solar winds hack or where it was
Speaker 1: being distributed from. So fire I was just like, we
Speaker 1: think we got hacked, and then a few days later
Speaker 1: everybody was like, oh, actually this is connected to a
Speaker 1: much bigger thing. It wasn't them, it was the vendor
Speaker 1: that they were using. So all of a sudden, everybody
Speaker 1: was just like, oh, we should probably check our systems too,
Speaker 1: And then everybody started realizing, oh, this is actually a
Speaker 1: really huge thing because it wasn't just us, it was
Speaker 1: a vendor. That's scary. Well, and when it's a cybersecurity
Speaker 1: firm that first says, oh, gosh, we were hacked, you
Speaker 1: know it's bad because these are the people who are
Speaker 1: paid to stop that from happening to other people. So
Speaker 1: it's a great example when you look at it from
Speaker 1: from that perspective of fire Eye as a cybersecurity company,
Speaker 1: even they had inherent trust in Solar Winds to distribute
Speaker 1: their firmware and their updates in a trusted way. And
Speaker 1: even then they couldn't fully trust Solar Winds to do
Speaker 1: that in a matter that would keep them protected, right right,
Speaker 1: I mean, we there's this whole certification process, this digital
Speaker 1: certification that proves that a piece of code is really
Speaker 1: coming from the source that you think you're receiving it,
Speaker 1: you know from, so that there's this approach that's very
Speaker 1: well tested, very well proven by history that this is reliable.
Speaker 1: And that's why this hack is so insidious because it said, cool,
Speaker 1: we were not going to try and get around that.
Speaker 1: We're gonna rely on that trust, on that that whole process,
Speaker 1: because everyone knows it works. So if you can, if
Speaker 1: you can get to the code before it goes through,
Speaker 1: then you're golden. And that's exactly what happened. Uh. An
Speaker 1: analogy I use is that the way we typically think
Speaker 1: of hackers is and you should appreciate this because I
Speaker 1: know you've played with them. We can think of someone
Speaker 1: who's got lock picks and they're going through an apartment
Speaker 1: building and they're just they're they're opening up locks just
Speaker 1: for fun. But the Solar Winds hack is as if
Speaker 1: the supervisor for the entire building with the master key
Speaker 1: is the one who has decided to do all the snooping,
Speaker 1: and they can just walk in when because they've been
Speaker 1: trusted with that master key. So that's kind of the
Speaker 1: analogy I give. It's it's totally different from the hacks
Speaker 1: where you're like, that person looks us I'm not gonna
Speaker 1: let them into the building. No, it's it's the supervisor.
Speaker 1: Of course, the supervisor comes in, he's tolly fied. Yeah,
Speaker 1: that's a great analogy. Actually, I don't I hope you
Speaker 1: don't mind if I steal that? Please? Do I get
Speaker 1: like two a year? So I'm just glad that I
Speaker 1: was able to. I mean I peaked early. We're in January.
Speaker 1: But but yeah, so the scope of this attack, even
Speaker 1: though only only I say only, but like forty different
Speaker 1: systems have been compromised then further infiltrated. Uh, you still
Speaker 1: have around eighteen thousand that could potentially be infiltrated because
Speaker 1: they do have the malicious code installed within their systems
Speaker 1: that allows for that backdoor access. So they have to
Speaker 1: they it is now incumbent upon them to make sure
Speaker 1: they uh they they isolate those servers, they remediate them,
Speaker 1: and that they bring everything up to a new version
Speaker 1: that no longer has that backdoor access. Meanwhile, for all
Speaker 1: the systems that we're compromised, for those forty, which again
Speaker 1: includes like national security level government offices, they have the
Speaker 1: unenviable task of figuring out how extensive the attack was
Speaker 1: within their systems, what parts of their systems were specifically affected,
Speaker 1: at what level of access did the hackers have, was
Speaker 1: it like microsoftware they could just see it or could
Speaker 1: they do more? And how do they fix it? Um?
Speaker 1: And this is. I think I think the way we
Speaker 1: could we could call it a ginormous challenge. Oh yeah,
Speaker 1: So I'll give you an example from a very much
Speaker 1: smaller scale. When I was working at Hack five in
Speaker 1: an office, I learned how I could do network sniffing
Speaker 1: on the entire office. So I was able to figure
Speaker 1: out from my little Lennox laptop what machines were connected
Speaker 1: all to the same network, even if they were Ethernet
Speaker 1: or WiFi. I was able to figure out how to
Speaker 1: you know, sniff WiFi as well, because we made a
Speaker 1: product for that, uh, And I was able to see
Speaker 1: that we had, like I think it was like twelve
Speaker 1: different computers, we had two printers. So then from there
Speaker 1: I was able to look up the versions of everybody's
Speaker 1: operating systems and find out which ones were vulnerable. And
Speaker 1: it turns out one of our printers was vulnerable. So
Speaker 1: even though I was not necessarily connected to the printer,
Speaker 1: like I didn't have it installed, the driver's installed, or
Speaker 1: anything on my Lenox computer, I was able to send
Speaker 1: that printer a piece of paper that said I got hacks,
Speaker 1: and I was able to print it out on the computer.
Speaker 1: And it was the funniest thing because like nobody it was.
Speaker 1: It was Darren's printer, so like he was able to
Speaker 1: look at it. My coworker, Darren Kitchen, and he was
Speaker 1: and he looks at the piece of paper and he
Speaker 1: was like, s did you just figure out how to
Speaker 1: hack the printer? And I said, yeah, it was super funny.
Speaker 1: But even from a much more broad perspective of when
Speaker 1: you're looking at solar winds um, if somebody had access
Speaker 1: to a net, the network of one of their clients,
Speaker 1: they could see the actual desktop computers that many of
Speaker 1: their office employees might have access to. They could see printers,
Speaker 1: They might be able to see network connected security cameras. UH.
Speaker 1: If they work at a bank, they might be able
Speaker 1: to see network connected a t M s UH. They
Speaker 1: have access to maybe like passwords or anything that's being
Speaker 1: distributed across the network if it's not being protected correctly.
Speaker 1: They could have access to network attached storage in server racks,
Speaker 1: all sorts of things. So if you have hundreds and
Speaker 1: hundreds of different connected devices and any of those have
Speaker 1: not been like auto update, and then again we're putting
Speaker 1: trust in vendors to auto update correctly. If these machines
Speaker 1: have not been auto updated or patched correctly, and a
Speaker 1: hacker has access over that network to see what version
Speaker 1: these programs are running. There's plenty of information on Google
Speaker 1: about what version of what software is still vulnerable to
Speaker 1: what problems. There are these things called c v s
Speaker 1: and you can look them up and see what kind
Speaker 1: of vulnerabilities are currently out there and how they are
Speaker 1: being fixed. And if a hacker knows and they look
Speaker 1: at this version and then they find out there's a vulnerability,
Speaker 1: they could use that to their advantage to get another
Speaker 1: foothold within that network. Even if even if the network
Speaker 1: admin found out that there was a vulnerability on their
Speaker 1: network and they were able to cut that off, the
Speaker 1: hacker might have already gotten another foothold. So it's entirely
Speaker 1: possible that there's like plenty of other places that these
Speaker 1: attackers are snooping on networks through. So yeah, it's a
Speaker 1: huge issue, and it's no wonder like given that this
Speaker 1: was just discovered a few weeks ago, maybe about a
Speaker 1: month month in two weeks ago or six weeks, Uh,
Speaker 1: it's no wonder that there's tons of network admins and
Speaker 1: security professionals that are still having to work like over
Speaker 1: time just to ensure that their networks are safe. And
Speaker 1: and you pointed out a problem that I hadn't even
Speaker 1: thought about, which just as like, hey, you know how
Speaker 1: bad you thought this was. Guess what, It's worse than that,
Speaker 1: because because like, if to go back to my analogy,
Speaker 1: it would be almost like if you are you have
Speaker 1: infiltrated a building, you were able to sneak in, and
Speaker 1: you're snooping around and you're looking at all this sort
Speaker 1: of stuff, and meanwhile you're also unlocking every window you
Speaker 1: go by, so that if if your original entry point
Speaker 1: has been shut off, you got like fifty others. Because example,
Speaker 1: so if somebody was to change the lock on their door,
Speaker 1: but you also had unlocked the windows so that you
Speaker 1: could get access that way, they might not even think
Speaker 1: about checking the window when they fixed the lock on
Speaker 1: the door, right right, So, like you were saying, looking
Speaker 1: at all the different versions of software that are running
Speaker 1: on various computers and other systems, other devices running on
Speaker 1: that network, if you identify all those potential vulnerabilities, really
Speaker 1: you're just you're like you're saying, we should use this
Speaker 1: time to start developing tools to take advantage of all
Speaker 1: these different potential weak points, because we can make the
Speaker 1: problem so big that it is almost impossible to think
Speaker 1: of what the solution would be apart from new kit
Speaker 1: from orbit. It's the only way to be sure. A
Speaker 1: lot of it is risk assessment, and that's something that
Speaker 1: a lot of a lot of large businesses do, and
Speaker 1: it's even something that customers can do. Consumers like I
Speaker 1: could do this from my home network risk assessment. What's
Speaker 1: running on your network right now? What devices are vulnerable
Speaker 1: or potentially vulnerable? Have you done a yearly audit to
Speaker 1: make sure that there's nobody getting access there's no like
Speaker 1: random email addresses tied or associated to your online accounts?
Speaker 1: Have you changed your passwords in the past year to
Speaker 1: comply with nests recommended framework for passwords, Like, there's a
Speaker 1: bunch of different things that you can do to kind
Speaker 1: of assess where your risks lay and then act on
Speaker 1: those assessments before a hack actually happens, right, Yeah, And
Speaker 1: as long as you don't have an issue like this
Speaker 1: where a trusted vendors where because yeah, because that just
Speaker 1: slips right in right, just like you were saying, like
Speaker 1: these these companies could have been doing all the right
Speaker 1: things it's not like they did something wrong. They did
Speaker 1: the right thing. And you might wonder, well, how did
Speaker 1: the hackers get access to the Orion software to start with?
Speaker 1: Like how did that happen? And honestly, we don't fully know, you,
Speaker 1: or at least the public doesn't fully know yet. Someone
Speaker 1: might know, but I don't. But the working theory right
Speaker 1: now is that another third party vendor called jet Brains
Speaker 1: creates a tool called Team City. Jet Brains, by the way,
Speaker 1: I'm sure completely coincidentally founded by a group of Russian
Speaker 1: cybersecurity experts, but Team City. Team City is a software
Speaker 1: testing environment. So it's the kind of thing where you've
Speaker 1: got your little virtual say in box, so that you
Speaker 1: can build software and try and break it and see
Speaker 1: if it works before you deploy it in the real world. Right,
Speaker 1: That's kind of the thing they make. And Solar Winds
Speaker 1: is one of the customers who uses Team City, and
Speaker 1: so the current thinking is that the hackers targeted Team City.
Speaker 1: They specifically targeted a server that Solar Winds uses that
Speaker 1: has Team City on it. They targeted that and then
Speaker 1: they were able to get access to solar Winds software
Speaker 1: through that link, which just shows you, like there could
Speaker 1: be a lot of hops from between the hacker and
Speaker 1: their ultimate goal. So this team City Server was one hop.
Speaker 1: The solar winds system where they were able to inject
Speaker 1: malware into Orion was a second hop. The customers were
Speaker 1: the third hop, and then they could go in and
Speaker 1: start adding a second payload. Because once they once they
Speaker 1: were deployed to the customers, that was the in road,
Speaker 1: that was the back door. There is no doubt in
Speaker 1: my mind that their end goal what were the clients
Speaker 1: that use solar winds, And chances are that these attackers
Speaker 1: are very very advanced and that they probably are state
Speaker 1: sponsored because the time that they're investing in order to
Speaker 1: get the foothold within get these back doors within these
Speaker 1: clients took them over a year. I mean, it took
Speaker 1: them a very very long time. And if they started
Speaker 1: even behind solar winds to jet brains, that's insane, Like
Speaker 1: that is extremely advanced. And that's one of the reasons
Speaker 1: why this is such a crucial attack and what why
Speaker 1: it's It's going to go in like history books when
Speaker 1: people talk about information security and learning about previous attacks,
Speaker 1: this is going to be one of those historical examples
Speaker 1: of a supply chain attack, because it's insane how how
Speaker 1: advanced it is. We'll be right back with more with
Speaker 1: Shannon Morse about the solar winds hack. After this quick message,
Speaker 1: I've read some articles by cybersecurity experts who, you know,
Speaker 1: hindsight is, now that it's happened, you can see where
Speaker 1: the opportunities were earlier on, in the sense that if
Speaker 1: you're thinking about the cybersecurity environment of say two eighteen
Speaker 1: to present day, a lot of that attention was rightfully
Speaker 1: devoted to things like how do we maintain a secure
Speaker 1: election cycle here in the United States, So a lot
Speaker 1: of resources we're looking in one direction, which meant that
Speaker 1: not as many resources we're looking for potential supply chain threats.
Speaker 1: So while there were a few analysts who had previously
Speaker 1: said this is something we really need to be cognizant
Speaker 1: of and have developed best practices so that we can
Speaker 1: hopefully prevent it, but if not prevent it, certainly detected
Speaker 1: and react to it. But because there were other pressing
Speaker 1: matters that were very much tied to cybersecurity, that that
Speaker 1: just didn't get as much attention as it might have otherwise,
Speaker 1: and it ended up being the perfect opportunity. It actually
Speaker 1: really does point to the incredible um UH inventiveness and
Speaker 1: the the how how nimble the hackers were to be
Speaker 1: able to recognize a time and and opportunity to really
Speaker 1: develop and deploy that malware, because you couldn't have asked
Speaker 1: for a better environment, right, It just was the perfect
Speaker 1: time for for the neighborhood Watch to be looking the
Speaker 1: other way. Oh yes, it's um And I feel like
Speaker 1: the attackers got very lucky on their timing, even though
Speaker 1: and this this is bringing up the pandemic in a sense,
Speaker 1: even though the it's probable that this started in October
Speaker 1: nineteen and that happened before the pandemic. What perfect timing
Speaker 1: for these attackers because the entire time that they have
Speaker 1: been silently getting intrusions into all these different clients and
Speaker 1: into solar Winds as the vendor. There have been companies
Speaker 1: out here that have been losing funds because of the pandemic.
Speaker 1: They don't have as much manpower because everybody's working from home,
Speaker 1: and they've had to lay off a lot of their
Speaker 1: network administrators and their I T and consultants and everybody else,
Speaker 1: and they don't have the money right now to fund
Speaker 1: doing like third party audits of their systems and stuff
Speaker 1: like that, So perfect timing for attackers to just come
Speaker 1: in and silently attack and intrude on all of these
Speaker 1: different networks because nobody, nobody has the manpower right now.
Speaker 1: It's it's almost impossible for all these companies to be
Speaker 1: able to fulfill all the projects they could have potentially
Speaker 1: had for security and privacy of their networks. Yeah, uh,
Speaker 1: it is. It's it's a remarkable set of circumstances that
Speaker 1: all helped create almost a perfect storm. The only way,
Speaker 1: this is the only way you could argue that this
Speaker 1: would be obviously worse, is if that number of compromise
Speaker 1: systems had an even larger number of ones that were
Speaker 1: followed up upon, if that were if that number were
Speaker 1: even bigger than we would be talking about. I mean,
Speaker 1: it's I don't even know how to call it like
Speaker 1: a catastrophe, because I think it's already a catastrophe. We're
Speaker 1: already at catastrophic level because of the potential espionage that
Speaker 1: could have been done in critical systems. We don't know
Speaker 1: if they were ever able to really access like highly
Speaker 1: classified information. Clearly that's something that the government likes to
Speaker 1: keep on the down low. They're not they're not too
Speaker 1: they're not too happy to say like, oh, by the way,
Speaker 1: Russian spies were able to look at our top secret
Speaker 1: classified information that even most of our government official never
Speaker 1: get a chance to see. That would be bad. Uh,
Speaker 1: we don't know if that's happened or not from based
Speaker 1: on what we've seen at other places. Uh, it's hard
Speaker 1: to say because it all depends upon what other security
Speaker 1: practices these different departments were doing, whether or not they
Speaker 1: had had sort of sequestered some of their most sensitive
Speaker 1: information in systems that are not as easily accessible. There
Speaker 1: are possible ways of doing that. Microsoft in fact, has
Speaker 1: talked about how through their own security system that is
Speaker 1: part of the reason why they were limited in their access.
Speaker 1: They still got to see a ton of stuff. It's
Speaker 1: not good, but but it was a low privileged user access.
Speaker 1: They weren't able to get like full access to everything
Speaker 1: on Microsoft systems because the attacker was only able to
Speaker 1: get that lower end access. So here's hoping, and and
Speaker 1: the cynic in me it feels like hope is a
Speaker 1: strong word to use because I've also familiar with government
Speaker 1: systems and they're not always laid out in the best way,
Speaker 1: often because not to any fault of government officials, I
Speaker 1: don't want to throw a lot of shade at them.
Speaker 1: We also have to keep in mind that some of
Speaker 1: those positions there's a lot of turnover just because government
Speaker 1: changes a lot. So it's hard to keep a real
Speaker 1: legacy of security in those systems because you don't necessarily
Speaker 1: have the same personnel from one administration to the next.
Speaker 1: Um and there can even be turnover within administrations, as
Speaker 1: our most recent administration taught us nearly daily. So so yeah,
Speaker 1: so this is this is a huge challenge. The process
Speaker 1: of cleaning it up is going to take a really
Speaker 1: long time. I tried to see if any analysts had
Speaker 1: kind of an estimate, but the most specific answer I
Speaker 1: could get was probably years to really assess the full extent.
Speaker 1: That's the same thing that I saw, which was pretty
Speaker 1: much the consensus even among like my hacker friends, was
Speaker 1: it's probably going to take several years in order for
Speaker 1: them to really figure out how deep this honestly goes.
Speaker 1: That is a sobering fact. It's also, you know, a
Speaker 1: good reminder that this is something that you know, it's
Speaker 1: not necessarily going to be an isolated incident. The fact
Speaker 1: that this was so successful sends out a message to
Speaker 1: any state sponsored hacker group that if you can manage
Speaker 1: something like this, then the the all the doors are
Speaker 1: open to you. So it's now something that vendors are
Speaker 1: really going to have to be cognizant of to make
Speaker 1: certain that the the product they send out has not
Speaker 1: been altered in any way. And this has made more
Speaker 1: challenging because obviously hackers are clever. They figure out ways
Speaker 1: to cover their footsteps, thank you, I mean, a good
Speaker 1: caer is anyway, right, A good hacker doesn't just figure
Speaker 1: out how to intrude on the system, they also figure
Speaker 1: out how to cover up that intrusion so that it's
Speaker 1: not immediately apparent. Yes, because a lot of companies have
Speaker 1: like they have really good intrusion detection software which will
Speaker 1: send them a red flag or notify several of the
Speaker 1: administrators that are working on that network immediately as soon
Speaker 1: as something is noticed, so that they can um assess
Speaker 1: the situation and cut off the threat. Yeah. And just
Speaker 1: to make this story even more scary, uh, there have
Speaker 1: been four major cybersecurity companies that have reported being compromised
Speaker 1: in some way or at least attacked by these hackers.
Speaker 1: One of the four says that no harm was done,
Speaker 1: and those would be fire Eye, which we mentioned before.
Speaker 1: That was the first company that came forward that kind
Speaker 1: of broke open the dam on on the discovery of this.
Speaker 1: Mike Soft as another, uh, malware bites which we learned
Speaker 1: about not too long before the recording of this. Yeah,
Speaker 1: like really recently and worse than that, not related directly
Speaker 1: to solar winds because they don't use solar winds products.
Speaker 1: We'll get back to that. And then CrowdStrike, which is
Speaker 1: the company that says, yeah, they tried, we didn't. Then
Speaker 1: they didn't and they didn't do anything. So good on them.
Speaker 1: But as for malware bites, they came forward and said, yes,
Speaker 1: we also have detected the presence of these hackers in
Speaker 1: our systems. But in our case it was because of
Speaker 1: an Office three sixty five email protection app that was
Speaker 1: dormant that they were able to target and get to
Speaker 1: our systems through that. So they were able to read
Speaker 1: some emails. So that tells us that potentially that could
Speaker 1: have been something they learned by being able to look
Speaker 1: at the source code over at Microsoft. We don't know
Speaker 1: that but that's possibly how that happened, was that they
Speaker 1: learned of a particular attack vector by scouring the source code,
Speaker 1: and thus we're able to have a secondary attack through
Speaker 1: a totally different approach and not have to depend upon
Speaker 1: solar winds at all. And if that's the case, if
Speaker 1: malware bites was targeted, then there's a really good chance
Speaker 1: that others were too and we just don't know about
Speaker 1: it yet. Yeah, that's an excellent example, and it kind
Speaker 1: of takes us back, you know, back to the beginning
Speaker 1: of the conversation, kind of explaining why the attackers were
Speaker 1: targeting these companies in the first place, because they're getting
Speaker 1: access to this crucial information that could potentially give them
Speaker 1: access to other people or other brands and companies in
Speaker 1: the future for completely different hacks that have nothing to
Speaker 1: do with solar winds. So so while we're we might
Speaker 1: be on the lookout for one type of attech, just
Speaker 1: like we did with what I was talking about the
Speaker 1: you know, election cycle, really taking a lot of cyber
Speaker 1: security attention. If we're all looking for one specific type
Speaker 1: of attack, that just means that there's opportunities for other attacks.
Speaker 1: In fact, this is sort of just the the cracker
Speaker 1: style of hacker, you know, the ones that specifically are
Speaker 1: are looking at how to infiltrate systems. It really just
Speaker 1: goes into their mindset, which is that all they care
Speaker 1: about is at first anyway, figuring out how do I
Speaker 1: infiltrate that system. That's that's their only focus. The problem
Speaker 1: with people who build these systems, they also are burdened
Speaker 1: with the weighty responsibility of making the system do whatever
Speaker 1: it was supposed to do, plus make it invulnerable to intrusion.
Speaker 1: But you have to make your system work first, right,
Speaker 1: So you're like, hey, everything works, and like, oh, you
Speaker 1: forgot about this way that a person could intrude to
Speaker 1: and and get access to your system without authorization. You think, well, shoot,
Speaker 1: I was just trying to make the thing go. Oh yeah,
Speaker 1: like straight up, even if you're like working in an office.
Speaker 1: I love giving those kind of examples because a lot
Speaker 1: of people work in offices. Uh, let's say they have
Speaker 1: to update the firmware on your printer and they have
Speaker 1: to disconnect it to make it invulnerable from some kind
Speaker 1: of attack. All of a sudden, they have to reauthorize
Speaker 1: all of the PCs to connect to that one printer.
Speaker 1: And that's a huge headache, and that creates even more work.
Speaker 1: So you have like all these people that are just
Speaker 1: trying to get their work done and you can't do
Speaker 1: anything from from the perspective of an employee. And yeah,
Speaker 1: and I'm definitely that guy who gets a little pop
Speaker 1: up in Windows that says, hey, we've got some updates.
Speaker 1: Do you want to reboot your system or do you
Speaker 1: wanna you know, and you're like no, I'm like no,
Speaker 1: twelve hours, tell me in twelve hours. And then after
Speaker 1: like four days, like no, seriously, my heart is going
Speaker 1: to come and take your computer if you don't update, Like, okay,
Speaker 1: you know what, We've had some fun, I'll go ahead
Speaker 1: and reboot. Uh. Yeah. So so this is this is
Speaker 1: fascinating to me, and I'm so thankful for you to
Speaker 1: join the show to help me kind of suss all
Speaker 1: this out because I kind of had a handle on it,
Speaker 1: but you really we opened up my eyes to other
Speaker 1: opportunities that, honestly, I mean, I just didn't think about.
Speaker 1: So that's exactly why I wanted you to to join
Speaker 1: the show and why I'm so thankful that you you
Speaker 1: said yes. After yeah, of course, after I bugged you
Speaker 1: while you were on holiday. Well, I'm I'm glad I
Speaker 1: was able to join you because there are so many
Speaker 1: different ways that you can look at this attack. So
Speaker 1: talking about all those different perspectives like I have been
Speaker 1: is really important to really understand and get ingrained into,
Speaker 1: like the motivations behind the solar winds attack, but also
Speaker 1: understand it from a client perspective why this has been
Speaker 1: so crucial and so important to so many people. And
Speaker 1: it's it's great to be able to have that sort
Speaker 1: of conversational approach. Where as I get my understanding, I
Speaker 1: hope that my listeners have gotten a deeper understanding of
Speaker 1: what's going on and why this is such a big
Speaker 1: deal and why it dominated tech news for a couple
Speaker 1: of weeks. Uh, you know, before we hear about Apple
Speaker 1: interfering with you know, defibrillators and things like that. Um
Speaker 1: So I'm sure we're going to hear a lot more
Speaker 1: about this over the coming months and potentially years as
Speaker 1: well as well. Inevitably we're going to hear about other
Speaker 1: hacks that are going to be compared against this, because,
Speaker 1: as you say, this is going to be a benchmark,
Speaker 1: This is this is a historic hack event. And will
Speaker 1: be one of those big ones we talked about for
Speaker 1: years to come, you know. Um, But Shannon, if people
Speaker 1: want to find your work and follow all the incredible
Speaker 1: things that you do, where would they go? Check out
Speaker 1: YouTube dot com slash Shannon Morse spelled just like my name.
Speaker 1: That's where I've been doing a lot of security and
Speaker 1: privacy as well as tech reviews too, and I do
Speaker 1: answer a lot of questions about security and privacy for consumers. Yeah,
Speaker 1: and if you hunt around, you can follow Shannon doing
Speaker 1: all sorts of crazy things like traveling the world when
Speaker 1: there's not a pandemic going on. And she takes really
Speaker 1: good photos. Me too. Me two. And it doesn't help
Speaker 1: that my wife will occasionally send me a picture of
Speaker 1: a place I really want to be in but cannot
Speaker 1: go to until it's very relatable. Yes, well, thank you again,
Speaker 1: and I will certainly have you back on tech stuff
Speaker 1: whenever you agree to do it. Well, thank you, Jonathan,
Speaker 1: I appreciate it. Thank you so much for having me.
Speaker 1: I hope you guys enjoyed the interview with Shannon Morrise
Speaker 1: and once again I have to thank her for coming
Speaker 1: onto the show. She is very generous with her time,
Speaker 1: so I greatly appreciate it, and I hope that that
Speaker 1: discussion gives you a deeper understanding and appreciation for the
Speaker 1: large challenge ahead in dealing with this hack, as well
Speaker 1: as just you know, something to think about for all
Speaker 1: of you folks managing stuff out there about things to
Speaker 1: look out for in the future. I mean, as Shannon
Speaker 1: points out, the real issue here is that the attack
Speaker 1: targeted something from a trusted source. So when you get
Speaker 1: a message that is from a trusted partner, you don't
Speaker 1: expect there to be malware in that. So this really
Speaker 1: is a major wake up call, and unfortunately it's a
Speaker 1: wake up call that's doing active damage right now. But
Speaker 1: hopefully we'll have better news to bring about the Solar
Speaker 1: Winds hack as time goes on and as people learn
Speaker 1: how to remediate those servers. In the meantime, if you
Speaker 1: guys have any suggestions for future topics I should cover
Speaker 1: on tech stuff, whether it's a company technology, a trend,
Speaker 1: something like the Solar Winds hack, or maybe there's somebody
Speaker 1: you would love for me to have on the show
Speaker 1: as a guest. Let me know. The best way to
Speaker 1: get in touch with me is over on Twitter. The
Speaker 1: handle for the show is text Stuff H s W
Speaker 1: and I'll talk to you again really soon. Text Stuff
Speaker 1: is an I heart Radio production. For more podcasts from
Speaker 1: I heart Radio, visit the i heart Radio app, Apple Podcasts,
Speaker 1: or wherever you listen to your favorite shows.