Scourge · December 13 2020

The Scourge of SUNBURST

Chronicle

On 13 December 2020, after FireEye discovered it had been breached, it emerged that attackers had inserted the SUNBURST backdoor into SolarWinds Orion updates shipped between March and June 2020. The poisoned update reached about 18,000 customers, who installed it trusting the vendor's signature. Only a small set of high-value targets were then actually exploited, including the US Treasury, Commerce and Homeland Security departments and Microsoft. The US government attributed the operation to Russia's foreign intelligence service, the SVR (APT29).

Lesson learned

It made software supply-chain security a government priority: signatures, reproducible builds and software bills of materials became the stuff of presidential executive orders.

Prayer of reparation

O SUNBURST, who came signed and blessed by the vendor, teach us to watch even our monitoring tools and never to believe that a signature alone makes an update holy. Amen.

How it is remembered

Remembered by protecting build systems as if they were production, restricting outbound traffic from management servers and asking vendors how they build what they sign.