SolarWinds Hack: What Vladimir Putin Wants Every Business To Ignore

Summary of the SolarWinds Hack

Russian hackers inserted malicious code into a ubiquitous piece of network-management software (SolarWinds and other companies) used by a majority of governmental agencies, Fortune 500 companies and many cloud providers. The software potentially gives Russia an all-access pass into the data of breached organizations and their customers.

Immediate Steps to Protect Your Network

I would recommend having a conversation with your IT provider or security team about the following items, as much for future attacks as for the SolarWinds hack:

  • After reading through this summary, take a deeper dive into this WSJ white-paper: The SolarWinds Hack – What Businesses Need to Know
  • For small businesses, it is important that you check with any cloud software providers to make sure they have resolved any problems with affected software.
  • Patch all instances of SolarWinds network management software and all network management, security and operational software in your environment.
  • Make sure your security team keeps up with the latest fixes for the Sunspot virus.
  • Configure your network assets to be as isolated as possible so that your most confidential data caches are separate from less confidential data.
  • Review the security settings of every category of user on the system to tighten user-level access.
  • Make sure employees know the proper procedures for connecting remotely to your network. Verify that they aren’t using a free personal VPN to connect.
  • If you utilize Microsoft products, keep up to date with their Investigation Updates.
  • If there is a chance you have been affected, have a full security audit done of your network.

Details of the SolarWinds Hack

During the worst possible time – a contentious presidential transition and a global pandemic – dozens of federal government agencies, among them the Defense, Treasury and Commerce, were breached by a cyber espionage campaign launched by the Russian foreign-intelligence service (SVR). The SVR is also linked to hacks on government agencies during the Obama Administration.

Senator Angus King said Putin “doesn’t have the resources to compete with us using conventional weapons, but he can hire about 8,000 hackers for the price of one jet fighter.”

In addition to internal communications being stolen, the operation exposed hundreds of thousands of government and corporate networks to potential risk. The hackers infiltrated the systems through a malicious software update introduced in a product from SolarWinds Inc., a U.S. network-management company. This allowed unsuspecting customers of their software to download a corrupted version of the software with a hidden back door allowing hackers to access their networks from “inside the house”. SolarWinds has more than 300,000 customers world-wide, including 425 of the U.S. Fortune 500 companies. Some of those customers include: the Secret Service, the Defense Department, the Federal Reserve, Microsoft, Lockheed Martin Corp, PricewaterhouseCoopers LLP, and the National Security Agency. (Note: more recently, it has been discovered that SolarWinds wasn’t the only primary software infected.)

A Solar Winds spokesperson said the company knew of a vulnerability related to updates of its Orion technology management software and that the hack was the result of a highly sophisticated, targeted and manual supply chain attack by a nation state. Like the FireEye breach, this was not a broad attack of many systems at once, but a stealthy, patiently-conducted campaign that required “meticulous planning and manual interaction.”

SolarWinds Hack was a Supply Chain Attack

These supply-chain attacks reflect a trend by hackers in which they search for a vulnerability in a common product or service used widely by multiple companies. Once breached, it spreads widely across the internet and across dozens or even hundreds of companies before the compromises are detected. Many companies have increased their level of cyber-protections, but they do not scrutinize the software that their suppliers provide. This is a concern because corporations typically have dozens of software suppliers. For example, in the banking industry, the average number of direct software suppliers is 83. In IT services, it’s 55.

To understand the severity and national-security concerns of this breach, think of this as a “10 on a scale of one to 10”. The Cybersecurity and Infrastructure Agency ordered the immediate shut down of use of SolarWinds Orion products. Chris Krebs, the top cybersecurity official at the Department of Homeland Security until his recent firing by Trump, stressed any Orion users should assume they have been compromised. Other investigators say that merely uninstalling SolarWinds will not solve the threat and that recovery will be an uphill battle unlike any we have ever seen. While the hackers may not have gained complete control of all companies, all experts agree that it will take years to know for certain which networks the Russians control and which ones they just occupy and to be assured that foreign control has been negated. Because they will be watching whatever moves we make—from the inside.


John Sileo is a cybersecurity expert, privacy advocate, award-winning author and media personality as seen on 60 Minutes, Anderson Cooper and Fox & Friends. He keynotes conferences virtually and in person around the world. John is the CEO of The Sileo Group, a business think tank based in Colorado.

Nancy Pelosi Laptop Stolen for Sale to Russia by Capitol Rioter

And my prediction about the hidden risk in the capitol riot appears to be coming true…

“There are growing concerns that U.S. adversaries may be seeking ways to benefit from the Capitol assault – and that some of rioters may have been looking to work with them.

The FBI is investigating claims that Riley June Williams stole a laptop or or hard drive from the office of House Speaker Nancy Pelosi (D-Calif.) and intended to sell the device to Russia’s intelligence services by way of a friend who lives in the country.

“The idea that a group of so-called ‘patriots’ would sell a government computer to the Russians should tell you everything you need to know about the people who assaulted the Capitol,” Sen. Mark R. Warner (D-Va.), incoming chairman of the Senate Intelligence Committee, said in a statement. “There are real counterintelligence concerns associated with a breach like the one that occurred on January 6th.”

Keep Reading about the stolen Pelosi laptop in The Washington Post.

The Massive U.S. Capitol Attack We’re Ignoring

Capitol Attack Could Go Way Beyond a Physical Breach

When Trump supporters occupied the US Capitol last week, hundreds of rioters gained unrestricted access to the offices of our Representatives and Senators . You can see one such invader sitting here in House Speaker Nancy Pelosi’s office. But we have to ask ourselves, did the breach stop there?

What we see in these images is not just a physical petentration of the very symbol of our democracy, but potentially a coordinated cyberbreach as well. In addition to ransacked filing cabinets, exposed desktops and confidential documents waiting to be shredded, it’s nearly certain that laptops were stolen, mobile devices pocketed and malware-enabled USB devices plugged into the same computers that run our government. From years of studying organized crime, let me assure you that any mob that has so premeditated an attack that they bring chemical agents and pipe bombs to the riot, has likely planned a corresponding cyber intrusion as well. In fact, physical destruction in corporate cybercrime is often just a diversionary tactic to keep investigators from focusing on a far more damaging digital takeover.

What if the rioters had access to and were reading all of the emails between Congress and the Capitol Police prior to the inauguration? What if they have the ability to freeze congressional computers during an impeachment procedure or transitional handoff?

As the FBI and Secret Service investigate members of the seditious mob attempting insurrection on American soil, I implore them to not forget the hallowed DIGITAL ground that underlies our legislative branch of government – and our way of life.

Twitter Hack Reminds Us That David Can Still Fell Goliath

twitter_hack_david

The twitter hack began as a quiet scheme to steal and sell unusual user names, which carry high currency in gamer and hacker circles.

But as the day wore on, the attack took over dozens of accounts belonging to corporations like Apple and celebrities like Joe Biden, Barack Obama, Bill Gates, Elon Musk and Kanye West. The hackers used the celebrity access to appeal to their followers for funds:

twitter hack of Joe Biden's accountAt least $180,000 worth of Bitcoin flowed into the hackers’ accounts.

By the time the hackers were done, they had broken into 130 accounts and dramatically exposed gaping holes in Twitter’s security.

What organized Goliath cybercrime ring was responsible?

Seventeen-year-old Florida resident, Graham Ivan Clark (David, for the purpose of this metaphor).

From the affidavit:

Graham Ivan Clark, 17  without authorization gain [sic] access to Twitter Inc.’s Customer Service Portal. Clark used social engineering to convince a Twitter employee that he was a co-worker in the IT department and had the employee provide credentials to access the customer service portal.

Clark then accessed the Twitter accounts of prominent individuals, including VP Joe Biden, former President Barack Obama and business [sic] such as Apple and Coinbase. Clark then posted on their Twitter accounts a communication that if Bitcoins are sent to accounts they will be doubled and returned to the victim. 

Despite the hackers’ cleverness, their plan quickly fell apart, according to court documents. They left hints about their real identities and scrambled to hide the money they’d made once the hack became public. Their mistakes allowed law enforcement to quickly track them down.

If Twitter, a company that spends millions on security ever year, can be hacked by a 17-year-old, so can your organization. But it wasn’t the technology that was hacked, it was the people. 

It is no surprise that the twitter hackers used the same tool that leads to a majority of damaging corporate breaches: social engineering. Twitter says that a few employees were targeted in a phone spear phishing attack, which suggests that hackers called Twitter employees while posing as members of the Twitter’s security team, and got them to reveal the credentials they use to access internal systems.

Once inside the system, they had free rein to do anything they wanted with any Twitter account. The next time this breach happens, the criminals will be more organized, and will use their access to launch a much more devious, lucrative scheme.

I hope Twitter invests as readily in their security awareness training and social engineering defenses as they do on their technology. And I hope you do as well, as it’s no fun to be beaten by David.


John Sileo is a cybersecurity expert, award-winning author and media personality as seen on 60 Minutes, Anderson Cooper and Fox & Friends. He keynotes conferences virtually and around the world and is the CEO of The Sileo Group, a technology think tank based in Colorado

Don’t Be Naive: Obama/Biden “Twitter Hack” Not What It Seemed

Photo Courtesy of the BBC.

twitter hack

I’m betting that the recent Twitter hack of prominent political and celebrity Twitter accounts was politically motivated and nation-state operated. But that’s not what “the investigators” say. And that false narrative could have massive implications for your privacy. Here’s the background in a nutshell:

Approximately 130 high-profile Twitter accounts were hacked on July 15 in what the company is calling a “coordinated social engineering attack”.  Victims included politicians like Barack Obama and Joe Biden, heads of mega companies like Tesla CEO Elon Musk, Amazon CEO Jeff Bezos and Microsoft CEO Bill Gates, and company accounts like Apple and Uber. Ironically, Donald Trump’s account has “extra security” protecting it from access, which begs the question, why don’t we all get added security if it’s possible?

Using various angles (“feeling grateful”, “giving back to my fans”…), hackers posted tweets on the compromised accounts saying that if followers sent Bitcoin to a wallet address then they would receive double the amount in return. No one falls for those scams anymore, right? At least 363 transactions occurred and the account received more than $118,000 in just a few hours. 

Investigators believe the people behind the twitter hack appear to have come from the “OG” community, a group interested in original, short Twitter handles such as @a, @b or @c, for instance. It is thought that they worked with at least one Twitter employee to gain access to an internal tool that allows staff to change email addresses associated with accounts; the hackers were able to reset the passwords of 45 of the accounts. The OG Community is not known to be tied to any nation state and their motivation is supposedly a mix of financial gain, hacker bragging rights, and disruption. So let me get this straight:

Experts are saying that cybercriminals got their hands on the Twitter accounts of 45 of the most powerful people on the planet and the best they could come up with was a tired Bitcoin scheme that made them $118,000? That’s pocket change to cybercriminals, and might be the lamest attribution for a hack I’ve ever heard. 

The key words above are “The OG Community is not known to be tied to any nation state” which is exactly why a nation-state like Russia would use technological tools like TOR’s Onion Router and trumped up OG user accounts to hide behind a plausible, alternative hacking group that would take the attention off of the real motivation. I can’t tell you how many historical cyberattacks I have seen that have been digitally disguised behind a highly-attractive alternative reality. 

Here is a fundamental law of cyberattacks: Hacker attribution (who actually performed the hack) and hacker motivation (why the hack was performed), is an exceptionally difficult puzzle to solve, and often manipulates outsiders in exactly the opposite direction. 

Twitter says no passwords were stolen, but they have not yet been able to confirm whether direct messages were compromised. I’m guessing that it will come out down the road that both passwords and direct messages were compromised. That’s how the corporate publicity machine works: the first message claims little damage and the truth comes out subsequently when we have all stopped paying attention (e.g., Target, Equifax, Marriott…).

So What Was the Point of the Twitter Hack – $118,000? NOT!

Clearly, nation-states don’t need $118,000 in Bitcoin, right? The twitter hack was simply a dry run for political disinformation attacks, cyber blackmail and campaign IP eavesdropping that will manifest closer to our presidential election. Nation-states that have a horse in the U.S. presidential race were testing the waters and covering their tracks by pointing to a plausible alternative explanation.

Yes, this hack raises questions about Twitter’s ability to secure its service against election interference and misinformation ahead of the U.S. presidential election, but those questions have existed for at least four years now. It also threatens the confidentiality and privacy of direct messages sent through Twitter; incredibly powerful information in the race for power. Politicians, business leaders and individuals alike should migrate their private messages to apps like Signal or even the less secure but better than Twitter option of Apple Messages. 


John Sileo is a cybersecurity expert, award-winning author and media personality as seen on 60 Minutes, Anderson Cooper and Fox & Friends. He keynotes conferences virtually and around the world and is the CEO of The Sileo Group, a technology think tank based in Colorado