SolarWinds 2020: when a trusted software update carried an attack

Nabayn did not work on this incident. This is our analysis of what is on the public record, written so other organisations can learn from it.

Security advice always says to install your updates. So what happens when the update itself is the attack? That is the uncomfortable question raised by the SolarWinds compromise, and although it mainly affected large organisations, it changed how many people think about trusting their suppliers.

What happened

SolarWinds makes Orion, software that organisations use to manage their IT systems. The company says it and its customers were victims of a cyber attack on its systems that inserted a vulnerability, known as SUNBURST, within its Orion Platform software builds. The affected versions were 2019.4 HF 5, 2020.2 unpatched and 2020.2 HF 1. If present and activated, it could allow an attacker to compromise the server running Orion.¹

SolarWinds describes this as a very sophisticated supply chain attack.¹ In a supply chain attack, rather than breaking into their target directly, attackers compromise something the target already trusts and installs.

Who was behind it

In April 2021, the UK and US revealed that they believed Russia’s Foreign Intelligence Service, the SVR, was behind a series of intrusions, including this one. The UK’s National Cyber Security Centre assessed that it was highly likely the SVR was responsible for gaining unauthorised access to SolarWinds Orion software and for subsequent targeting.²

A state intelligence service is not likely to be interested in most small businesses. The lesson travels because the method does.

Why it was so hard to spot

Software companies digitally sign their releases, so customers can verify that the code came from them. SolarWinds uses such a code-signing certificate, and as part of its response, it revoked the certificate used to sign the affected versions and released rebuilt versions.¹

That shows the difficulty. To the customer, a compromised update can look just like a good one. It comes from the right company, through the normal channel, with the expected signature. All the usual signs of trust are present.

What a small business can learn

You cannot personally inspect the software you buy, and nobody is suggesting you stop updating. Updates fix far more problems than they cause. What you can do is reduce how much damage one compromised supplier could cause. These are our suggestions.

Know your suppliers. List the software and services that can reach your data: your website, accounts, email and booking system. Most small businesses have never written this down.

Give each tool only the access it needs. A plugin that adds a contact form does not need to be able to read every customer record.

Remove what you no longer use. Every old plugin, forgotten integration and unused account is one more door that needs watching.

Ask simple questions. Who can access our data? Do you offer two-step sign-in? How would you tell us about a breach? The government’s survey found few businesses review the risks posed by their suppliers, so simply asking puts you ahead.³

Keep good backups. Keep a copy somewhere your suppliers cannot reach, and check that you can restore it.

Have a plan to remove a supplier. If a provider was compromised tomorrow, could you switch it off quickly and keep working? Thinking about this in advance is much easier than during an incident.

If you build software, the same thinking applies to you. Everything you ship depends on things you did not write, as the Log4Shell case shows.

For the basics, read Cyber Essentials for small businesses.