Microsoft says it found 1,000-plus developers’ fingerprints on the SolarWinds attack

Microsoft’s analysis of the SolarWinds supply chain attack revealed that the code used by the threat actors was the work of a thousand developers.

Microsoft president Brad Smith provided further details about the investigation of the SolarWinds supply chain attack, the company’s analysis of the malicious code involved in the hack suggests it was the work of a thousand developers.

Smith shared Miscosoft’s findings with the US TV program 60 Minutes, he defined the attack as “the largest and most sophisticated attack the world has ever seen.”

“When we analysed everything that we saw at Microsoft, we asked ourselves how many engineers have probably worked on these attacks. And the answer we came to was, well, certainly more than 1,000.” Smith said.

“What we are seeing is the first use of this supply chain disruption tactic against the United States,”“But it’s not the first time we’ve witnessed it. The Russian government really developed this tactic in Ukraine.”

The discovery is disconcerting and could give us an idea of the complexity of the attack and of the effort spent by the threat actors.

Smith didn’t attribute the attack to a specific threat actor, he only pointed out that the offensive was comparable in effort to the attacks on the Ukraine power grid that were attributed to Russia-linked APT groups.

FireEye CEO Kevin Mandia was also interviewed as part of the same TV program and described how his experts discovered the attack when hackers attempted to bypass two-factor authentication.

“Just like everybody working from home, we have two-factor authentication. A code pops up on our phone. We have to type in that code. And then we can log in. A FireEye employee was logging in, but the difference was our security staff looked at the login and we noticed that individual had two phones registered to their name. So our security employee called that person up and we asked, “Hey, did you actually register a second device on our network?” And our employee said, “No. It wasn’t, it wasn’t me.” said Mandia.

“Suspicious, FireEye turned its gaze inward, and saw intruders impersonating its employees snooping around inside their network, stealing FireEye’s proprietary tools to test its clients defenses and intelligence reports on active cyber threats. The hackers left no evidence of how they broke in – no phishing expeditions, no malware.”

Smith also revealed that the core of the malicious code employed in the attack was composed of 4,032 lines.

“SolarWinds Orion” is one of the most ubiquitous software products you probably never heard of, but to thousands of I.T. departments worldwide, it’s indispensable. It’s made up of millions of lines of computer code. 4,032 of them were clandestinely re-written and distributed to customers in a routine update, opening up a secret backdoor to the 18,000 infected networks.” Smith explained. “Microsoft has assigned 500 engineers to dig in to the attack. One compared it to a Rembrandt painting, the closer they looked, the more details emerged.”

Chris Inglis, former Deputy Director at National Security Agency explained that the government did not detect this attack because it is not looking on private sector networks. The government did not find it on their network, so that’s a disappointment, the attack bypasses government defense systems like the “Einstein” platform designed to detect cyber attacks on government agencies.

“The Russians outsmarted it. They circumvented the NSA, which gathers intelligence overseas, but is prohibited from surveilling U.S. computer networks. So the Russians launched their attacks from servers set up anonymously in the United States.” concludes Inglis.

“U.S. Intelligence Community, U.S. Department of Defense, can suggest what the intentions of other nations are based upon what they learn in their rightful work overseas. But they can’t turn around and focus their unblinking eye on the domestic infrastructure. That winds up making it more difficult for us.”

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, SolarWinds)

[adrotate banner=”5″]

[adrotate banner=”13″]