{"id":275,"date":"2021-08-25T17:19:35","date_gmt":"2021-08-25T17:19:35","guid":{"rendered":"https:\/\/bigcompute.org\/?p=275"},"modified":"2023-09-19T19:11:10","modified_gmt":"2023-09-19T19:11:10","slug":"how-hackers-outsmarted-solarwinds-and-steve-harveys-funderdome","status":"publish","type":"post","link":"https:\/\/bigcompute.org\/blog\/how-hackers-outsmarted-solarwinds-and-steve-harveys-funderdome\/","title":{"rendered":"How Hackers Outsmarted SolarWinds and Steve Harvey’s Funderdome"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\n

\u201cSlice open the city and you\u2019ll find a dozen burglars tucked up inside, like some strange new diorama at the natural history museum. Attics, basements, walls, closets, and crawl spaces; alleys, parks, sewers, streets, and backyards: all of these margins and peripheries, subsidiary rooms and edge-spaces, are put to brilliantly unexpected use by people intent on stealing things.\u201d <\/em><\/p>\n<\/blockquote>\n\n\n\n

In the book A Burglar\u2019s Guide to the City<\/em>, researcher Geoff Manaugh peels back the layers on a metropolis, exposing the vulnerabilities exploited by expert criminals. While we law abiders are nearly blind to a poorly placed window or view a signpost as a purveyor of information and not an opportunely placed ladder, crooks are constantly scouting for tiny oversights that\u2019ll lead to a big score.<\/p>\n\n\n\n

On the internet, a bustling bazaar of both kookily dancing teenagers and 2,500+ Harvard and MIT courses<\/a>, cyber-swindlers have wormed their way into the digital nooks and crannies. Like a city, the web is also a cross-section of prowlers hidden in the corners of leaky APIs, outdated and unpatched operating systems, and sometimes in the ear of a hapless employee. <\/p>\n\n\n\n

Not every burglary involves lasering through a windowpane. Just as 34% of burglars stroll right through your unlocked front door<\/a>, most cybersecurity crimes happen due to basic human error: we just get outsmarted. <\/p>\n\n\n\n

In the SolarWinds hack, evildoers stealthily accompanied an already-welcomed guest: a software patch for an IT administration platform. Sometimes, all it takes is one backdoor, and bad actors can easily weave and worm their way into other connected systems, just like the Baltimore \u201cDrywall Burglar<\/a>\u201d that slunk through an entire city block of homes by cutting a pathway through the drywall of dozens of residences.<\/p>\n\n\n\n

These days, through the tightly interwoven web, you don\u2019t need to break into 18,000 doors to get to 18,000 victims\u2014you only need one. <\/p>\n\n\n\n

The interconnectedness of the web: a pro or con for cybersecurity? <\/h2>\n\n\n\n

Like the \u201cDrywall Burglar,\u201d the SolarWinds hack found one vulnerability and kept cutting through neighboring walls until they found the jackpot. The hack was discovered by a company called FireEye, much further downstream from the initial hack. Unknowingly, SolarWinds pushed an infected software patch to one of their products, Orion, an IT management tool used by FireEye and countless others. By nestling themselves in an aging technology\u2014FTP\u2014SolarWinds hackers were able to worm their way down the lunch line, snaking their way into 18,000 entities, including Fortune 500 companies and the federal government. You can hear more about their nitty-gritty strategy in this podcast episode, The SolarWinds Hack: What Happened?<\/em><\/p>\n\n\n\n