<story><title>SolarWinds hack was &apos;largest and most sophisticated attack&apos; ever: MSFT president</title><url>https://www.reuters.com/article/us-cyber-solarwinds-microsoft-idUSKBN2AF03R</url></story><parent_chain><item><author>jjcm</author><text>Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I&amp;#x27;m missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&lt;/a&gt;</text></item></parent_chain><comment><author>nimbius</author><text>Absolutely agree.  Solarwinds focuses a disproportionate amount of effort in ensuring it shows up favorably in Gartner magazine reviews and trade publications.  As a monitoring platform its a monolithic, expensive, slow and rather dated monitoring solution.  Agile does not come to mind, and you certainly wouldnt use it for anything approaching &amp;quot;observability.&amp;quot;&lt;p&gt;But the concerted marketing effort pays dividends.  Solarwinds is almost the only choice for government.  For potential attackers its a big red arrow.  Exploit a rent-seeking company that writes mediocre software and exists mostly to cash in on &amp;quot;best practice&amp;quot; lock-in with government contracts.&lt;p&gt;as far as i know nobodys really addressed the elephant in the room.  Solarwinds is &lt;i&gt;still&lt;/i&gt; a preferred government purchase for monitoring.  every company that was affected by it still uses it (or at least hasnt publically refuted it) and no government official has come forward to admit they will discontinue it.  Solarwinds hasnt offered any remediation or major changes in their development, leadership or code.  just patch, rinse, and repeat and try not to pay too much attention to the issue.</text></comment>
<story><title>SolarWinds hack was &apos;largest and most sophisticated attack&apos; ever: MSFT president</title><url>https://www.reuters.com/article/us-cyber-solarwinds-microsoft-idUSKBN2AF03R</url></story><parent_chain><item><author>jjcm</author><text>Largest impact, sure. But architecturally it was a relatively simple formula - compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. I disagree with this being the most sophisticated though. Unless I&amp;#x27;m missing something about this hack, the Stuxnet[1] architecture, complexity, and long term planning feel far more sophisticated than the SolarWinds hack.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Stuxnet&lt;/a&gt;</text></item></parent_chain><comment><author>stevemk14ebr</author><text>The attack is unique in its usage of the supply chain. The malware is not &amp;#x27;sophisticated&amp;#x27; in the same way stuxnet is because it has different goals. This actors goals align with stealth above all else, which is evident in both the design of the malware and the choice of the supply chain delivery vehicle. Also realize that the network comminication scheme used attempts to blend in with the legitimate SolarWinds software. If you design a stuxnet like malware and deploy it to 18k+ companies it will be found, because exploiting zero days left and right is super noisey. This malware was minimal. It&amp;#x27;s cool in a different way</text></comment>