Sophos News

SolarWinds breach: how to identify if you have been affected

  • Ross McKerchar

    • ** We will update this article with additional information as it becomes available. We have also published a playbook to guide any security team that has SolarWinds in their environment and is looking to initiate incident response. **

    Last updated: [2020-12-18  22:35 UTC] – view changelog

    SolarWinds, an IT monitoring specialist, reported last Sunday that it had fallen victim to a “highly-sophisticated, manual supply chain attack … likely by a nation state.”

    The compromised products are SolarWinds Orion versions 2019.4 through 2020.2.1.

    How to identify if you are running an impacted SolarWinds Orion version?

    Sophos customers can identify whether they are running a vulnerable version in multiple ways:

    Sophos MTR customers

    The MTR team is actively monitoring all protected customer environments and has already contacted affected customers directly to discuss remedial action.

    Sophos EDR customers

    EDR customers can run the dedicated query below to hunt for affected versions (updates will be posted here):

    SELECT
name,
version,
install_location,
publisher,
uninstall_string,
install_date
FROM programs where name like 'SolarWinds Orion%2020.2' or name like 'SolarWinds Orion%2020.2.1%' or name like 'SolarWinds Orion%2019.4%';

    Additionally, EDR customers can look for the following malicious DLL SHA256 hashes:·

    Anyone not using Sophos EDR can activate a 30-day free trial and run the query across your estate:

    All Sophos customers

    SophosLabs has published the following anti-malware detections for the compromised SolarWinds components:

    If you see one or more of these detections, you are exposed to potential attack.

    SophosLabs has also published the following detections for the known second-stage backdoor components:

    If you see one or more of these detections, you are likely a victim of targeted attack and should take additional remediation actions.

    Warning: check your configuration for scan exclusions. See https://twitter.com/ffforward/status/1338785034375999491 

    SophosLabs is in the process of releasing IPS signatures that identify Command-and-Control traffic from the active exploitation stages of the attack. The list of IPS signatures to monitor on Sophos XG Firewall is:

    If you see one or more of these IPS detections, you are likely a victim of targeted attack and should take additional remediation actions.

    We have blocked all associated IP and domain indicators.

    We have also revoked trust on the compromised SolarWinds certificate used in these attacks.

    Sophos Application Control detects all versions of SolarWinds Orion as “SolarWinds MSP Agent”. Application Control is an optional setting – read the Help Guide for instructions on how to enable it, and add SolarWinds to the list of apps you want to block.

    SophosLabs is continuing to investigate the attack and will be providing additional protection as necessary. Please monitor this location for further updates.

    What do to if you are impacted

    If you are running a compromised version, we recommend that you isolate the affected SolarWinds servers from the network.

    We also recommend rebuilding all impacted SolarWinds servers and installing Orion Platform version 2020.2.1 HF 2 which is now available. See https://www.solarwinds.com/securityadvisory for more details.

    We will be releasing further incident response guidance shortly. Contact your security team or partner for advice and support where needed.

    Sophos and SolarWinds

    Sophos is a SolarWinds Orion Customer. Upon receiving notification from SolarWinds, Sophos initiated incident response. We have undertaken incident response steps, which we also published at https://news.sophos.com/en-us/2020/12/14/solarwinds-playbook/ in the context of recommendations to other threat responders. In addition to incident response measures, we have now also undertaken precautionary forensics on our SolarWinds infrastructure, and our current assessment is that Sophos was not targeted in this attack.

    Change log

    2020-12-18 22:35 UTC Updated “Sophos and SolarWinds” section

    2020-12-18 16:28 UTC Updated “Sophos EDR customers” section with new malicious DLL SHA256 hashes.

    2020-12-16 14:03 UTC Added Troj/SunBurst-A to anti-malware detections

    2020-12-16 12:40 UTC Updated to state that Orion Platform version 2020.2.1 HF 2 is now available

    2020-12-16 12:27 UTC Updated to advise that the Sophos MTR team has now contacted all affected MTR customers

    2020-12-15 22:04 UTC Added Sophos detection names for second-stage backdoor components and XG IPS signatures for command and control traffic

    2020-12-15 21:00 UTC Added additional Sophos detections; add an additional Hash; add signatures to monitor for

    2020-12-15 12:24 UTC Added warning to check your configuration for exclusions

    2020-12-15 12:06 UTC Added link to Application Control help guide, and to advise that Application Control is an optional setting that needs to be enabled.

    2020-12-15 09:30 UTC Updated to add Mal/Sunburst-A to the list of Sophos detections; provide the Sophos AppControl detection; advise that we have blocked all associated IPs and domain indicators; add three further Hashes; and provide link to the playbook.

    2020-12-14 18:54 UTC Updated to advise that SophosLabs has revoked trust on the compromised SolarWinds certificate used in these attacks