Content by Mathew J. Schwartz

SolarWinds Describes Attackers' 'Malicious Code Injection'

Mathew J. Schwartz  •  January 12, 2021

Investigators probing the supply chain attack that hit SolarWinds say attackers successfully hacked the company's Microsoft Visual Studio development tools to add a backdoor into Orion network monitoring security software builds. They warn that other vendors may have been similarly subverted.

SolarWinds Hires Chris Krebs to Reboot Its Cybersecurity

Mathew J. Schwartz  •  January 8, 2021

As security software firm SolarWinds investigates the supply chain attack involving its Orion software and looks to rebuild its security processes and reputation, it's hired former U.S. cybersecurity czar Chris Krebs and former Facebook CSO Alex Stamos as advisers.

SolarWinds Attack: Pointing a Finger at Russia

Mathew J. Schwartz  •  January 6, 2021

Mounting evidence points to the "serious compromise" of SolarWinds' Orion software having been an intelligence gathering operation "likely" run by Russia, according to U.S. government agencies probing the supply chain attack. It's the first official attack attribution to be issued by the Trump administration.

Severe SolarWinds Hacking: 250 Organizations Affected?

Mathew J. Schwartz  •  January 5, 2021

As investigators probe the SolarWinds hack, they're finding that the supply chain campaign appears to have deeply compromised more than the 50 organizations originally suspected. Meanwhile, the federal agencies overseeing the investigation now officially believe a Russian-linked hacking group is responsible.

SolarWinds Orion: Fixes Aim to Block Sunburst and Supernova

Mathew J. Schwartz  •  December 29, 2020

Software vendor SolarWinds has updated multiple versions of its Orion network-monitoring software to address the Sunburst backdoor that was added to its code and to block Supernova malware that exploited a vulnerability in Orion. But incident response experts have warned that full cleanup may take years.

Are EU Privacy Regulators Starting to Find GDPR Consensus?

Mathew J. Schwartz  •  December 28, 2020

More than two years after Europe's tough new General Data Protection Regulation came into full effect, EU privacy watchdogs are finding more consensus, and consumers have been benefiting, experts say. But how regulators apply sanctions, in particular, remains a work in progress.

CISA Warns SolarWinds Incident Response May Be Substantial

Mathew J. Schwartz  •  December 24, 2020

Federal, state and local governments are among the many victims of the supply chain attack that backdoored the SolarWinds' Orion network-monitoring software, and victims "may need to rebuild all network assets" being monitored by the software, the U.S. Cybersecurity and Infrastructure Security Agency warns.

US Treasury Suffered 'Significant' SolarWinds Breach

Mathew J. Schwartz  •  December 22, 2020

An investigation at the U.S. Treasury Department has found that it suffered a "significant" breach as a result of the SolarWinds Orion supply chain attack, a top Democrat on the Senate Finance Committee reports. Meanwhile President-elect Joe Biden said of the attack: "I promise you, there will be a response."

SolarWinds Hack: Is NSA Doing the Same to Russia?

Mathew J. Schwartz  •  December 21, 2020

In light of calls from some quarters for the U.S. to launch online attacks in reprisal for the SolarWinds supply chain campaign - allegedly carried out by Russia's foreign intelligence service - it's time to pause and remember: Spies are going to spy.

FireEye: SolarWinds Hack 'Genuinely Impacted' 50 Victims

Mathew J. Schwartz  •  December 21, 2020

Hackers who infiltrated government and business networks via a stealthy backdoor added to SolarWinds' Orion software appear to have focused on only the most high-value targets, leading to about 50 organizations being "genuinely impacted," says FireEye CEO Kevin Mandia.

SolarWinds Supply Chain Hit: Victims Include Cisco, Intel

Akshaya Asokan , Mathew J. Schwartz  •  December 17, 2020

Intel and Cisco are among the thousands of SolarWinds Orion customers that were running a Trojanized version of the security software. FireEye, together with Microsoft and GoDaddy, have devised a "kill switch" to disrupt attackers' ability to access the malware on at least some infected systems.

Target Selection: SolarWinds' Orion 'Big Fish' Most at Risk

Mathew J. Schwartz  •  December 15, 2020

Following the discovery that attackers Trojanized SolarWinds' Orion software, expect the list of organizations that were running the backdoored network-monitoring tool to keep increasing. But with this being a suspected cyberespionage operation, attackers likely focused on only the juiciest targets.

SolarWinds Incident Response: 4 Essential Security Alerts

Scott Ferguson , Mathew J. Schwartz  •  December 14, 2020

What should incident responders grappling with the complex online attack campaign that successfully distributed a Trojanized version of SolarWinds Orion network monitoring software to customers focus on first? See these four essential alerts, which are already being updated.

7 Takeaways: Supply Chain Attack Hits SolarWinds Customers

Mathew J. Schwartz  •  December 14, 2020

Warning: The breach of FireEye disclosed last week traces to a sophisticated campaign involving Trojanized versions of SolarWinds Orion software used by hundreds of large businesses and government agencies. Experts are urging users to immediately upgrade the software and begin looking for signs of compromise.

Following FireEye Hack, Ensure These 16 Bugs Are Patched

Mathew J. Schwartz  •  December 10, 2020

Because 2020 wasn't already exciting enough, now we have to worry about being hunted by adversaries wielding FireEye's penetration testing tools, thanks to the company having suffered a big, bad breach. Here's a list of targeted flaws that every organization should ensure they've patched.