SolarWinds’ Russia-linked hack targeting US government agencies and private companies may be worse than officials first realized, as about 250 federal agencies and companies are now believed to have been affected. The New York Times mentioned.
Microsoft said hackers were at risk SolarWinds Orion Monitoring and Management software, Which allows them to “impersonate any of the current user and user accounts of the organization, including the highly privileged accounts.” The Times Reports indicate that Russia has exploited layers of the supply chain to gain access to agency systems.
The Times Reports that Cyber Command and NSA’s early warning sensors have placed inside foreign networks to detect potential attacks appear to have failed in this case. In addition, it appears likely that the US government’s interest in protecting the November election from foreign hackers may have taken resources and focus away from the software supply chain, according to Times. It appears that carrying out the attack from inside the United States allowed the hackers to evade detection by the Department of Homeland Security.
Microsoft He said earlier this week It discovered that its systems had been compromised “beyond just the presence of malicious SolarWinds code”. The hackers were able to “view the source code in a number of source code repositories,” but the hacked account granting access did not have permission to modify any code or systems. However, in a little good news, Microsoft said it found “no evidence of accessing production services or customer data,” and “no indications that our systems have been used to attack others.”
Senator Mark Warner (Democrat, Virginia), a senior member of the Senate Intelligence Committee, told … Times The breakout looked “much worse” than initially feared. He said, “Its size is expanding.” “It’s clear that the United States government got it wrong.”