CISA just issued a rare emergency directive

[Nevilledog]

Link to tweet

Tweet text:
Dustin Volz
@dnvolz
New: CISA just issued a rare emergency directive instructing federal civilian agencies to review their networks and immediately power down SolarWinds products, saying the hack "poses unacceptable risks to the security of federal networks." https://wsj.com/articles/agencies-hacked-in-foreign-cyber-espionage-campaign-11607897866…
Image

Link to tweet

Tweet text:
Cybersecurity and Infrastructure Security Agency
@CISAgov
JUST RELEASED: Emergency Directive 21-01 calls on all federal civilian agencies to review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately. Read more: http://cisa.gov/news/2020/12/13/cisa-issues-emergency-directive-mitigate-compromise-solarwinds-orion-network…
10:03 PM · Dec 13, 2020

[jpak]

1. Trump

Yup

[mr_lebowski]

3. You know tomorrow the wingnuts are going to say this proves that the election was hacked, right?

ALL ACROSS their media infrastructure starting in the AM tomorrow, it will be a full court press ... can't move forward until this is ZOMG INVESTIGATED!!!1!!

Also they'll claim it 'proves' that 'CISA doesn't know what they're doing'.

As an aside, I don't think it's a coincidence this news dropped today.

[Captain Zero]

10. Ok. I looked up NTIA for those of us acronym challenged...

The National Telecommunications and Information Administration is an agency of the United States Department of Commerce that serves as the President's principal adviser on telecommunications policies ... Wikipedia

[abqtommy]

20. Thanks.

[dalton99a]

4. Kick

[Roisin Ni Fiachra]

21. Great post. That cartoon is copyrighted 2018. nt

[Brother Buzz]

5. In my perfect world Christopher Krebs would have announced this BEFORE the hack

I'm just saying

[DURHAM D]

6. JHFC ! nt

[My Pet Orangutan]

12. Indeed.

Root access to Federal networks - for months.

[LearnedHand]

7. This is some fucked up shit

Here’s the CISA emergency directive to shut SolarWinds servers the fuck down: https://cyber.dhs.gov/ed/21-01/

[honest.abe]

8. This looks serious.

The hack involves the NTIA's office software, Microsoft's Office 365. Staff emails at the agency were monitored by the hackers for months, sources said.

The hackers are "highly sophisticated" and have been able to trick the Microsoft platform's authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.

https://news.trust.org/item/20201213175137-8vsfr

[Sgent]

11. Its major

SolarWinds (the compromised vendor) is an enterprise management software for computers used by >400 of the Fortune 500, Treasury, Commerce, and all five military branches. Software that is incorporated into SW was compromised, and SW then signed it and the SW software was then installed on every single desktop, laptop and server in the organization. The SW software in managed environments will usually have admin rights, and would be able to access any information on the computers. The installed software also allowed the hackers to access the computers and upload / download additional software and data.

The only redeeming quality is this wasn't a burn it all down hack, it was an infiltrate and gather info -- meaning its probably not automated and the Russians would be limited due to manpower.

[My Pet Orangutan]

14. 'Every single desktop, laptop and server'. Jesus.

If it had been a burn it down hack, welcome to WWIV.

[Hermit-The-Prog]

13. "Microsoft" and "highly sophisticated" are like "tinker toys" and "F18 Hornet".

[My Pet Orangutan]

17. Visual Basic

[Hermit-The-Prog]

18. VB is the VD of computing. Wouldn't surprise me if it was involved.

[TomDaisy]

9. if this happened under Biden the GOP would be screaming bloody murder

[progree]

15. I saw a movie where a guy tried to shut down a computer

"that's something I cannot allow to happen"

[Hermit-The-Prog]

16. How much was trump's cut?

[Dark n Stormy Knight]

19. Always an appropriate question.

Trump's got dedicated bank account at Kickbacks R Us.

[Best_man23]

22. Another Information Source

The SANS Institute's Internet Storm Center tracks ongoing virus and malware, and had the SolarWinds story on its main page. The ISC content is highly technical, but they do their best to make the information as easily digestible as possible. They have scheduled a webcast for 5 PM EST today.

https://isc.sans.edu/?_ga=2.220397464.1677938191.1607951488-1686481652.1594861345