About That Biggest Data Breach In U.S. History Discovered Back in December 2020

[ancianita]

Last edited Tue Mar 23, 2021, 04:17 PM - Edit history (1)

Notes here are from links below. I hope they make sense of this BFD.

What

The cyber attack,]undetected for months, was first publicly reported on December 13, 2020, and was initially only known to have affected the
-- U.S. Treasury Department ...
-- National Telecommunications and Information Administration (NTIA),
-- part of the U.S. Department of Commerce.[42] In the following days, more departments and private organizations reported breaches.

The cyberattack that led to the breaches began no later than March 2020. The attackers exploited software or credentials from at least three U.S. firms: Microsoft, SolarWinds, and VMware. A supply chain attack on Microsoft cloud services provided one way for the attackers to breach their victims, ... A supply chain attack on SolarWinds's Orion software, widely used in government [see Krebs on Security below] and industry ...
Flaws in Microsoft and VMware products allowed the attackers to access emails and other documents, and to perform federated authentication across victim resources via single sign-on infrastructure.

The government breach through the software Solar Winds...
SolarWinds said of its 300,000 customers, 33,000 use Orion.
Of these, around 18,000 government and private users downloaded compromised versions.
... Compromised versions were known to have been downloaded by the Centers for Disease Control and Prevention, the Justice Department, and some utility companies...

Impact

...the information stolen in the attack would increase the perpetrator's influence for years to come.
...future uses could include attacks on hard targets like the CIA and NSA,[how?] or using blackmail to recruit spies.
Cyberconflict professor Thomas Rid said the stolen data would have myriad uses. He added that
... if printed would form a stack far taller than the Washington Monument.

In addition to the theft of data, the attack caused costly inconvenience to tens of thousands of SolarWinds customers, who had to
-- check whether they had been breached ...
-- take systems offline and
-- begin months-long decontamination procedures as a precaution.

...it appeared that the attackers had deleted or altered records, and may have modified network or system settings in ways that could require manual review.
Former Homeland Security Advisor Thomas P. Bossert warned that it could take years to evict the attackers from US networks, leaving them able to continue to monitor, destroy or tamper with data in the meantime.

Harvard's Bruce Schneier, and NYU's Pano Yannakogeorgos, founding dean of the Air Force Cyber College, said that affected networks may need to be replaced completely.

Through a manipulation of software keys, Russian hackers were able to access the email systems used by the Treasury Department's highest-ranking officials. This system, although unclassified, is highly sensitive because of the Treasury Department's role in making decisions that move the market, as well as decisions on economic sanctions and interactions with the Federal Reserve.

U.S. Senator Richard J. Durbin described the cyberattack as tantamount to a declaration of war. President Donald Trump was silent for days after the attack, before suggesting that China, not Russia, might have been responsible for it, and that "everything is well under control".

Response -- a brief timeline

On December 14, 2020, the CEOs of several American utility companies convened to discuss the risks posed to the power grid by the attacks. On December 22, 2020, the North American Electric Reliability Corporation asked electricity companies to report their level of exposure to Solarwinds software.

SolarWinds unpublished its featured customer list after the hack, although as of December 15, cybersecurity firm GreyNoise Intelligence said SolarWinds had not removed the infected software updates from its distribution server.

Around January 5, 2021, SolarWinds investors filed a class action lawsuit against the company in relation to its security failures and subsequent fall in share price.
Soon after, SolarWinds hired a new cybersecurity firm co-founded by Krebs.

The Linux Foundation pointed out that if Orion had been open source, users would have been able to audit it, including via reproducible builds, making it much more likely that the malware payload would have been spotted.

The Administrative Office of the United States Courts initiated an audit, with DHS, of the U.S. Judiciary's Case Management/Electronic Case Files (CM/ECF) system, then stopped accepting highly sensitive court documents to the CM/ECF, requiring those documents only in paper form or on airgapped devices.

The above notes are from this link, which contains charts of who was hit, and what the government and private sector response has been.

https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach#Investigations_and_responses

My oldest son, who works for Palo Alto Securities, also hit, has said nothing.
I've always believed that this government's commitment to Microsoft's PC OS was unwise, made its data building no more solid than swiss cheese. I've always held that this government would do well to completely change its database networks to Apple -- or at least diversify its networks to include Apple.
No amount of replacement cost would be greater than the losses this nation has already suffered, in keeping its own developed information, in operational strength of our electrical grids, in enforcing rule of law through its justice system, in attacks on covid health care information and treatment systems. On one level, we've been laid wasted as a government and as a people. No, Apple's Mac OS is not a panacea, but a diversification that, in the long run, could just save the US from further hacks and theft, if not attacks. Just my opinion.

Notes from Slashdot:

... the federal court document system was "hit hard," by the SolarWinds attackers, which multiple U.S. intelligence and law enforcement agencies have attributed as "likely Russian in origin."
... The report notes that Administrative Office (AO) of the U.S. Courts' document system "may contain highly sensitive information, including intellectual property and trade secrets, or even the identities of confidential informants...
..."the system is full of sensitive sealed filings -- such as subpoenas for email records and so-called 'trap and trace' requests that law enforcement officials use to determine with whom a suspect is communicating via phone, when and for how long...

https://yro.slashdot.org/story/21/01/08/0348247/sealed-us-court-records-exposed-in-solarwinds-breach

https://yro.slashdot.org/submission/13047042/sealed-us-court-records-exposed-in-solarwinds-breach?sdsrc=rel

notes from Chris Krebs' site

https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/

“This would be a treasure trove for the Russians knowing about a lot of ongoing criminal investigations,” Weaver said. “If the FBI has indicted someone but hasn’t arrested them yet, that’s all under seal. A lot of the investigative tools that get protected under seal are filed very early on in the process, often with gag orders that prevent [the subpoenaed party] from disclosing the request.”

Final thoughts

Who would benefit from knowing what's in all those sealed docs but pendejo45.
Who could then, do his party 'a favor, though,' and from McCarthy to Brooks -- who now thinks he will get off long enough to win a senate seat in 2022 -- bend them to his goals, to a man.

The American public needs to know about this greatest breach in US history, who did it, who benefits and what Congress, the DOJ, Homeland, and the President (lookin' at his 3-letter agencies) are going to do about it.

Americans need to realize the depths of influence that go beyond
personal party politics, what influence this has had on congressional "bipartisan" politics and
the climate of Congress.
Americans should know that its very existence darkens any media fomenting of doubt and division about Democrats' ability to undo the damage of the last five years.

[alwaysinasnit]

1. k&r for visibility

I know and agree that this is some serious shit, but oh ancianita, you are precious - "pendejo45"

[Sentath]

2. Wow

That is just Waaay Too Much for me to reply to in a coherent fashion right now. But the conclusion feels pretty inarguable. Maybe we don't need details, delicate hidden things ought to be handled delicately. But, we do need to know that they are being addressed with seriousness and vigor at high levels.

[Hermit-The-Prog]

3. Microsoft: Incompetent since inception.

Why do we continue to pay billions to the world's most incompetent software maker to rent software that's flawed, including deliberate flaws? Everything accomplished by that lousy software can be accomplished with FOSS (Free (as in libre) Open Source Software), which is more robust, reliable, and customizable.

[ancianita]

4. Seriously. Even government back then could have figured that out.

I am ALL for open source. I don't think it could apply to the military or our cabinet with huge databases, but for public use, yes.

[Hermit-The-Prog]

5. It can apply to everything.

You just have to choose software with the right license, or roll your own.

All Microsoft software in governments can be replaced. I think it's telling that Microsoft had to consult with the Samba team in order to be able to produce the documentation the EU court ordered. Samba knew more about the protocols of Windows servers than MS did.

[ancianita]

6. Yep.

I didn't know about the Microsoft challenge from the EU court. Interesting. If you have a link or two, I'd appreciate reading more on that. All I can think is that in the US, Microsoft and its OS were "first to market," and that our government made a decision back then, which out of ignorance it never reviewed once there were better OSs out there. A government overhaul could have been done so much more cheaply in the oughties.