https://urgentcomm.com/wp-content/themes/ucm_child/assets/images/logo/footer-new-logo.png
  • Home
  • News
  • Multimedia
    • Back
    • Multimedia
    • Video
    • Podcasts
    • Galleries
    • IWCE’s Video Showcase
    • Product Guides
  • Commentary
    • Back
    • Commentary
    • Urgent Matters
    • View From The Top
    • All Things IWCE
    • Legal Matters
  • Resources
    • Back
    • Resources
    • Webinars
    • White Papers
    • Reprints & Reuse
  • IWCE
    • Back
    • IWCE
    • Conference
    • Special Events
    • Exhibitor Listings
    • Premier Partners
    • Floor Plan
    • Exhibiting Information
    • Register for IWCE
  • About Us
    • Back
    • About Us
    • Contact Us
    • Advertise
    • Terms of Service
    • Privacy Statement
    • Cookie Policy
  • Related Sites
    • Back
    • American City & County
    • IWCE
    • Light Reading
    • IOT World Today
    • Mission Critical Technologies
    • TU-Auto
  • In the field
    • Back
    • In the field
    • Broadband Push-to-X
    • Internet of Things
    • Project 25
    • Public-Safety Broadband/FirstNet
    • Virtual/Augmented Reality
    • Land Mobile Radio
    • Long Term Evolution (LTE)
    • Applications
    • Drones/Robots
    • IoT/Smart X
    • Software
    • Subscriber Devices
    • Video
  • Call Center/Command
    • Back
    • Call Center/Command
    • Artificial Intelligence
    • NG911
    • Alerting Systems
    • Analytics
    • Dispatch/Call-taking
    • Incident Command/Situational Awareness
    • Tracking, Monitoring & Control
  • Network Tech
    • Back
    • Network Tech
    • Interoperability
    • LMR 100
    • LMR 200
    • Backhaul
    • Deployables
    • Power
    • Tower & Site
    • Wireless Networks
    • Coverage/Interference
    • Security
    • System Design
    • System Installation
    • System Operation
    • Test & Measurement
  • Operations
    • Back
    • Operations
    • Critical Infrastructure
    • Enterprise
    • Federal Government/Military
    • Public Safety
    • State & Local Government
    • Training
  • Regulations
    • Back
    • Regulations
    • Narrowbanding
    • T-Band
    • Rebanding
    • TV White Spaces
    • None
    • Funding
    • Policy
    • Regional Coordination
    • Standards
  • Organizations
    • Back
    • Organizations
    • AASHTO
    • APCO
    • DHS
    • DMR Association
    • ETA
    • EWA
    • FCC
    • IWCE
    • NASEMSO
    • NATE
    • NXDN Forum
    • NENA
    • NIST/PSCR
    • NPSTC
    • NTIA/FirstNet
    • P25 TIG
    • TETRA + CCA
    • UTC
Urgent Communications
  • NEWSLETTER
  • Home
  • News
  • Multimedia
    • Back
    • Video
    • Podcasts
    • Omdia Crit Comms Circle Podcast
    • Galleries
    • IWCE’s Video Showcase
    • Product Guides
  • Commentary
    • Back
    • All Things IWCE
    • Urgent Matters
    • View From The Top
    • Legal Matters
  • Resources
    • Back
    • Webinars
    • White Papers
    • Reprints & Reuse
    • UC eZines
    • Sponsored content
  • IWCE
    • Back
    • Conference
    • Why Attend
    • Exhibitor Listing
    • Floor Plan
    • Exhibiting Information
    • Join the Event Mailing List
  • About Us
    • Back
    • About Us
    • Contact Us
    • Advertise
    • Cookie Policy
    • Terms of Service
    • Privacy Statement
  • Related Sites
    • Back
    • American City & County
    • IWCE
    • Light Reading
    • IOT World Today
    • TU-Auto
  • newsletter
  • In the field
    • Back
    • Internet of Things
    • Broadband Push-to-X
    • Project 25
    • Public-Safety Broadband/FirstNet
    • Virtual/Augmented Reality
    • Land Mobile Radio
    • Long Term Evolution (LTE)
    • Applications
    • Drones/Robots
    • IoT/Smart X
    • Software
    • Subscriber Devices
    • Video
  • Call Center/Command
    • Back
    • Artificial Intelligence
    • NG911
    • Alerting Systems
    • Analytics
    • Dispatch/Call-taking
    • Incident Command/Situational Awareness
    • Tracking, Monitoring & Control
  • Network Tech
    • Back
    • Cybersecurity
    • Interoperability
    • LMR 100
    • LMR 200
    • Backhaul
    • Deployables
    • Power
    • Tower & Site
    • Wireless Networks
    • Coverage/Interference
    • Security
    • System Design
    • System Installation
    • System Operation
    • Test & Measurement
  • Operations
    • Back
    • Critical Infrastructure
    • Enterprise
    • Federal Government/Military
    • Public Safety
    • State & Local Government
    • Training
  • Regulations
    • Back
    • Narrowbanding
    • T-Band
    • Rebanding
    • TV White Spaces
    • None
    • Funding
    • Policy
    • Regional Coordination
    • Standards
  • Organizations
    • Back
    • AASHTO
    • APCO
    • DHS
    • DMR Association
    • ETA
    • EWA
    • FCC
    • IWCE
    • NASEMSO
    • NATE
    • NXDN Forum
    • NENA
    • NIST/PSCR
    • NPSTC
    • NTIA/FirstNet
    • P25 TIG
    • TETRA + CCA
    • UTC
acc.com

Cybersecurity


Partner content

Hiding in plain sight: What the SolarWinds attack revealed about efficacy

Hiding in plain sight: What the SolarWinds attack revealed about efficacy

  • Written by Pieter Danhieux / Dark Reading
  • 22nd February 2021

If ever there was something to ruin Christmas in the cybersecurity industry, it’s a devastating data breach that is on track to becoming the largest cyberespionage event affecting the US government on record.

The SolarWinds attack is far reaching, with threat actors having initially breached the software as early as mid-2019. This months-long heist was discovered in December 2020 after the scheme was used to infiltrate prominent cybersecurity firm, FireEye, and the nightmare unraveled from there. The full scope of the breach is still being investigated, but key areas of infiltration include US Departments of State, Homeland Security, Commerce, and the Treasury, in addition to the National Institutes of Health.

This incident is going to have ongoing aftershocks, but the sheer sophistication of it is fascinating. At a technical level, it is a multilayered infiltration involving custom malicious tooling, backdoors, and cloaked code, far beyond the skill of script kiddies we so often see exploiting more obvious errors.

Code Laundering at Its Best Worst
CrowdStrike has done more of their genius work in reverse-engineering the exploit, and detailing the findings for all to see. It has now come to light that SolarWinds was the victim of an infrastructure breach, allowing malicious code injection into system updates, resulting in at least four separate malware tools opening up unprecedented access for the threat actors.

The method was covert, allowing for a strategic precision that seems straight out of a Jason Bourne novel. It bought time to sniff around, plan, and strike victims outside of the SolarWinds network exactly when they wanted, in a comprehensive supply chain attack. And it was all carried out with code that looked completely benign.

Cyberattacks are often the result of simple, yet costly, errors. Once discovered, the mistakes are fairly obvious; think a poorly configured network, passwords stored in plaintext, or unpatched software that sits vulnerable to known exploits. In this case, the code didn’t stand out at all, and not just to developers and security engineers. A wide myriad of expensive, complex security technology failed to detect it too.

Tools Rendered Virtually Useless
Security professionals are aided in their quest to safeguard enormous amounts of company data, software, and infrastructure, by a technology stack that is customized to the security needs of the business. This usually takes the form of components like network firewalls, automated penetration testing, monitoring and scanning tools, with the latter soaking up a lot of time in the software development process. This tooling can quickly spiral and become unruly to manage and execute, with many companies using upward of 300 different products and services.

To read the complete article, visit Dark Reading.

 

Tags: Alerting Systems Analytics Applications Artificial Intelligence Companies Critical Infrastructure Cybersecurity DHS Enterprise Federal Government/Military Incident Command/Situational Awareness News Policy Public Safety Security Software State & Local Government System Operation Test & Measurement Tracking, Monitoring & Control Training Partner content

Most Recent


  • Report: Remote work causing offices to empty, but walkable cities still in high demand
    Given the reliance on vehicular transportation in the United States, some American cities historically haven’t prioritized being walkable in past planning and or design. But amid an unprecedented shift in the economy toward remote work, those that have are increasingly desirable for prospective residents. A new report from Smart Growth American and Places Platform, “Foot Traffic Ahead […]
  • AT&T FirstNet unleashes robotic dogs for emergency services
    AT&T is releasing robotic hounds from Ghost Robotics as part of the service provider’s FirstNet emergency responder service. In a blog, AT&T VP Lance Spencer explained that the robotic dogs will be connected to AT&T’s network and deployed for public safety, defense, federal and state agencies, local police and fire departments, and commercial customers. “Network-connected robotic dogs can deliver a […]
  • Federal agencies infested by cyberattackers via legit remote-management systems
    It has come to light that hackers cleverly utilized two off-the-shelf remote monitoring and management systems (RMMs) to breach multiple Federal Civilian Executive Branch (FCEB) agency networks in the US last summer. On Jan. 25, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) released […]
  • How 5G is making cities safer, smarter, and more efficient
    It’s a scenario we’ve all experienced: an ambulance with a blaring siren racing against time to get a person in medical distress to a hospital through traffic. What we don’t see is 5G connectivity enabling paramedics to communicate with hospital staff via video conference and coordinate care in real-time before arriving at the emergency room. […]

Leave a comment Cancel reply

To leave a comment login with your Urgent Comms account:

Log in with your Urgent Comms account

Or alternatively provide your name, email address below:

Your email address will not be published. Required fields are marked *

Related Content

  • Hiding in plain sight: What the SolarWinds attack revealed about efficacy
    Newscan: Feds recover millions from pipeline ransom hackers, hint at U.S. Internet tactic
  • Cyber is the new Cold War, and AI is the arms race
  • Microsoft patches 6 zero-day vulnerabilities under active attack
  • IoT connectivity spending climbs as COVID-19 cases decline

Commentary


How 5G is making cities safer, smarter, and more efficient

26th January 2023

3GPP moves Release 18 freeze date to March 2024

18th January 2023

Do smart cities make safer cities?

  • 1
6th January 2023
view all

Events


UC Ezines


IWCE 2019 Wrap Up

13th May 2019
view all

Twitter


UrgentComm

Report: Remote work causing offices to empty, but walkable cities still in high demand dlvr.it/ShXM7Z

27th January 2023
UrgentComm

AT&T FirstNet unleashes robotic dogs for emergency services dlvr.it/ShW7p8

27th January 2023
UrgentComm

Federal agencies infested by cyberattackers via legit remote-management systems dlvr.it/ShVhn3

26th January 2023
UrgentComm

How 5G is making cities safer, smarter, and more efficient dlvr.it/ShVS1h

26th January 2023
UrgentComm

MCPTT interworking for critical communications dlvr.it/ShTm3P

26th January 2023
UrgentComm

Self-driving cars present terrorism risk, FBI director says dlvr.it/ShTTHx

26th January 2023
UrgentComm

UK Home Office officially will cut ESN ties with Motorola Solutions in December dlvr.it/ShNjfN

24th January 2023
UrgentComm

Newscan: Police software vendor breach exposes personal data, raid plans dlvr.it/ShN0q2

24th January 2023

Newsletter

Sign up for UrgentComm’s newsletters to receive regular news and information updates about Communications and Technology.

Expert Commentary

Learn from experts about the latest technology in automation, machine-learning, big data and cybersecurity.

Business Media

Find the latest videos and media from the market leaders.

Media Kit and Advertising

Want to reach our digital and print audiences? Learn more here.

DISCOVER MORE FROM INFORMA TECH

  • American City & County
  • IWCE
  • Light Reading
  • IOT World Today
  • Mission Critical Technologies
  • TU-Auto

WORKING WITH US

  • About Us
  • Contact Us
  • Events
  • Careers

FOLLOW Urgent Comms ON SOCIAL

  • Privacy
  • CCPA: “Do Not Sell My Data”
  • Cookie Policy
  • Terms
Copyright © 2023 Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and Head office is 5 Howick Place, London, SW1P 1WG.