SolarWinds: the attack that came through a trusted update

The story

SolarWinds is a company that makes software called Orion, used by businesses and governments to monitor their networks. In early 2020, attackers broke into SolarWinds and slipped a back door into Orion’s code before it was built.

Between March and June 2020, SolarWinds sent out updates containing the back door. About 18,000 customers installed them, as they would any routine update. The back door stayed quiet for about two weeks, then contacted the attackers. They chose a small number of targets for further access, including several US government departments and large technology companies.

The attack was discovered in December 2020 by the security company FireEye, which found the attackers inside its own network. The US government attributed it to Russia’s foreign intelligence service. The attackers had been inside some networks for months.

Why it mattered

This was a supply chain attack: the attackers compromised something every target already trusted, and the targets installed it themselves. It changed how governments and businesses think about the software they buy.

The lesson today

Every business depends on vendors it cannot fully check. The defense is to limit what each piece of software can reach, keep logs of what it does, and have someone watching for behavior that does not fit.