A Russian hacking campaign has struck several federal agencies, according to security companies and news reports.
Earlier this year, hackers compromised software made by a cybersecurity company you might not have heard of. The infiltration led to a massive malware campaignthat's now affecting US federal agencies as well as governments around the world, according to the security firm and news reports.
The hacked company, SolarWinds, sells software that lets an organization see what's happening on its computer networks. Hackers inserted malicious code into an updated version of the software, called Orion. Around 18,000 SolarWinds customers installed the tainted updates onto their systems, the company said.
Subscribe to CNET Now for the day's most interesting reviews, news stories and videos.
The compromised update process has had a sweeping effect, the scale of which keeps growing as new information emerges. Based on newspaper reports, the company's statements and analysis from other security firms, a Russian intelligence agency reportedly carried out a sophisticated attack that struck several US federal agencies and private companies including Microsoft.
On Saturday, President Donald Trump floated on Twitter the idea that China might be behind the attack. Trump, who didn't provide evidence to support the suggestion of Chinese involvement, tagged Secretary of State Mike Pompeo, who had earlier said in a radio interview that "we can say pretty clearly that it was the Russians that engaged in this activity."
US national security agencies issued a joint statement Wednesday acknowledging a "significant and ongoing hacking campaign" that's affecting the federal government. It's still unclear how many agencies are affected or what information hackers might have stolen so far, but by all accounts the malware is extremely powerful. According to analysis by Microsoft and security firm FireEye, both of which were also infected with the malware, it gives hackers broad reach into impacted systems.
On Thursday, Politico reported that systems at the Department of Energy and the National Nuclear Security Administration were also affected. Also on Thursday, Microsoft said it had identified more than 40 customers that were targeted in the hack. More information is likely to emerge about the hack and its aftermath. Here's what you need to know about the SolarWinds hack:
Hackers managed to access a system that SolarWinds uses to put together updates to its Orion product, the company explained in a filing with the SEC. From there, they inserted malicious code into otherwise legitimate software updates. This is known as a supply-chain attack, because it infects software while it's being assembled.
It's a big coup for hackers to pull off a supply-chain attack, because it packages their malware inside a trusted piece of software. Instead of having to trick individual targets into downloading malicious software with a phishing campaign, the hackers could rely on several government agencies and companies to install the Orion update at SolarWinds' prompting.
The approach is especially powerful in this case because hundreds of thousands of companies and government agencies around the world reportedly use the Orion software. With the release of the tainted software update, SolarWinds' vast customer list became potential hacking targets.
According to reports from Reuters, The Washington Post and TheWall Street Journal, the malware affected the US Homeland Security, State, Commerce and Treasury Departments, as well as the National Institutes of Health. Politico reported on Thursday that nuclear programs run by the US Department of Energy and the National Nuclear Security Administration were also targeted.
It's still unclear what information, if any, was stolen from the federal agencies, but the amount of access appears to be broad.
Though the Department of Energy and the Commerce Department have acknowledged the hacks to news sources, there's no official confirmation that other specific federal agencies have been hacked. However, the US Cybersecurity and Infrastructure Security Agency put out an advisory urging federal agencies to mitigate the malware, noting that it's "currently being exploited by malicious actors."
In a statement Thursday, President-elect Joe Biden said his administration will "make dealing with this breach a top priority from the moment we take office."
In addition to gaining access to several government systems, the hackers turned a run-of-the-mill software update into a weapon. That weapon was pointed at thousands of groups, not just the agencies and companies that the hackers focused on after they installed the tainted Orion update.
Microsoft president Brad Smith called this "an act of recklessness" in a wide-ranging blog post that explored the ramifications of the hack. He didn't directly attribute the hack to Russia, but described its previous alleged hacking campaigns as proof of an increasingly fraught cyber conflict.
"This is not just an attack on specific targets," Smith said, "but on the trust and reliability of the world's critical infrastructure in order to advance one nation's intelligence agency." He went on to call for international agreements to limit the creation of hacking tools that undermine global cybersecurity.
Former Facebook cybersecurity chief Alex Stamos said on Twitter that the hack could lead to supply-chain attacks becoming more common. However, he questioned whether the hack was anything out of the ordinary for a well resourced intelligence agency.
"So far, all of the activity that has been publicly discussed has fallen into the boundaries of what the US does regularly," Stamos said.
Yes. Microsoft confirmed Thursday that it found indicators of the malware in its systems, after confirming Sunday that the breach was affecting customers of its cybersecurity services. A Reuters report also said that Microsoft's own systems were used to further the hacking campaign, but Microsoft denied this claim to news agencies. On Wednesday, the company began quarantining the versions of Orion known to contain the malware, in order to cut hackers off from its customers' systems.
FireEye also confirmed last week that it was infected with the malware and was seeing the infection in customer systems as well.
Other than FireEye and Microsoft, it isn't clear which of SolarWinds' private sector customers saw malware infections. The company's customer list includes large corporations, such as AT&T, Procter & Gamble and McDonald's. The company also counts governments and private companies around the world as customers. FireEye says many of those customers were infected.
Unnamed US government officials have reportedly told news outlets that a hacking group widely believed to be a Russian intelligence agency is responsible for the malware campaign. SolarWinds, cybersecurity firms and US government statements have attributed the hack to "nation-state actors" but haven't named a country directly.
In a statement on Facebook, the Russian embassy in the US denied responsibility for the SolarWinds hacking campaign. "Malicious activities in the information space contradict the principles of the Russian foreign policy, national interests and our understanding of interstate relations," the embassy said, adding, "Russia does not conduct offensive operations in the cyber domain."
Nicknamed APT29 or CozyBear, the hacking group named by news reports has previously been blamed for targeting email systems at the State Department and White House during the administration of President Barack Obama. It was also named by US intelligence agencies as one of the groups that infiltrated email systems at the Democratic National Committee in 2015, but the leaking of those emails isn't attributed to CozyBear. (Another Russian agency was blamed for that.)
More recently, the US, UK and Canada have identified the group as responsible for hacking efforts that tried to access information about COVID-19 vaccine research.
The rest is here:
Microsoft head calls SolarWinds hack 'act of recklessness': What you need to know - CNET
- Amazon just slashed the price of our favorite budget home security camera - Tom's Guide - March 14th, 2024 [March 14th, 2024]
- Los Angeles Police Department warning home owners to hard-wire home security systems as organized theft rings ... - Notebookcheck.net - March 14th, 2024 [March 14th, 2024]
- Mesa family upping home security as burglaries increase - Yahoo! Voices - March 14th, 2024 [March 14th, 2024]
- An attempted kidnapping in Glendale is caught on camera - The Arizona Republic - March 14th, 2024 [March 14th, 2024]
- Best Security Systems For Apartments Of 2024 Forbes Home - Forbes - March 14th, 2024 [March 14th, 2024]
- Airbnb's Unexpected Home Security Ban Sets A New Standard For Rental Property Owners - House Digest - March 14th, 2024 [March 14th, 2024]
- Wayward 450-pound pig named Kevin Bacon hams it up for home security camera - The Associated Press - March 14th, 2024 [March 14th, 2024]
- The Best Home Security Cameras According To Rigorous, Hands-On Testing - Forbes - March 14th, 2024 [March 14th, 2024]
- Best home security deal: Get the Arlo Essential Wired Video Doorbell for just $49.99 at Amazon. - Mashable - March 14th, 2024 [March 14th, 2024]
- The 6 Hottest Outdoor Design Trends You'll See Everywhere This Spring and Summer - SFGATE - March 14th, 2024 [March 14th, 2024]
- This smart security camera impressed me in the most unexpected way - ZDNet - March 14th, 2024 [March 14th, 2024]
- Lithe Audio and Lilin integrate AI for home security - HiddenWires - March 14th, 2024 [March 14th, 2024]
- Why Airbnb Is Banning Cameras in Rentals - TIME - March 14th, 2024 [March 14th, 2024]
- PC students gift overnight security guard trip home to Nigeria - WPRI.com - March 14th, 2024 [March 14th, 2024]
- Influencer suing Tyreek Hill for 'breaking her leg' DEMANDS he hand over his private texts and home security f - Daily Mail - March 14th, 2024 [March 14th, 2024]
- Ring's Battery Doorbell Pro is one of the best security systems I've tested (but there's a catch) - ZDNet - March 14th, 2024 [March 14th, 2024]
- Ring Spotlight Cam Pro Review: Compact, Reliable And Long Battery Life - Forbes - March 14th, 2024 [March 14th, 2024]
- Home security video catch person taking mail that results in $8,000 worth of fraudulent checks - AOL - February 16th, 2024 [February 16th, 2024]
- Best Home Security Cameras of 2024 - CNET - February 16th, 2024 [February 16th, 2024]
- Ring sale: Save on Ring doorbells and home security cameras today - Digital Trends - February 16th, 2024 [February 16th, 2024]
- Blink's video doorbell just crashed to $44 and it doesn't require a subscription - Tom's Guide - February 16th, 2024 [February 16th, 2024]
- Snag Up to 43% off These Blink Security Cameras and Doorbells - CNET - February 16th, 2024 [February 16th, 2024]
- U.S. House Republicans impeach Homeland Security chief Mayorkas on second try Oregon Capital Chronicle - Oregon Capital Chronicle - February 16th, 2024 [February 16th, 2024]
- Wi-Fi jamming to knock out cameras suspected in nine Minnesota burglaries -- smart security systems vulnerable as ... - Tom's Hardware - February 16th, 2024 [February 16th, 2024]
- The 4 Best Security Cameras for Your Home of 2024 | Reviews by Wirecutter - The New York Times - February 16th, 2024 [February 16th, 2024]
- Security guard shoots man allegedly trying to run people over in Home Depot parking lot - CBS Los Angeles - February 16th, 2024 [February 16th, 2024]
- The 4 Best Smart Doorbell Cameras of 2024 | Reviews by Wirecutter - The New York Times - February 16th, 2024 [February 16th, 2024]
- Everything you need to know about the Ring Protect price hike - Digital Trends - February 16th, 2024 [February 16th, 2024]
- Vory Threatens To 'Kill' Girlfriend In Alleged Footage Of Domestic Abuse - HipHopDX - February 16th, 2024 [February 16th, 2024]
- Angry Airbnb host sent guest's wife security photo of him with another woman, lawsuit claims - New York Post - February 16th, 2024 [February 16th, 2024]
- Best Smart Locks of 2024 - CNET - February 16th, 2024 [February 16th, 2024]
- Bear tries to enter Washington home through doggie door - UPI News - February 16th, 2024 [February 16th, 2024]
- The Ring Battery Doorbell Pro has 3D motion detection - Gadget Flow - February 16th, 2024 [February 16th, 2024]
- We test some of the latest home security cameras to see how far the technology has come - Nottinghamshire Live - February 16th, 2024 [February 16th, 2024]
- Ring Is Raising Rates on Some Plans by 25% in March - PCMag Middle East - February 16th, 2024 [February 16th, 2024]
- The 12 Best Home Security Cameras of 2023 - Security.org - December 11th, 2023 [December 11th, 2023]
- Traveling for the holidays? Keep an eye on your home with the Blink Mini security camera, now just $20 - Gwinnettdailypost.com - December 11th, 2023 [December 11th, 2023]
- Gangs from South America use security jammers to break in to expensive homes across country: police - WLS-TV - December 11th, 2023 [December 11th, 2023]
- Best Home Security Companies Of 2023 Forbes Home - Forbes - December 11th, 2023 [December 11th, 2023]
- Best Wireless Security Cameras Of December 2023 Forbes Home - Forbes - December 11th, 2023 [December 11th, 2023]
- Best Outdoor Security Lights With Cameras Of 2023 - Forbes - December 11th, 2023 [December 11th, 2023]
- Wireless CCTV camera for home security? Here are top 10 options to choose from | Mint - Mint - December 11th, 2023 [December 11th, 2023]
- Cougar struck and killed near Minneapolis likely the one seen in home security video, expert says - Drgnews - December 11th, 2023 [December 11th, 2023]
- Cougar living in Lowry Hill neighborhood of Minneapolis, city, DNR warn - Star Tribune - December 11th, 2023 [December 11th, 2023]
- FAIR Applauds Senate Republicans for Holding Firm and Demanding that National Security Starts at Home - StreetInsider.com - December 11th, 2023 [December 11th, 2023]
- Prevent Burglaries With ADT's Tips For Property Security | Security News - SecurityInformed - December 11th, 2023 [December 11th, 2023]
- Prince Harry Says His Security Removal Had One Glaring Error - Newsweek - December 11th, 2023 [December 11th, 2023]
- Save $50 on the Ring Alarm home security system from Amazon - SFGATE - September 13th, 2022 [September 13th, 2022]
- An Indian Security System That Is Being Transformed By Technology - Inventiva - September 13th, 2022 [September 13th, 2022]
- Home Security Systems Market | expected to reach $96.5 billion | growth of 9.1% CAGR | 200 pages report - Taiwan News - September 13th, 2022 [September 13th, 2022]
- VP Harris wishes lawmakers treated domestic threats as 'Americans' - Business Insider - September 13th, 2022 [September 13th, 2022]
- Axis Communications Unveils Latest Solutions for Integrating Sight, Sound, Analytics and More at the 2022 Global Security Exchange - Business Wire - September 13th, 2022 [September 13th, 2022]
- Tomorrow.io Delivers First Radar for Weather Satellite Constellation Backed by U.S. Air Force - Benzinga - September 13th, 2022 [September 13th, 2022]
- The 2 Stocks Everyone's Talking About Tuesday - The Motley Fool - September 13th, 2022 [September 13th, 2022]
- What To Do With Old Smartphones? 15 Genius Reuse Ideas - TechPP - September 13th, 2022 [September 13th, 2022]
- Broken Arrow Man Arrested, Accused Of Hiding Cameras To Record Minors - News On 6 - September 13th, 2022 [September 13th, 2022]
- Massacre in Pike County Suspect is escorted by security as they enter court on the first day of the trial. - TDPel Media - September 13th, 2022 [September 13th, 2022]
- Department of Homeland Security PAL-Home - November 4th, 2021 [November 4th, 2021]
- Native Sun Home Accents, Inc. - Arizona Security Doors ... - November 4th, 2021 [November 4th, 2021]
- Ring Alarm Pro review: A giant leap for home security - CNET - November 4th, 2021 [November 4th, 2021]
- The Top Reasons You Should Not Ignore Installing a Home Security System - Southeast Missourian - November 4th, 2021 [November 4th, 2021]
- Where is the best place to install my home security cameras? - TechRadar - November 4th, 2021 [November 4th, 2021]
- Wyze announces new camera features and a new Wyze Smart Switch and Smart Bulb - The Verge - November 4th, 2021 [November 4th, 2021]
- Connected Home Security Market 2021: Global Analysis, Share, Trends, Application Analysis and Forecast To 2027 Bolivar Commercial - Bolivar... - November 4th, 2021 [November 4th, 2021]
- Amazon Black Friday deal takes $250 off the Arlo Pro 3 Spotlight 4 camera system - T3 - November 4th, 2021 [November 4th, 2021]
- Frontpoint Security Expands Executive Team with the Announcement of its First Chief Commercial Officer - PRNewswire - November 4th, 2021 [November 4th, 2021]
- Xiaomi Smart Door Lock Xhome security with face recognition and a sleek design - Gadget Flow - November 4th, 2021 [November 4th, 2021]
- US Blacklists Israeli Spyware Companies Over Threat to National Security - The Daily Beast - November 4th, 2021 [November 4th, 2021]
- Remote Work Security: Handling Setbacks in the Time of COVID-19 - Security Intelligence - November 4th, 2021 [November 4th, 2021]
- World Series 2021 - The inside story of where Jorge Soler's home run went once it left Minute Maid Park - ESPN - November 4th, 2021 [November 4th, 2021]
- Ask a Broker: The importance of smart-home technology - Aspen Daily News - November 4th, 2021 [November 4th, 2021]
- Apple's Craig Federighi defends App Store in face of looming regulation - Mashable - November 4th, 2021 [November 4th, 2021]
- The eufy Floodlight Video Camera II provides 360 degrees of security coverage without breaking the bank - TechHive - November 4th, 2021 [November 4th, 2021]
- Worldwide Automotive Software Industry to 2026 - Safety and Security Software is Expected to Witness Faster Growth Rate - ResearchAndMarkets.com -... - November 4th, 2021 [November 4th, 2021]
- She would never just leave: Investigators look into if Mid-City moms disappearance related to financial investigation - KTLA Los Angeles - November 4th, 2021 [November 4th, 2021]
- Bring Alexa support to your home security with 54% off wansviews 1080p outdoor cam from $18 - 9to5Toys - July 2nd, 2021 [July 2nd, 2021]
- Members of Congress Are Spending More Than Ever on Security Mother Jones - Mother Jones - July 2nd, 2021 [July 2nd, 2021]
- Google Nest to Strengthen Its Commitment to Security by Testing Devices Against the ioXt Alliance's Global Security Standards - Business Wire - July 2nd, 2021 [July 2nd, 2021]
- Summer Wells investigators receive more than 700 tips about missing Tennessee girl - Fox News - July 2nd, 2021 [July 2nd, 2021]
- DIY Home Security Solutions Market Analytical Overview, Growth Factors, Demand and Trends Forecast to 2027 The Courier - The Courier - July 2nd, 2021 [July 2nd, 2021]