back to article SolarWinds just keeps getting worse: New strain of backdoor malware found in probe

Another form of malware has been spotted on servers backdoored in the SolarWinds' Orion fiasco. The strain, identified as SUNSHUTTLE by FireEye, is a second-stage backdoor written in Go which uses HTTPS to communicate with a command-and-control server for data exfiltration, adding new code as needed. Someone based in the US, …

  1. Pascal Monett Silver badge
    Mushroom

    Your turn

    "nefarious actors wondering if their real-world identities will be discovered thanks to the leaked data"

    Good. See how it feels for once.

    1. MarkSitkowski

      And another thing...

      "Law enforcement is not thought to be involved in the hacking..."

      Why not? Isn't this what they're supposed to be doing? If the cybertrash can do it, why not the so-called cybersecurity professionals?

  2. Pascal Monett Silver badge
    Facepalm

    "Investors should be wary of social media endorsements of investment opportunities"

    Investors with a brain already are.

    Then again, they don't look to Twitter to get tips.

    1. Anonymous Coward
      Anonymous Coward

      Re: "Investors should be wary of social media endorsements of investment opportunities"

      They don't? They even buy tweets as NFTs now...

      https://www.bbc.com/news/world-us-canada-56307153

    2. TimMaher Silver badge
      Coat

      Re: "Investors should be wary of social media endorsements of investment opportunities"

      Should’ve mentioned that to Elon Musk... and his followers.

    3. Confuciousmobil
      Thumb Up

      Re: "Investors should be wary of social media endorsements of investment opportunities"

      Have you got a link to his account? I’m looking for some good investments.

      1. VulcanV5

        Re: "Investors should be wary of social media endorsements of investment opportunities"

        I've got a used rocket to sell you.

  3. don't you hate it when you lose your account

    Another day

    Another dollar

    1. RM Myers
      Joke

      Re: Another day

      You work assembling IPhones in India! I read about you in El Reg.

      https://www.theregister.com/2020/12/14/india_iphone_factory_riot/

  4. Danny 2

    a public malware repository

    They are changing the guard at Buckingham Palace

    Christopher Robin went down on Alice

    They've great big parties inside the grounds.

    "I wouldn't be King for a hundred pounds,"

    Says Harry.

    "We love to have agents provocateurs in the party, because they always propose the most revolutionary motions." - Louise Michel , 8th March, Internationale Women's Day

    1. Anonymous Coward
      Anonymous Coward

      Re: a public malware repository

      I assume they mean VirusTotal as the first submission of the malware was done on:

      2020-09-04 00:18:10

  5. Bitsminer Silver badge

    Unable to boot up?

    A successful exploit could allow the attacker to exhaust disk space on the affected device, which could result in administrators being unable to log in to the device or the device being unable to boot up correctly.

    And cisco have never heard of disk partitioning, where log files are kept separate from essential operating system files.

    It is called "separation of concerns", which can be translated to "separate us from cisco, please!".

    1. MarkSitkowski

      Re: Unable to boot up?

      Actually, Unix doesn't allow you to totally fill up the disk, for that very reason. When df tells you it's 100% used up, you can still access it as root, as it leaves a few percent spare.

      1. jtaylor

        Re: Unable to boot up?

        you can still access it as root, as it leaves a few percent spare.

        Indeed. Vendors are clever, though. Some of them require* that you run their software as root.

        *If you refuse, their support engineer gives the local version of a Gallic shrug "ah, quel dommage"

        1. ThatOne Silver badge

          Re: Unable to boot up?

          > Some of them require* that you run their software as root

          It's too tedious to code around the limitations of an unprivileged account. Besides, their software is perfect, so why bother!

          1. jtaylor

            Re: Unable to boot up?

            their software is perfect

            In my experience, they know their software is crap. Their job is to support it. The experienced techs know what happens to people who venture too far off script.

            Anyway, your company already paid for support. If you fail to provide a supported platform, they'll move on and let you fight it out with the person who paid them.

            In the Business version of rock-scissors-paper, Money beats Computers.

  6. arachnoid2

    "ah, quel dommage

    c'est la guerre

    https://www.youtube.com/watch?v=Hi5V6rRt2VM

  7. VulcanV5
    Unhappy

    Survival of the fittest

    Proof that evolution is not a smooth unstoppable process of ever-increasing refinement has been with us for centuries.

    Even so, it's still a surprise to be reminded of the sheer scale of homo sapiens' forking:

    ""The defendants allegedly used McAfee's Twitter account to publish messages to hundreds of thousands of his Twitter followers touting various cryptocurrencies through false and misleading statements to conceal their true, self-interested motives," Manhattan US Attorney Audrey Strauss said.

    McAfee actually had hundreds of thousands (!) of Twitter followers? Ye gods, a longtime certifiable fruitcake like McAfee should only have had two followers at most, both in white coats and one of them armed with a ready supply of sedatives.

    Thus do the numb dumb primates of Homo Idiota go on their not so merry way to oblivion. Quite why homo sapiens should care a jot about them, or do anything to delay their inevitable extinction, is beyond me.

    1. martinusher Silver badge

      Re: Survival of the fittest

      >Thus do the numb dumb primates of Homo Idiota go on their not so merry way to oblivion.

      Or power. There's some mention of "Presidential apsirations" in the article. In normal times you'd never take this sort of thing seriously. Post-Trump, though, its a completely different game. Anyone with enough money (or just promises of money) seems to be able to purchase power and the weird bit is that people follow (Trump is Exhibit #1).

  8. Steve B

    And this is different to Huawei how?

    At least the Chinese back doors are supposedly coded in by design!

  9. hoola Silver badge

    The gift that keeps on giving

    If SolarWinds cannot sort this out soon one would hope that people would start to look elsewhere. Just having the best functionality is not the only factor now but IT is filled with people with entrenched views who stubbornly refuse to look at alternatives. The closer to the network the worse it is.

    The trouble is that (usually small) teams with vested interests either refuse to look at alternatives of if there is a viable alternative, make life difficult. Threatening management that you will resign because they are going to accept a networking tender that is not Cisco and such like are what causes so many problems. A similar thing happened with SolarWinds so we are still lumbered with it. Management cave in because the network is seen as this mystery layer that only a few geeks are allowed to understand.

    The cycle continues and large amounts of money that could usefully be deployed elsewhere goes into a bottomless pit.

    1. Cliffwilliams44 Silver badge

      Re: The gift that keeps on giving

      Already have. Went from paying these idiots a lot of money to going full open source and getting more functionality. We will most likely make a sizable donation!

  10. ThatOne Silver badge
    Devil

    Waiting list

    > McAfee remains in prison in Spain on separate charges

    Take a ticket if you too want to put him in jail...

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like