SolarWinds hackers were able to access Microsoft source code

Re:SolarWinds hackers were able to access Microsoft source code by iam-TJ on Friday January 01, 2021 @05:35AM (#25602268)

Many comment threads here discussing the (in)ability of an attacker to modify the source-code that Microsoft builds from, or use it to more easily discover vulnerabilities.

What I've not seen anyone discuss is the potential for an attacker to take the source-code of a single Windows core component (a system DLL for example), add in a backdoor, build it and then distribute the binary via a compromise such as the SolarWinds update mechanism.

In other words, insert a modified core Windows DLL into some other popular Windows driver or application package updater published and signed via a 'trusted' channel other than Microsoft itself.

[ Parent | on HN ]

Re:SolarWinds hackers were able to access Microsoft source code by NickGerleman on Friday January 01, 2021 @05:44AM (#25602297)

Code signing makes that pretty tricky. System DLLs will have integrity checks against msft certs.

[ Parent | on HN ]

Re:SolarWinds hackers were able to access Microsoft source code by SCHiM on Friday January 01, 2021 @11:46AM (#25604488)

Not all of them. msimg32.dll has no certificate and many system processes attempt to load that. There are more dlls in system32 if you look. Neither does Wldap32.dll, which gets loaded into lsass and is part of the knowndlls...

[ Parent | on HN ]