FireEye, Microsoft find 'killswitch' to hamper SolarWinds

The action highlights the power that tech companies have to throw up road blocks to well-resourced hackers.

As the U.S. government works to contain a sprawling hacking campaign that relies on software in technology from SolarWinds, a federal contractor, technology firms are disabling some of the hackers’ key infrastructure.

Cybersecurity giant FireEye on Wednesday said that it had worked with Microsoft and the domain registrar GoDaddy to take over one of the domains that attackers had used to send malicious code to victim machines. The move is no panacea for stopping the suspected state-sponsored hacking campaign, though it could help stem the tide of victims, which reportedly includes the departments of Treasury and Homeland Security.

The seized domain, known as a “killswitch,” will “affect new and previous” infections of the malicious code coming from that particular domain, FireEye said in a statement that was first reported by independent journalist Brian Krebs. “Depending on the IP address returned when the malware resolves avsvmcloud[.]com, under certain conditions, the malware would terminate itself and prevent further execution.”

The killswitch will make it harder for the attackers to use the malware, known as SUNBURST, that they have already deployed. FireEye warned, though, that hackers still have other means of retaining access to networks. “[I]n the intrusions FireEye has seen, this actor moved quickly to establish additional persistent mechanisms to access to victim networks beyond the SUNBURST backdoor.”

The FBI is investigating the compromise of SolarWinds’ software updates, which the Washington Post has linked with a Russian intelligence service. SolarWinds’ software is used throughout Fortune 500 companies, and in critical sectors such as electricity. The network monitoring vendor said in a Securities and Exchange Commission filing on Monday that the number of public and private customers with its vulnerable software installed was “fewer than 18,000,” without specifying the number.

Alex Stamos, Facebook’s former security chief, pointed out the hard work ahead for many security teams in corporate and government environments.

The killswitch action highlights the power that major technology companies have to throw up road blocks to well-resourced hackers, and follows Microsoft and other firms’ attempt to disrupt a powerful botnet in October. Perhaps the most famous use of a killswitch during a malicious cyber campaign came during the 2017 WannaCry ransomware outbreak, when security researcher Marcus Hutchins registered a web domain found in the ransomware’s code, helping stop the spread of the global computer virus.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure