SUNBURST SolarWinds Malware - Tools, Tactics and Methods to get you started with Reverse Engineering

[@klaboem0]

Your videos are also getting more sophisticated! Really enjoyed the video, keep it up Colin

[@cybercdh]

Thanks, glad you enjoyed! 🙏

[@philswaim392]

It was really fun to listen to this. I was able to just have this playing on audio and take a shower listening to this and could still follow along. You do such a good job of narratijg and speaking through everything.

[@cybercdh]

Wow thanks Phil, awesome comment. Glad you enjoyed.

[@stephenemerson2229]

Working from home, lunch break, food ready - go on youtube and see a new vid from Colin; perfect. Was hoping you would do a video on this malware after seeing your Twitter updates on it :) Thanks.

[@cybercdh]

Thanks for the comment and support, it means a lot. Glad you enjoyed the content! ✌️

[@MauroScomparin]

Glad you're back, really interesting as always!

[@TheLampedusa]

Colin, you have produced some amazing videos, that have really helped me develop as a malware analyst, but this one takes your work to a new level. Thank you!

[@cybercdh]

That's awesome to hear, thank you for taking the time to comment. 🙏

[@mirhassanriaz7713]

Amazing drill-down, appreciate your contribution. My team and I are doing research on this and u opened by the door for us to dig deeper. Keep contributing, respect from Pakistan!

[@cybercdh]

Awesome, appreciate the support and look forward to hearing more about your research.

[@wise_one45]

Thank you Colin. As always as a new malware analyst i always enjoy your videos for new ideas and to dig at your thinking. Been following you for years!

[@cybercdh]

Thanks jeremy, that's really cool to hear and glad you enjoy the content.

[@CodeXND]

Was eagerly waiting for this, thanks.

[@cybercdh]

Hope you enjoyed it!

[@FMontanari709]

Loved the video, super interesting piece of malware! If you keep having issues with 1080p, would it be possible to bump up the font size a bit? That would help mobile user's eyesight a lot lol

[@cybercdh]

Issue is fixed for next time, don’t worry but thanks for reaching out and appreciate the support

[@travelmore9626]

Great content as usual! Are you suprised security teams didnt discover the service registry change sooner? Seems relatively noisy to me that EDR/Sysmon would detect, especially as its impacting key security controls

[@cybercdh]

It’s a good point. There are lots of opportunities to detect this, but I guess it’s easy when you know how. Tampering with an EDR config in registry or on disk would ordinarily make it alert like crazy; it’s worth testing I guess.

[@stephenemerson2229]

I think if the activity wasn't related to a company such as SolarWinds it would have been found sooner as it would have looked more 'unusual'. Not saying that a SolarWinds product disabling security tools is 'usual' but many teams may turn a blind eye as they see this as a trusted process, or some may even whitelist activity from solarwinds due to the noisy events from a 'trusted process'.

[@robbie_984]

Colin you beast! Awesome, awesome analysis and explainations. I dug into it few days ago when friend sent me a sample and the C# code is incredible and the way it works is insane. Still just scratched the surface. Thankfully, fireeye helped a lot to understand some of the functions of the malware.

[@cybercdh]

Awesome, thank you!

[@stewatts]

Amazing work as always Col and 100% agree about intelligence sharing!

[@qe4wsy5]

Good stuff, quick and smooth

[@cybercdh]

Thanks!

[@anoopmj6749]

Very very good job. My best video on KZbin so far. 👏🏻👏🏻👏🏻👏🏻👏🏻

[@cybercdh]

thank you :)

[@cmdsecure]

Very interesting - super research and well documented.

[@cybercdh]

Many thanks!

[@D_Tech_And_Trek]

Amazing job Colin, Thank you!!

[@cybercdh]

Glad you liked it!

[@elisalem164]

Great video! The attackers' effort to stay under the radar is super cool, must give them credit for that.

[@cybercdh]

Agree dude, very elegant malware. This is fast becoming one of my favourites.

[@CUBKITS]

I love how informative these videos are! If I could make one comment/request, though, it would be that you make the font a bit larger! It's hard to read a lot of the text on the screen!

[@somethingsinlife5600]

I think the biggest problem is Closed Source siftware aka Security through obscurity. If this was open source, it would take only a few seconds to spot the fishy code. The other question is...Doesn't solarwinds have a version control system? Or even a simple diff? Or a damn QA? How did this code get added without the builders noticing it?

[@MasterOfMisc]

As I understand it, they compromised the build server itself. If that's the case, this malware code doesn't even need to be checked into source control. They can add it into the mix of files on disk after checkout of the code but before the build of the binaries. That way the employees of the company do not even see the malware class in the source repository.

[@somethingsinlife5600]

@@MasterOfMisc Even then it shouldn't be possible, without negligence that is. What gets built should be just as important as what's being built. However, Details are scarce on how they actually infiltrated the supply chain. They had it signed and everything. How were they so negligent, it's not like supply chain attacks are a new thing.

[@MasterOfMisc]

@@somethingsinlife5600 Oh yeah, i'm with you 100%. There is a lot of negligence on their part. A lot of negligence considering the fact the company even had a "customers page" with a list of all the government agencies and other high profile companies that they supplied the product too!! That page has now disappeared from the web but that list alone would have been like attracting a bull to a red flag. A great advert to would-be hackers shouting "Look over here.. We are a valuable target" - So yeah, given their position there was a failure to guarantee the build binaries matched expected CRC checks or whatever BEFORE the DLLs were signed. Anyway, its all mute at this point. Who knows what damage has been caused. The only reason why we know about this hack is because of FireEye installing the software on their systems and detecting the breach... Which means the hackers have had plenty of time in all those government agencies setting up shop and installing other persistent back doors. The whole thing is a mess to say the least!

[@HackeXPlorer]

Awsome Analysis Colin, appreciate your work a lot. Yes, definitely you have given a good start for us to get involved. Can you share a sample of your GO code with us?

[@cybercdh]

Check the description, link to my Github in there.

[@user-rh6zc2pk5d]

Great video as always. Thank you

[@mytechnotalent]

Great breakdown Colin thank you.

[@benbell9170]

Hi, great video, even for me as a Mechanical engineer with zero IT or cyber security knowledge. very interesting in dead and the way you analyzing it reminds me of Sherlock Holmes. I just want to ask about the size of this malware. Is it relatively to other such malwares rather small or big? I mean was it possible for Solarwinds to see a difference in the size of the update file comparing to what it should be and therefore come to this conclusion, that there are some other stuff in the file?

[@cybercdh]

Thanks for the comment, the size of the file will be different for sure; and therefore so will the cryptographic hash. Which leads to the question as to what part of the software update lifecycle was compromised, as this DLL was signed with their certificate. We may never know the full story here tbh.

[@NikolaTomic]

I noticed that Gmail, Windows, iOS and Android are affected! Just saw how my Gmail signature written on iPhone looks like sent Gmail / PC! It has cookie or code implemented on signature link! What to use to clean it? Nothing finds anything... fake credentials, fake GUI + some Win updates came with this!

[@trich4912]

Great content! I appreciate you taking the time to make this video. How'd you get the analyzer window at the bottom to show? I can't figure out how to enable that view to show.

[@cybercdh]

if you right click on the function name itself and click Analyse you'll see the window.

[@TURNERJE12]

Great work! Keep it up! Please add the link to your Github page. I had to find it via a quick search.

[@cybercdh]

nice spot - updated!

[@yair3230HD]

Great video! Please upload in 1080p next time, so the text would be visible

[@cybercdh]

For sure, it's a long story why it was 720p, but better than nothing.

[@Arthur-fv3nj]

@@cybercdh Agreed, long story and great video. If possible please re-upload 1080p, not sure if is my old eyes but I'm not able to read. Seams you are using Retina display like me and text become to small for 720p. Thanks for great content

[@sbakor8043]

great explanation - loved it

[@cybercdh]

Glad you liked it!

[@ArtyBoney]

You are the best, Colin.

[@cybercdh]

Thanks 🙏

[@maryschmitt3254]

In your video, about 23:50 seconds in, it appears to decrypt output as AWS Regions? AWS Appsync is also displayed. Amazon Cloud is target based on what you've decrypted.

[@cybercdh]

It uses these strings within the dns request to avsvmcloud[.]com - another technique it uses to try and blend in to the norm

[@maryschmitt3254]

@@cybercdh Your videos on this have been great. Thanks!

[@JanivzZ]

thank you Colin ! ! as usual super interesting !!

[@cybercdh]

Glad you enjoyed it

[@Ownage4lif31]

That hashing function is a genius idea lol. This not only prevents people from looking at strings via decompiling, but also through memory inspections. What exactly did this virus do though? I don't think it was explained anywhere in great detail, how they actually hacked solar winds. Was this send to an engineer or something and used as a service by solar winds themselves? Must be more to this story, than what meets the eye.

[@sharon2416]

Hey I'm new to this field, can you please explain what you mean by preventing people from looking at strings through memory inspections? I'd like to understand more, thank you!

[@Ownage4lif31]

@@sharon2416 Short version - not too technical: When a program is run, it gets allocated virtual space to the heap, which is just basically an area that allows you to dynamically allocate and deallocate objects to. A string is allocated to the heap and viewable to all. For .NET specifically, strings can be seen through dnspy because c# is compiled to .net's version of bytecode. And a reverse engineerer can see all these strings and this allows them to be able to crack your program pretty easily. Using this function, you can hide strings because they show up as weird looking numbers in dnspy. So the person who looks at it will be confused on what it actually does, until he takes his time to study it. This allows you to put booby traps into your program which can indicate to your program that someone is trying to tamper with it, then you can take action (kill the program, ban the license etc). Even if you did manage to hide the strings in dnspy with heavy obfuscation, you can view the heap and it will reveal the string since one way or another, the string will have to be allocated to the heap. It pretty much just gives people who want to tamper with your program, a much harder time to figure out what's going on. Slowing them down. If you want to know more about how RAM and memory allocations works with programs, you can google "stack and heaps - programming c#" ( c or whatever language u desire) and there should be an in depth explanation there.

[@sharon2416]

​@@Ownage4lif31 Wow, heyy it is really informative, thank you so much !! I'll check it out in depth too, Cheers!

[@maximilian19931]

OOP style backboor, which could be found by diffing the DLL to a clean version

[@baruchben-david4196]

That requires knowing there's a problem, and also having a clean copy. If you don't know for certain that your DLL is OK, then all you can say is that at least one of the DLL's is wrong. You don't know whether either is clean.

[@maximilian19931]

​@@baruchben-david4196 diff the changes between current version and updated version like version control does it, to see changes in code. most malware is attached to the end of the code, and wired up to run it, bufferoverflow like. most failures are intruduces by chynges to source code.

[@samquirk6414]

Thank you for this video, really did help understanding this hack.

[@cybercdh]

Glad it helped!

[@manchestergreyhats6032]

Great walkthrough!

[@cybercdh]

Thank you; appreciate the comment

[@RowanSheridan]

great work as always

[@cybercdh]

Thank you! Cheers!

[@Ms.Robot.]

Wow that was nice. ❤ subscribed💋

[@TheRealLegenDz]

Great analysis, thanks!

[@cybercdh]

Glad you liked it!

[@hqcart1]

You can reverse engineer the code, you can hack the update server, but you CANT INJECT the malware into the original code without breaking the checksum. so it's either: 1. ALL SolarWinds got hacked, in which they do not need to reverse engineer anything, they just take over the source code and plug the new code inside, compile and publish to the update server. 2. INSIDE JOB.

[@lalapoluza4113]

Considering bigger picture #2 highly probable

[@temitopehardhekheyhe7359]

Or ... they are in possession of a code signing certificate

[@hqcart1]

@@temitopehardhekheyhe7359 if they do this means they hacked everything...

[@Limpuls]

Pretty sure some employee at SolarWinds done this..

[@petergibbons9135]

Hi Colin, do you know how this "hacked" file happened to replace "the real one" in the build process of the solarwinds software? What kind of intrusion took place to achieve that? Maybe this has been described somewhere, I just havent found it.

[@cybercdh]

i dont think thats intelligence thats yet been released. im looking forward to finding out but im not holding my breath we'll ever know the complete picture.

[@ParthGupta-my9ox]

Definitely need more content like this. Thanks for the insights man♥♥

[@WrathofGod555]

Samanage merger. That's how they got in and they're still inside the building. Probably still in the networks using Orion.

[@cybercdh]

Interesting take, lots more to come from this whole situation for sure

[@syphaxxxxx]

Thank you from the informations, i'm preparing for my master thesis about " The effectiveness of US security systems in the face of cyber threats , case study : solarwinds attack " i wanna know if the part name of the case study is right or do you suggest any changes ? i accept any help for that , also if you have any websites or articles about this attack, i will be thankful for your help :)

[@cybercdh]

Sounds like a cool thesis. There's some links in the description to this video that may help. Enjoy and good luck.

[@syphaxxxxx]

@@cybercdh Thank you so much

[@Ms.Robot.]

Can you tell me the steps you took up to using dnSpy?

[@cybercdh]

Grabbed the sample from a public sandbox, looked at the headers etc in pestudio then opened in dnspy.

[@Ms.Robot.]

@@cybercdh For noobs like me, can you please give a step-by-step process for doing this (or anything like this) please! I just got dnSpy, and I can't get it to work well for me. I'm a cybersecurity student. 😍

[@sent4dc]

man, great video. but please smash ctrl+plus for a few times. it's hard to read what vladimir had written there.

[@cybercdh]

ha! noted.

[@Shark-x77]

WOW super wow!!!! Imagine the guys who wrote the code watching this VDO and have Vodka and saying hmm!!! we need to get this guy on our team ;-))

[@cybercdh]

lol.

[@stungun3009]

Awesome content, great job! Immediately subscribed :)

[@joshuampere4327]

can you analyze QBOT malware

[@cybercdh]

Thanks for the suggestion.

[@nagatubein]

Good info. Well explained.

[@cybercdh]

Thank you 🙏

[@iamzeronothing]

just make ppl add capital letters and symbols to their passwords. I never been hacked once, since changing my FB password to !Password

[@fingerbowlfish5408]

Wow! Brilliant

[@Tarquin2718]

Wow if all o f science would work that way, that would be awesome. You compter scientics are lucky you can work with internet and full disclosure :-)

[@MTS_IT]

awesome as always! :D

[@cybercdh]

Thank you :-)

[@npavan888]

Really great stuff🔥🔥 👌👌 keep rocking

[@cybercdh]

Thank you! Will do!

[@btno222]

Can you see where this malware call backs to?

[@GVK000]

Hi Colin, thanks again for helpful and entertaining session! Could you also tell that this code comes from a particular state? I am interested in Russian involvement, and if you do (and since you have that hint on Putin at the introduction), what kind of signs make you think so? (I am not sure if I would be able to make that link until I am familiar with a particular coding style of an individual or school of thought; it would be interesting to know your opinion on this)

[@cybercdh]

The reference I made was based on threat Intel from various vendors such as FireEye who published the original research. Generally they’ll look at crossovers between coding concepts, code snippets, style etc between other known state attributed campaigns.

[@ameerhamza4017]

Great Job, Sir. Became a new subscriber and Twitter's follower. Kindly, make a discord server (my suggestion)

[@racedrivergrid01]

IOCs are released for this?

[@cybercdh]

Yes, see the links in the description.

[@zwels]

I love how the first thing this malware does is "nothing". Literally. Just sit there and wait patiently.

[@manjoos4906]

damn, great video man

[@cybercdh]

Many thanks 🙏

[@Nobody423]

I wish I was as clever, I’d love to be able to do this...

[@cybercdh]

I’m definitely not clever; I just have a curious mind.

[@gesnow]

Thanks this is great information

[@cybercdh]

🙏

[@longhoang9490]

what is password to extract the Sunburst malware from any.run?

[@theloanranger2632]

It's typically "infected": a little reminder and acknowledgement you're about to handle malicious files

[@RikthDcruze]

can extract this Malware and use it myself.

[@loopforwhile]

Not catching null pointer exceptions = real pro who knows his shit.

[@LossyLossnitzer]

FireEye that I had not heard of before last year have now been shown as the No. 1 company in intrusion detection and malware protection. It would be funny if this piece of code was in a github repository and been incorporated into many other pieces of company software and their code has been certified with a good MD5 for release by the companies releasing their software.

[@maximilian19931]

trusting a vendor is a bad thing

[@ayushmanthapa_onion]

Thamk you mr.colin subbed!

[@cybercdh]

nice! thanks :)

[@techworld3043]

Nice video

[@cybercdh]

Thanks

[@ozorg]

great info!

[@Jupiterxice]

I must learn malware and various scripting or the basics

[@TheWhippinpost]

720p, or shall I wait?

[@cybercdh]

It's 720p, I wont bore you with why...look out for more content coming soon also.

[@kennybania8623]

Well thank goodness Chris Krebs former CISA for DHS, which was also affected, is confident that Dominion Voting machines are rock solid. Maybe SolarWind's could learn from Dominion on how to become unhacakble.

[@nikolas8741]

I think it's a bit late mate

[@ish4n10]

awesome

[@cybercdh]

ty

[@cristopherandes4084]

make more malware in dotnet, thx

[@zainuddinbrahim4625]

thanks colin

[@misham6547]

Nice finally taking revenge against the pipeline and sanctions

[@HoangNguyen-jd2mr]

Awesome

[@danielolivares5199]

hermoso video

[@Tarquin2718]

I think president45 was a nice piece of social engineering ^__^

[@MauroScomparin]

From what I could see the library in question was also signed from them, which means their signing keys are compromised somehow. I could not find any info on any revoked keys, do anybody has any info about, on their site it looks like they just acknowledge the malicious code and suggest to upgrade to a clear patch.. Looks like it's a target attack to a particular category of customers (some say voting machines), disabling services and doing recon and profiling of the victims. Pretty bad anyway, personally another reason to use open software for sensible infrastructure instead of relaying on someone who looks like it's not even that careful with network management/security besides their kind of business.. Pretty bad for them and their image too..

[@maximilian19931]

It was a build infra compromise.

[@ovalwingnut]

👍😎

[@Mirion212]

Please drop the ultra loud intro

[@LossyLossnitzer]

This is a little funny did this only affect windows servers running .NET? It looks like now that companies do not have real systems administrators that look after their servers and looks at the logs on the servers to see if apps have started/stopped, you have a devOps model where no one really looks after the computers and they just run servers as code - Programmers are running the show and systems administrators are redundant and those programmers are so under pressure to get code out they do not check their code or programmers share code blindly to quickly get products out there. On a good note: some companies probably noticed that their servers are running really quickly without all those services running after the reboots :) and can save money by changing the server class to a tier lower to save on the compute costs, so what if all their data and IP have gone to the CCP or Russia the US military and government have gone open source and now every country can have hypersonic missiles.

[@jeremyjacob6646]

Why is this shit not 1080p

[@cybercdh]

Genuinely a long and boring story. Vids are usually 1080p / 4K but had a mare with tech lately.

[@adanjsuarez]

It was written in good English... that make me think.... hhmmm!

[@ozorg]

blending in ...

[@maximilian19931]

lsseon learned: DONT RUN FILTER TOOLS ON WINDOWS AND ISOLATE THEM FROM THE PUBLIC INTERNET

[@TCWthecanadianwinter]

Lol is this written in python?

[@_DeProgrammer]

left a thumbs down because I can't read one line of code in your video. Please enlarge text. How do content creators still do this?

[@cybercdh]

I appreciate knowing the reason for the thumbs down; it helps content creators learn and develop. 👍 for your 👎

[@joshsprinkles4689]

I could read every line of code just fine.

[@grantc8353]

@@joshsprinkles4689 I could make it out but was a little blurry

[@ytnthr1]

I left a thumb up cause you gave me weeks of learning and entertainment. Wonderful content, helpful links, very well made and enjoyable pace. Thanks, I’m subscribing!

[@cybercdh]

@@ytnthr1 Thank you, and appreciate you taking the time to comment 🙏