The SolarWinds hack and our corporate/political culture

Remember last year's SolarWinds hack? You know, the one that no one could prove where it came from?
Well, we now know who's responsible - the Intern!


"I've got a stronger password than 'solarwinds123' to stop my kids from watching too much YouTube on their iPad. You and your company were supposed to be preventing the Russians from reading Defense Department emails!" said US Representative Katie Porter after learning about the password.

Everything was perfectly fine at SolarWinds until that damn intern!
And I bet the intern didn't take complete and full responsibility for all of cyber security at this major software company either!
As opposed to those brave and honest SolarWinds executives, who just happen to have massively sold their stock options right before telling the public about the worst hack in history.

Speaking of responsibility, RUSSIA!
Everyone knows Russia did it. It's so obvious it doesn't even have to be proven.
...except when it was someone else.

By now, most people know that hackers tied to the Russian government compromised the SolarWinds software build system and used it to push a malicious update to some 18,000 of the company’s customers. On Monday, researchers published evidence that hackers from China also targeted SolarWinds customers in what security analysts have said was a distinctly different operation.

CHINA! At the very same time, no less.
Something tells me that Iran, North Korea, Venezuela, and socialism hacked us too.

So obviously we must go to war with someone.


According to a report from The New York Times, the Biden administration is planning cyberattacks against Russia in the coming weeks. The cyber offensive could come with new sanctions and would mark a serious escalation towards Moscow from the new administration.

Anonymous US officials told the Times that the first “major move” is expected to happen over the next three weeks. It will consist of a “series of clandestine actions across Russian networks that are intended to be evident to President Vladimir V. Putin and his intelligence services and military but not to the wider world.”
The US formally attributed blame to Russia for the SolarWinds hack in January. The FBI, NSA, the Cybersecurity and Infrastructure Security Agency, and the Office of the DNI released a statement that said the hack was “likely Russian in origin.” Missing from the statement was any evidence for the accusation.

The reality is, attributing cyberactivity is difficult as hackers have methods to conceal their identity. One reason US officials and media outlets say it could have been Russia is the sophistication of the hack. But testimony from SolarWinds’ former CEO and a cybersecurity expert made it clear that anybody could have accessed SolarWinds’ servers due to a major security lapse.

It's a real big coincidence that the fact that our nation's biggest rivals hacked SolarWinds (without leaving a trace) does manage to distract from the corporate incompetence and insider trading.

26 users have voted.


Raggedy Ann's picture

What's a country to do? Unknw

7 users have voted.

"The “jumpers” reminded us that one day we will all face only one choice and that is how we will die, not how we will live." Chris Hedges on 9/11

@Raggedy Ann Bomb, Bomb, Bomb Iran! /S

7 users have voted.

not only is this one of your most insightful, and hilarious, essays, gjohnsit, but you're shedding light on the laughter on the part of Defense contractors, laughing at us, the American people.

Because Russia hacked the DNC emails, we are getting all new nuclear weapons, new submarines, and new silos because the new nukes don't fit the old subs and silos. Turns out there was no hack.

Now, because Russia was sophisticated enough to burn through an intern's poorly chosen password, our corporate, Treasury, and Defense department security was destroyed, and so we need new Cyber. We're using our old Cyber to demolish the Russians.

I just can't help feeling the Defense contractors are falling off their chairs laughing at us, and hopefully some of them will be knocked unconscious.

16 users have voted.

@Linda Wood

2 users have voted.

"Without the right to offend, freedom of speech does not exist." Taslima Nasrin

@Fishtroller 02

I completely agree with you. There was no hack In December 2017 Crowdstrike's source of the hack lie admitted to Congress, under oath, that there was no hack. I apologize for being unclear about my position on that.

3 users have voted.

The nation’s top cybersecurity official told lawmakers Wednesday that the federal government is seeing “widespread” hacking using recently uncovered vulnerabilities in a Microsoft email application, with researchers saying almost a dozen hacking groups have used the flaw to target a variety of organizations.

Brandon Wales, the acting director of the Cybersecurity and Infrastructure Security Agency (CISA), testified to a House committee that the previously unknown vulnerabilities on Microsoft Exchange Server have been exploited globally and could have long-lasting consequences.

“CISA is already aware of widespread exploitation of the vulnerabilities, and trusted partners have observed malicious actors using these vulnerabilities to gain access to targeted organizations in the United States and globally,” Wales testified to the House Appropriations Committee’s homeland security subcommittee.

“Importantly, once an adversary gains access to a Microsoft Exchange Server, they can access and control an enterprise network even after the vulnerabilities are patched, and malicious exploitation could be executed by actors with various motivations, from stealing information to executing ransomware attacks to physically damaging infrastructure,” he warned.

Wales’s testimony came a week after CISA issued an emergency directive ordering all federal agencies to investigate for signs of compromise, and if found to immediately patch their systems to prevent exploitation.

8 users have voted.

deserves to be hacked.
for less than the cost of a Starbucks coffee once a week, actually closer to the cost of a Dunkin Donuts cost of coffee once a week, you can buy your own domain and hire a hosting service. Or go one step farther and sign up with an encrypted e-mail service.

3 users have voted.

I've seen lots of changes. What doesn't change is people. Same old hairless apes.

Matt Stoller wrote about SolarWinds and how private equity is the cause for our shitty and vulnerable infrastructure.

How to Get Rich Sabotaging Nuclear Weapons Facilities

The most interesting part of the cybersecurity problem is that it isn’t purely about government capacity at all; private sector corporations maintain critical infrastructure that is in the “battle space.” Private firms like Microsoft are being heavily scrutinized; I had one guest-post from last January on why the firm doesn’t manage its security problems particularly well, and another on how it is using its market power to monopolize the cybersecurity market with subpar products. And yet these companies have no actual public obligations, or at least, nothing formal. They are for-profit entities with little liability for the choices they make that might impose costs onto others.

SolarWinds sells a network management package called Orion, and it was through Orion that the Russians invaded these systems, putting malware into updates that the company sent to clients. Now, Russian hackers are extremely sophisticated sleuths, but it didn’t take a genius to hack this company. It’s not just that criminals traded information about how to hack SolarWinds systems; one security researcher alerted the company last year that “anyone could access SolarWinds’ update server by using the password “solarwinds123.’”

Using passwords ripped form the movie Spaceballs is one thing, but it appears that lax security practice at the company was common, systemic, and longstanding. The company puts its engineering in the hands of cheaper Eastern Europe coders, where it’s easier for Russian engineers to penetrate their product development. SolarWinds didn’t bother to hire a senior official to focus on security until 2017, and then only after it was forced to do so by European regulations. Even then, SolarWinds CEO, Kevin Thompson, ignored the risk. As the New York Times noted, one security “adviser at SolarWinds, said he warned management that year that unless it took a more proactive approach to its internal security, a cybersecurity episode would be “catastrophic.” The executive in charge of security quit in frustration. Even after the hack, the company continued screwing up; SolarWinds didn’t even stop offering compromised software for several days after it was discovered.

In other words, the same sloppy and corrupt practices that allowed this massive cybersecurity hack made Bravo a billionaire. In a sense, this hack, and many more like it, will continue to happen, as long as men like Bravo get rich creating security vulnerabilities for bad actors to exploit.

In July, I interviewed Eileen Appelbaum, the author of Private Equity at Work: When Wall Street Manages Main Street. Eileen is quiet economist who has been leading the political fight against private equity barons, for years. She told me that the key problem with private equity isn’t the idea of financiers doing investment, as investment is necessary for any commercial sector to flourish. The problem is how these financiers - usually large ones who do cookie cutter deals - offload risk onto employees, lenders, investors, and the public itself.

12 users have voted.