topic Re: Solarwinds supply chain attack - still a good idea to whitelist thirdparty applications at AV? in Threats

Solarwinds supply chain attack - still a good idea to whitelist thirdparty applications at AV?

CY — Fri, 18 Dec 2020 03:23:23 GMT

I had always been wondering if it is a good idea allow whitelisting of certain third party application and folders at anti-malware platform so that it can run smoothly without interference from AV scanning. With whitelisting a requirement for the solarwind onion platform, whitelisting would had prevented the anti-malware from detecting malicious activities originating from the compromise software. So should be put a stop to all such whitelisting? Is there a good reason and guidelines to allow whitelisting safely?

Re: Solarwinds supply chain attack - still a good idea to whitelist thirdparty applications at AV?

Beads — Fri, 18 Dec 2020 03:40:04 GMT

Not necessarily. I put many of these types of software on a bit higher scrutiny. WAF, outer ring before the next protection zone, higher degree of logging etc. as a matter of best practice beginning after the Target fiasco. Have I found the magic bad packet? No, eventually I will or someone will get lazy and miss something stupid.

I am just waiting for the final forensics on this and FireEye before jumping to any conclusions, though.

Happy reading!

b/eads

Re: Solarwinds supply chain attack - still a good idea to whitelist thirdparty applications at AV?

Carleton — Fri, 18 Dec 2020 06:10:47 GMT

Early this week, FireEye said that the hackers were infecting targets using Orion, a widely used network management tool from SolarWinds. After taking control of the Orion update mechanism, the attackers were using it to install a backdoor that FireEye researchers are calling Sunburst.

Re: Solarwinds supply chain attack - still a good idea to whitelist thirdparty applications at AV?

rslade — Fri, 18 Dec 2020 19:07:19 GMT

Definitely an important question. Whitelisting should be done carefully,
particularly with applications which require pervasive permissions, and, in this
case, it still would have been extemely difficult to detect the attack, since it was
properly signed and authenticated.

====================== (quote inserted randomly by Pegasus Mailer)
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
Great spirits have always encountered violent opposition from
mediocre minds. - Albert Einstein
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://community.isc2.org/t5/forums/recentpostspage/user-id/1324864413

Re: Solarwinds supply chain attack - still a good idea to whitelist thirdparty applications at AV?

manickamk — Mon, 21 Dec 2020 10:35:58 GMT

Very valid question, the direction is Zero Trust and SDP.