SolarWinds: What Hit Us Could Hit Others
Oh good. The attackers were only in their systems since 9&#x2F;4&#x2F;19 before being detected on 12&#x2F;12&#x2F;20, so only 15 months of infiltration into SolarWinds&#x27; systems before detection. At least the payload was only deployed 2&#x2F;20&#x2F;20, so their customers were only completely infiltrated without detection for 8 months. Assuming the attackers could only get a 10 MB&#x2F;s channel <i>total</i> per target even though they probably infected thousands to tens of thousands of machines per target, at ~20 million seconds that would constitute ~200 TB exfiltrated per customer or ~19 years of 1080p video.<p>If an attacker has just one day to root around and exfiltrate they can easily get valuable information. If they are given 8 months they have already gotten everything of value for months and are just waiting around for any new data to come in. Think how inadequate your systems must be to let an attacker sit around in your systems for 8 months, it is mind-boggling how unqualified their systems are for their problems. And this is not just an indictment of SolarWinds. Just in case anybody forgets, it was the top-flight security company FireEye who discovered this breach after realizing they themselves were breached. A &quot;best of the best&quot; security company took 8 months before realizing that they or any of their customers had been breached. This is what &quot;top-class&quot; security buys you.