Analyzing the compromised DLL file that started the Solorigate attack
I am curious how this code actually made it in, based upon the following:> The fact that the compromised file is digitally signed suggests the attackers were able to access the company’s software development or distribution pipeline. Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes.Unless this a compromise of the build machine, it sounds suspiciously like a lack of code review standards to me.In our organization, the only way to get a line of code into master is through a process where a 2nd developer reviews and approves via GitHub. Branch protection rules are really nice for this kind of concern. Obviously, the attacker can hit right after cloning source, but it helps to know your foundations are clean regardless.