The SolarWinds Supply Chain Compromise
summary
Reconstructs the Sunburst DNS command‑and‑control protocol, shows a one‑byte XOR, per‑host victim IDs and a 19‑bit timestamp, and provides a working Sunburst domain decoder to parse subdomains into internal AD names. DNS responses use IPs to tell implants to continue beaconing or to return a CNAME that upgrades to an HTTPS backdoor; attackers disable ~99% disabled of victims and only ~1% get targeted. Timeline: DNS C2 runs Feb–Oct 2020 (eight months). Actionable: collect outbound passive DNS and enforce vendor dogfooding and least‑privilege.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:20Supply chain compromise overview
- 7:39DNS as C2 mechanism
- 11:12Reverse engineering DNS protocol
- 18:27Identifying victims
- 23:06Defending against supply chain attacks
- 26:19Summary and recommendations
- 27:43Q&A
related talks
40mInside the Mind of the SUNBURST Adversary
47mDNS On Fire
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
41mWhen Cybersecurity Is More Than Just Vulnerabilities
23mSolarWinds: What Really Happened?
25mDark Side of the DNS Force
26mMisuse of DNS, the Second Most Used Protocol
25mGlobal Threat Brief: Hacks and Adversaries Unveiled