Basic Security Failures Enabled High-Impact Intrusions at OilRig and SolarWinds

Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked OilRig tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to srvr.js, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that Turla had previously hijacked OilRig infrastructure.

A separate assessment of the SolarWinds Orion breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including DHS, FireEye, and the U.S. Treasury, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and Cobalt Strike deployment.