Microsoft Set to Block SolarWinds Orion Binaries

Microsoft is preparing to quarantine malicious versions of the SolarWinds Orion application used in recent nation state attacks, in a move that may crash systems.

The computing giant had previously released detections to alert customers of its Windows Defender security product if they were running the malicious updates. Although it was recommended that such customers isolate and investigate any such devices, the decision was down to them.

However, in an update yesterday Microsoft effectively said it was taking the decision out of the hands of its customers.

“Starting on Wednesday, December 16 at 8:00 AM PST, Microsoft Defender Antivirus will begin blocking the known malicious SolarWinds binaries,” it said.

“This will quarantine the binary even if the process is running. We also realize this is a server product running in customer environments, so it may not be simple to remove the product from service.”

Over the weekend reports emerged that a previous attack on FireEye was part of a much larger Russian intelligence plot to steal sensitive information from US government and countless other unnamed organizations.

The vector was Orion updates which the attackers managed to seed with malicious binaries used to install the Sunburst (aka Solarigate) backdoor malware. SolarWinds confirmed to the SEC that 18,000 customers were affected.

However, as the product performs crucial network management operations, Microsoft’s decision could theoretically cause some disruption.

“It is important to understand that these binaries represent a significant threat to customer environments,” it argued. “Customers should consider any device with the binary as compromised and should already be investigating devices with this alert.”

Microsoft urged victim organizations to immediately isolate affected devices, identify accounts used on the device and assume they have been compromised, reset passwords, look for lateral movement tools and more.

Need help to be sure you are buying the right tools for remote working? We can help!

KDI can guide your business through a smooth and beneficial change to remote working, ensuring you get value from your remote working. We can help you build a Cloud infrastructure that is effective and tailored around your business needs. With our expert advice, services, and product knowledge we can fit your individual IT needs. Contact us now!

Get advice, service and products that fit your unique needs. KDI is an expert partner for complete IT Services and Networking Support based out of the Greater Vancouver area. We are your one-stop IT solution, uniquely combining aspects of information technology, software development, and accounting expertise to make your work life easier.

Visit our contact page, send an email to info@kdi.ca or give us a call on (604) 574 7225.