Creating, managing and fixing the often highly-customized systems that allow for that centralized management to happen is a large part of the system administrator's job. The company grew quickly and has remained aggressive in its acquisition of smaller firms to introduce additional functionality to their monitoring products.īefore virtualization hit the scene, one of the big value adds for system administrators were applications that allowed for centralized management of server OS and applications. SolarWinds offered an easy-to-install, Windows-based way to monitor lots of servers. Over time, SolarWinds began to integrate more advanced monitoring capabilities, for example by using SNMP. The novelty came from their availability within Windows within a GUI and these features would be a mainstay of SolarWinds and an early differentiator from linux-based products that tended to offer better functionality but a higher bar for usability.

The programs were just what they sounded like - simple ICMP packets to identify hosts. SolarWinds was founded 21 years ago by brothers David and Donald Nonce around a pair of network monitoring products named 'Trace Route' and Ping Sweep. According to FireEye, the 'victims have included government, consulting, technology, telecom andĮxtractive entities in North America, Europe, Asia and the Middle East'. Orion's compromised distribution platform was then leveraged to infect a wide variety of organizations. netblocks or assignments registered to 'bullet proof' hosts that are frequented by criminals. Traffic from infected hosts was disguised using traffic resembling normal SolarWinds activity and avoided using IPs that were part of non-U.S. Multiple signed updates contained additional malware.

The post identified a digitally-signed component of the Orion software, .dll, that contained a backdoor. On December 13th, digital security firm FireEye published a post to their blog with the comprehensive title ' Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor'. However, I have never been employed by SolarWinds and I was not compensated for this post. Full disclosure: I've been employed by several companies that were customers and/or vendors of SolarWinds.

What is solarwinds orion