Guidance on accounts used on systems affected by the current hack?

edwardconde

We are looking at all avenues that we need to take. Something not mentioned or maybe I missed it, was if it was recommended to change passwords for service accounts used within SolarWinds. Also what about configured admin accounts for the environment? Or accounts used to access ESX and windows hosts? Should we recommend everyone that has rights to orion to change their passwords?

Thanks

paynecave

You are right to assume that you need to change login credentials on pretty much anything that your SW server touches but don't be too quick about it.  I would recommend two resources if you haven't already seen them.

https://cyber.dhs.gov/ed/21-01/

https://www.sans.org/webcasts/emergency-webcast-about-solarwinds-supply-chain-attack-118015

But to the point, CISA gives good guidance starting with cutting off your SolarWinds server's internet access.  But on the list of possible malware included in the attack is something like a key logger that, once reconnected to the internet, could send your new usernames/passwords to the attacker.  So you won't want to change anything until you are sure that your system was not compromised or if it was, until you are sure that you have removed all malicious files.  Once you are confident that your system is clean then you can assign new credentials and put your system back on the internet.  

I wish I knew how long my system is going to be offline.  It's almost like losing a leg.  I'll get done what I need to get done, but it's going to take me a little longer than usual.