By User Friendly 2.0
Dependence on Technology
By: William Sikkens
Host, User Friendly 2.0 Saturday’s at 5:00 p.m.
As we greet 2021 and hope for a better year, hacking has been forefront in the news. A foreign power (the Russians being most likely) managed to break into a company called Solar Winds and from there entered over 250 different systems, both government and private.
Also, a bomber blew up a RV near an AT&T communications building in Nashville, Tennessee and in doing so disabled cell phones, 911 services, other emergency access, and Internet connections. This impacted a 4 state area.
How could this damage affect so many when just one company such as Solar Winds or AT&T were targeted?
Simple, we have become dependent on network communications. While the Internet was originally designed for military use with many backups routes (the web), modern communications rely on hubs. Modern software relies on updates that are sent, in many cases automatically, by the software vendor. These systems are advanced and complicated, which makes them more susceptible to tampering.
For switching centers like AT&T in Nashville, one of many such centers existing all over the country, it is a center point for many different systems to connect. In addition to AT&T’s equipment, other operators lease space in the building. Part of the reason for this is that there’s a major network “backbone” (a very high speed Internet connection) that is tied to these centers. It makes it a logical location to place equipment for easy access to a high speed network. As such many different services from many different companies come through these central points. And that is why disabling the AT&T center caused disruptions in so many other things.
Our computer networks usually rely on technology from different vendors. A basic example of this is something like a Windows server. The server controls the network but it contains software from different companies. The operating system would be from Microsoft but other services come from other companies. Solar Winds produces software to manage large networks that consist of many servers. The hackers were able to place their compromised software into the Solar Winds system that sends out the automatic updates for Solar Winds software. Once that was done, it automatically replicated to every system on which this software was installed. A somewhat insidious plan.
Once that happened it allowed the hackers access to all these other systems. At the moment of writing this article, it is still unknown how much damage the hackers did or what they actually accessed. The concern is that some of these systems contain sensitive information.
An example of this surrounds the concern that the hackers may have accessed the details for something called “Black Start”. Black Start is a plan by the Department of Energy to reset the country’s electrical grid in the event of a nationwide blackout. With access to this information the hackers now may know exactly what equipment to target to prevent the government from turning the electrical grid back on if it’s turned off. This is a less than ideal situation.
Additionally, it appears that the hackers got some of Microsoft’s source code. Source code is the blueprint under which software works. If a hacker wants to target a computer system it’s much easier if they have a complete understanding of how it works. Source code is usually a very closely guarded secret in software companies. Microsoft is no exception to that and has guarded the source code to their products for many years.
It will be awhile until we know how much damage this has done or what the extent of the information released actually is. It is also interesting to note that this demonstrates a huge failure of cybersecurity. The hack was discovered by a private firm called FireEye. If this firm hadn’t discovered it, then we would not have known that the hack occurred. According to The New York Times, the hackers targeted the weak points of the system. It appears that some of the Solar Winds code was written in Eastern Europe and the company has a reputation for lackluster security in it’s products.
William (Bill) Sikkens has been an on-air technology expert since 2014. With an expertise in I.T., cyber security and software design he has had more than 20 years’ experience with advanced technology. Sikkens conceptualizes and designs custom applications for many professional industries from health care to banking and has the ability to explain the details in a way all can understand. Article edited by Gretchen Winkler, who along with Jeremy Winkler are the co-hosts of User Friendly 2.0 here on The Answer Saturday’s at 5:00 p.m.
Links and brand/store information provided are for information only and are not endorsed by Salem Media Group, KPAM or the shows hosts.
Got a technology question or comment for Bill? Follow him on Twitter @sikkensw
