[mehrdadn]

Hmm, interesting. I'm confused if that's how I should read this. You might be right. I assume you're referring to this paragraph?

> Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Therefore, insertion of malicious code into the SolarWinds.Orion.Core.BusinessLayer.dll likely occurred at an early stage, before the final stages of the software build, which would include digitally signing the compiled code.

They talk about adding classes at an early stage... I assumed that meant modifying the source code in some fashion. Sounds like you took it to mean they inserted binary (MSIL?) code during the build? Or are you referring to a different paragraph that indicates this wasn't part of source control?

[eternalny1]

SolarWinds themselves it claiming it.

https://www.solarwinds.com/securityadvisory/faq

> Our initial investigations point to an issue in the Orion software build system in which the vulnerability was insert which, if present and activated, could potentially allow an attacker to compromise the server on which the Orion Platform products run.

Under "With these processes in place how was your code compromised?"

[dwheeler]

If the compromise was inserted during the build process, then one countermeasure could have been reproducible builds. Reproducible builds require the source code, but they can verify whether or not the build matches the claimed source code. That would work even after it was signed.

[mehrdadn]

Thanks!

[ThePadawan]

I was also thinking of manipulating source code. Let's say there are multiple stages:

1. Source code as available on development machines and version control

2. Source code as available on build machines

3. .dll generated by build machines

I would assume (based on the article's language that you quoted) that manipulation happened on (2), not (1) or (3).

[mehrdadn]

Oh interesting. So that would mean it would depend on a compromised build machine. Yeah, that would make sense, and I guess you couldn't prevent it like this in that case. Thanks!