SolarWinds Orion

Stands for: The Orion Platform, SolarWinds' self-hosted monitoring platform and the carrier of the 2020 SUNBURST backdoor

SolarWinds' self-hosted monitoring platform, the base for Network Performance Monitor and its sibling modules, and the software whose signed updates carried the SUNBURST backdoor in 2020; its modules now run on the renamed SolarWinds Platform.

SolarWinds describes the Orion Platform, in the past tense, as a comprehensive, scalable infrastructure monitoring and management platform designed for the era of network and infrastructure monitoring modules and restricted to self-hosted deployment; its modules, Network Performance Monitor, NetFlow Traffic Analyzer, Network Configuration Manager, IP Address Manager, Server & Application Monitor, Virtualization Manager, Storage Resource Monitor and Web Performance Monitor, are now self-hosted on the SolarWinds Platform, which the company calls a new, more expansive platform built with Secure by Design principles. The reason the old name is known far outside network operations is SUNBURST: on 13 December 2020 FireEye disclosed that trojanised Orion updates, digitally signed by SolarWinds, carried a backdoor in SolarWinds.Orion.Core.BusinessLayer.dll, and the same day CISA's Emergency Directive 21-01 ordered federal agencies to disconnect or power down Orion versions 2019.4 through 2020.2.1 HF1. The full story is in the Learn article on the SolarWinds compromise.

The platform. Orion was the common base on which SolarWinds' modules installed: Network Performance Monitor for device and interface health, NetFlow Traffic Analyzer for flow records, Network Configuration Manager for configuration backup and change, IP Address Manager, Server & Application Monitor, Virtualization Manager, Storage Resource Monitor and Web Performance Monitor. It ran on the customer's own servers, which is what the company means today when it says the Orion Platform was restricted to self-hosted deployment. The company's current page is titled 'Orion modules are now self-hosted on the SolarWinds Platform' and presents the successor as a new, more expansive platform rather than a rebranding, built with Secure by Design principles.

Why a monitoring platform is a target. A network monitoring server holds credentials for everything it watches: SNMP community strings and users, Windows service accounts, SSH keys for configuration backup, API tokens for the hypervisors. It sits where it can reach every segment, because reaching every segment is its job. That is why compromising the vendor's update was worth the effort to the actor who did it, and why the directive's first instruction was not to patch but to disconnect.

SUNBURST, in the disclosers' words. FireEye, on 13 December 2020: a supply chain attack trojanising SolarWinds Orion business software updates in order to distribute malware it called SUNBURST, inside SolarWinds.Orion.Core.BusinessLayer.dll, a SolarWinds digitally signed component of the Orion software framework that contains a backdoor communicating over HTTP to third-party servers; after an initial dormant period of up to two weeks it retrieved and executed jobs, transferring and executing files, profiling the system, rebooting it, disabling services, and found its command server through a domain generation algorithm under avsvmcloud[.]com. CISA's Emergency Directive 21-01, the same day, named Orion Platform 2019.4 HF5, 2020.2 RC1 and RC2, 2020.2 and 2020.2 HF1 and required agencies to disconnect or power down the products, image the hosts, analyse stored traffic and report by noon on 14 December. SolarWinds' own 8-K of 14 December said the vulnerability existed in updates released between March and June 2020 and that fewer than 18,000 of its roughly 33,000 Orion maintenance customers were believed to have installed them.

What changed afterwards. The company's platform page, its Secure by Design language and the regulatory history recorded on the SolarWinds entry of the industry timeline are the consequences; the Learn article on the compromise tells the sequence from the September 2019 intrusion to the 2024 court ruling. For an operator the lesson is older than the incident: the monitoring system is a crown jewel, and its update channel is part of the attack surface.

Also known as: orion platform, orion, solarwinds platform, npm orion, sunburst

Sources

← All glossary entries