Dave Kennedy on Twitter: "If you are running Solarwinds Orion, things you can do: Determine patch levels and ensure you are running the latest. Isolate / contain all Solarwinds servers at this time until all full details come out. Begin analysis from those servers dating back from at least March."

@HackingDave

Founder of @TrustedSec @Binary_Defense. Family, Hacker, Security, Ex-CSO, Media/TV, USMC Intel. My drive is to help others and to make the world a better place.

Strongsville, Ohio

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

1. Sean Barbour「バーバーシャーﾝ」‏ @old_Red_f0x 13 Dec 2020
  Replying to @HackingDave
  
  Isolation is a good option but might be difficult for anyone who heavily relies on them and is monitoring systems without the agent. If this is the case then traffic monitoring might be the only option.
  
  3 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. WalletForums‏ @walletforums 14 Dec 2020
  Replying to @HackingDave
  
  Actual attack might happen after monitoring system is isolated/offline.
  
  2 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. 和子晴‏ @atxBlackMamba 14 Dec 2020
  Replying to @HackingDave
  
  Or switch to Tipping Point / Trend Micro.
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. Lucky7sCyber‏ @Lucky7sCyber 14 Dec 2020
  Replying to @HackingDave
  
  Or if possible just disable the service entirely until patch is released- again only if possible
  
  2 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. cryptohag‏ @cryptohag 14 Dec 2020
  Replying to @HackingDave
  
  finally somebody with some sense. too many "cyber security journalists" on twitter with no helpful info for those affected other than "stay tuned", I feel sorry for them.
  
  4 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. SubZe12o‏ @El33tsamurai 14 Dec 2020
  Replying to @HackingDave
  
  Bend over and kiss Christmas freeze good bye ;)
  
  2 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. JimK‏ @kuhnsster 14 Dec 2020
  Replying to @HackingDave
  
  Start looking for data being exfilled in outbound traffic. Look for top talkers..
  
  2 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. ISO8601‏ @SMarr311 14 Dec 2020
  Replying to @HackingDave
  
  My org didn't do any Orion updates in 2020 except for October with v2020.2.1. No signs of compromise, using the IOCs published so far.
  
  2 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. 0f2g‏ @0x0f2g 14 Dec 2020
  Replying to @HackingDave
  
  Should not everything be contained within it’s own VLAN? Is everyone else not using segmentation?
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo