A former NSA hacker breaks down the FireEye hack

Turn to CNBC TV for the latest stock market news and analysis. From market futures to live price updates CNBC is the leader in business news worldwide.


Connect with CNBC News Online

#CNBC
#CNBCTV

[MikeSimoneLV]

Despite working for one of their competitors, I really applaud the approach FireEye took towards disclosing the attack, and releasing mitigations for the tools which got exfiltrated. That's a solid move, and they're definitely doing the right thing.

There are only two types of company: Those who have been breached, and those who don't know they've been breached. People calling for FireEye to be shut down or punished for this are morons. They were a high-profile, high-value target, and a breach was inevitable. They will recover from this, and their disclosure is, quite frankly, a perfect example of what one *should* do in a breach.

[thewolfofswingthat]

lol hacker stealing hacking tools from other hackers

[JerryLee..]

This is like a drug dealer robbing other drug dealers.

[the_DOS]

This guest, David, did a great job explaining the issue.

[zolagb]

Solarwind back door password solarwind123 lmao

[puyatecla]

I am curious as to what "techniques never seen before by us in all our past investigations" are those those hackers used

[Sueloveschoc]

I’d buy Fireeye stocks now when they’re low. They’ll survive this.

[Rickety]

It’s sad this man discredits himself. He clearly did not read Fireeye’s reports available publicly on their website.

[watchchat]

So...this security company was hacked and lost these tools? That is just as concerning and what does it say about the security company?

[alanmorris]

I don't hear Trump threatening to take Russia to court. He's out playing golf again.

[nozmo]

My biggest question is, WHY ARE OUR GOVERNMENT SERVERS CONNECTED TO THE INTERNET IN THE FIRST PLACE???

[Ms.Robot.]

This is why software should not be a substitute for CYBERSECURITY people.

[shainz]

Imagine FIREYE is Last night me and my friend were discussing about which is most secure phone out there 🤔

[arifsjc]

This "expert" David Kennedy fails to even mention that it was SolarWinds' official ver of Orion software had embedded malware /attack tool(s) detected by Fireeye in own network infrastructure. Fireeye was capable of identifying the tool and reported so others can safeguard themselves. Then, the expert failed to mention that other SolarWinds Orion customers running those versions could also have been hacked, but they or their security consultants just didn't even knew about it till Fireeye disclosure. Lastly, after admitting there "... we don't for sure ..." (ummm, about the culprit), he goes on and on Russia probably because it makes much more sensational news. You want to learn about security attacks, just go to some network security vendor's website. SANS also posted on Youtube a webcast on this attack.

Here is Fireeye's own blog on this specific attack mentioning SolarWinds but no Russia or China:

Threat Research
Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
December 13, 2020 | by FireEye
...
...<snip>
FireEye discovered a supply chain attack trojanizing SolarWinds Orion business software updates in order to distribute malware we call SUNBURST.
...<snip>

[Thumper]

Who payed him off to push Russia and not china

[Rickety]

Hmmm. You better tell Fireeye!! Because THEY say theres no evidence it’s Russia. They created a whole new team designation for this hack.

[whatabouttheearth]

FiverEyes!

I still don't know how to operate Windows OS and have only watched a few YouTube vids on geopolitics so Im gonna enter my staunch opinion here:

...

[DonDarrelMendozaTadaya]

Someone must've had quite a price...

[jonboybilly]

Dave Kennedy is awesome. I met him several times at DerbyCon.

[Skankhunt.]

0:33 wait so FireEye was hacking them first?