Solar Flare Pulling Apart SolarWinds Orion

Explore the intricacies of SolarWinds ORION in this 28-minute conference talk from BSides Philly 2016. Delve into the evaluation process, network detection techniques, and default account vulnerabilities. Uncover methods for accessing credentials, utilizing database tools, and decrypting sensitive information. Examine the exportable encryption certificate and its implications. Discover critical findings, including easily reversible "encrypted" password storage and clear text configurations in text files. Learn about database access methods and the nature of the 'SWNETPERFMON.DB' database. Conclude with an overview of results, fixes, and an overall rating of the system's security.

Intro
WHAT IS ORION?
EVALUATION TIME!
HOW DO I FIND IT ON A NETWORK?
DEFAULT ACCOUNT
EVERYONE LIKES CREDENTIALS!
CONVENIENT DATABASE TOOL
DECRYPT!!
WHERE IS CERT?
EXPORTABLE ENCRYPTION CERTIFICATE
FINDING #1 - REALITY CHECK
EASILY REVERSIBLE "ENCRYPTED" PASSWORD STORED
OK... BUT HOW DID YOU ACCESS THE DATABASE??
BUT WHAT KIND OF DATABASE IS 'SWNETPERFMON.DB'?
CLEAR TEXT AND OLD CONFIGURATIONS KEPT IN TEXT FILE
RESULTS / FIXES
OVERALL RATING: A