Karsten Wenzlaff, Advisor
August 26th, 2025
While the SolarWinds hack primarily targeted in-house infrastructure, the breach has morphed into a multidimensional assault on key computing infrastructure, including cloud services.
The SolarWinds supply chain attack, which was broad in scope and sophisticated in nature and execution, could affect popular cloud-based services provided by key players, including Microsoft and Amazon. This is because the SolarWinds Orion software, widely used for network monitoring, could be deployed in cloud environments.
Under such conditions, it might have privileged access to AWS and Microsoft Azure API keys, Identity and Access Management (IAM) services, and other security credentials.
Similarly, compromised Orion software running on in-house environments allows attackers to authenticate against cloud platforms by manipulating the Security Assertion Markup Language (SAML) to create access tokens.
Details from the NSA and Microsoft show that the suspected Russian hackers behind the SolarWinds hack were targeting cloud services such as Office 365.
Additionally, Reuters’ reporting claimed that hackers had compromised cloud services on National Telecommunications and Information Administration’s Microsoft Office 365 account and monitored staff emails for months.
Similarly, a recent report by Microsoft also revealed that the attackers tried to read CrowdStrike’s emails through a compromised reseller’s Microsoft Azure account.
SolarWinds hack attributed to suspected Russian hackers threatens various cloud infrastructure such as AWS and Microsoft Azure in several ways.
Firstly, Orion databases store AWS and Azure cloud platforms’ API keys alongside other security credentials. Attackers could later access the stored security identifications to compromise other cloud services.
Similarly, SolarWinds Orion software deployed on AWS or Azure cloud platforms has access to root API keys. These privileges grant an attacker full admin access to the cloud services running on the platform.
Orion software also requires access to Identity and Access Management (IAM) services. Consequently, running Orion software injected with malicious code compromises the whole Orion IAM identity services on the cloud environment. Attackers could exploit the IAM to expose resources and networks and perform role chaining to escalate access privileges.
A resource-based policy allows any principal in the account to access the resource without identity-based permissions in the AWS platform. Consequently, Orion IAM identity could gain access to resources, leading to resource exposure.
Similarly, if a cloud service’s trust policy allows various identities to assume a role, the role could be adopted by any trusted identity residing within the cloud account. This leads to role chaining, which attackers could use to escalate privileges on the cloud platform.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Forbes | | Dec 22, 2020
Why Not An Apple ID For Your Dog?We spend a lot of time talking about digital identity for people and speculating about whether Apple ID or federated Bank ID or centralised Government ID is the best implementation. But in the new online world, there are a great many things other than people that will need to have digital identities in order to participate in a functioning post-industrial economy. Things, for example. Artificial Intelligences. Bots will need identities. In fact I'm writing a book about this at the moment. It's called "Will Robots Need Passports?" and it will be out next year sometime.
(And the answer, as I am sure you already know, is "yes". Spoiler alert: robots will need passports because they will need to have authorisation to access resources.)
What other things will need identities? Well, I read with great interest a report in the Times of India about a new smartphone app that farmers can use to check information about cattle. This was developed in response to an appeal from Prime Minister Modi for a means to reduce cattle theft. As you probably know, India already has a national identity number for people and it has worked pretty well, providing a low-cost mechanism to establish the unique identities of citizens and thereby contribute to the goal of financial inclusion which (as everyone knows) is an identity problem. Therefore, it would seem logical to give animals a number too.
But how do you tell Napoleon from Snowball? Well, specific information "unique to each animal" like the footprint, height, weight, colour and tail hair is recorded in the software and a unique ID is generated. As one of the designers of the Indian app notes, the animal ID "is very useful when insuring cattle", which is a good point. I am slightly surprised that, all other things being equal, they didn't put the IDs on a quantum-resistant blockchain in the cloud, but that's probably version 3.
We don't spend anything like enough time thinking about the digital identity of animals. The biometric identification of animals and the association of a digital identity with individual beasts clearly has significant economic value which, in turn, means fintech opportunities.
I don't know how unique animal footprints are, so I cannot comment on adjusting the false accept and false reject rates for optimal barnyard efficiency, but I do know that face recognition might be a quicker and more efficient way to tell one cow from another not only for tracking but also for detecting diseases or finding lost animals. The identification can then also been used to feed into databases to offer consumers more transparent information about the origin of their food and ensure the animals have been well-treated.
I’m not sure if I really want to scan the barcode on my rib of beef and have the system pull up a picture of the cow grazing peacefully, but if some people do then why not give it a try? There are plenty of “blockchain” startups out there right now trying to track food from source to table and perhaps animal digital identity is what they need to automate for efficient data entry (after all, garbage in, garbage that’s now immutable out: GIGIO).
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |