--- title: "When a security tool becomes dangerous — ZEBR.ai" description: "In IT today, the vast majority of companies protect themselves against cybercriminals in various ways, most often by deploying one or more security products. However, can one of these products be attacked by attackers and thereby become dangerous itself, putting the protected network at risk? Unfortunately, we must…" url: "https://zebr.ai/en/blog/when-a-security-tool-becomes-dangerous" markdown_url: "https://zebr.ai/en/blog/when-a-security-tool-becomes-dangerous.md" language: "en" published: "2021-02-26T12:45:35+00:00" alternates: cs: "https://zebr.ai/cs/blog/kdyz-se-bezpecnostni-prvek-stane-nebezpecnym.md" sl: "https://zebr.ai/sl/blog/ko-se-varnostni-element-spremeni-v-nevarnega.md" sk: "https://zebr.ai/sk/blog/ked-sa-bezpecnostny-prvok-stane-nebezpecnym.md" hr: "https://zebr.ai/hr/blog/kada-sigurnosni-element-postane-opasan.md" sr-Latn: "https://zebr.ai/sr-latn/blog/kada-bezbednosni-element-postane-opasan.md" bs: "https://zebr.ai/bs/blog/kada-sigurnosni-element-postane-opasan.md" sq: "https://zebr.ai/sq/blog/kur-nje-element-sigurie-behet-i-rrezikshem.md" fr: "https://zebr.ai/fr/blog/quand-un-element-de-securite-devient-dangereux.md" es: "https://zebr.ai/es/blog/cuando-un-elemento-de-seguridad-se-vuelve-peligroso.md" de: "https://zebr.ai/de/blog/wenn-ein-sicherheitselement-gefaehrlich-wird.md" pt-BR: "https://zebr.ai/pt-br/blog/quando-um-recurso-de-seguranca-se-torna-perigoso.md" pl: "https://zebr.ai/pl/blog/gdy-element-bezpieczenstwa-staje-sie-niebezpieczny.md" it: "https://zebr.ai/it/blog/quando-un-elemento-di-sicurezza-diventa-pericoloso.md" nl: "https://zebr.ai/nl/blog/wanneer-een-beveiligingscomponent-gevaarlijk-wordt.md" hu: "https://zebr.ai/hu/blog/amikor-egy-biztonsagi-elem-veszelyesse-valik.md" ro: "https://zebr.ai/ro/blog/cand-un-element-de-securitate-devine-periculos.md" tr: "https://zebr.ai/tr/blog/guvenlik-unsuru-tehlikeli-hale-geldiginde.md" id: "https://zebr.ai/id/blog/ketika-fitur-keamanan-menjadi-berbahaya.md" --- [Home](https://zebr.ai/en/) [Blog](https://zebr.ai/en/blog) When a security tool becomes dangerous # When a security tool becomes dangerous [blog](https://zebr.ai/en/blog?tag=blog) [GFI Software](https://zebr.ai/en/blog?tag=gfi-software) [N-able](https://zebr.ai/en/blog?tag=n-able) [patch management](https://zebr.ai/en/blog?tag=patch-management) [vulnerabilities](https://zebr.ai/en/blog?tag=vulnerabilities) In IT today, the vast majority of companies protect themselves against cybercriminals in various ways, most often by deploying one or more security products. However, can one of these products be attacked by attackers and thereby become dangerous itself, putting the protected network at risk? Unfortunately, we must… 26/02/2021 · 4 min read · ZEBR.ai editorial team In IT today, the vast majority of companies protect themselves against cybercriminals in various ways, most often by deploying one or more security products. However, can one of these products be attacked by attackers and thereby become dangerous itself, putting the protected network at risk? Unfortunately, we must state that this can happen, and history has already seen several such cases. One such case occurred at the end of last year, when it was revealed that SolarWinds Orion remote management software for workstations and servers had been compromised, and attackers exploited its ability to distribute executable code, spreading malware instead of updates and patches. On December 13, 2020, CISA (Cybersecurity & Infrastructure Security Agency) issued a directive warning of this security risk and ordering all federal agencies in the United States to take immediate action, most commonly to immediately shut down the SolarWinds Orion platform in addition to checking at once whether an attack had already occurred. The list of compromised institutions is quite impressive and includes very well-known names such as the US Pentagon, NASA, NSA, and others. Allow me a brief note here – the malware called Sunburst attacked only the SolarWinds Orion platform, not other products in the SolarWinds family, such as SolarWinds MSP N-Central and RMM. You can find more details at this link: How does such an attack through a security product work? The compromise of the SolarWinds Orion system consists of several layers. The server component of the Orion platform is regularly updated from update servers. These servers were the first to be attacked, and the attackers managed to place malicious code on them, making it available for unsuspecting organizations to download. After penetrating the victims' networks, the attackers avoided detection in several ways. The first was to delay any action, meaning that the code was not activated immediately but only after two weeks. Furthermore, the attackers were able to digitally sign the code and hide it in a library called BusinessLayer.dll. Last but not least, this code uses several techniques to detect whether it is being run in a sandbox. It is usually enough for it to try to “ping” known network segments to verify whether they exist, as well as its own “base.” So far, this has been a classic breach of the SolarWinds Orion network and its customers' networks. However, at this point we must realize that the attacker found themselves in the right place at exactly the right time. Software intended for managing computers on a network, updating them, and installing or uninstalling applications must necessarily have sufficiently high permissions, for example in the form of a local or domain administrator. And our attacker now has this software fully at their disposal and can therefore install any additional code on all devices in the managed network and, of course, run it as well. This can begin the final phase of the attack, which will vary from victim to victim; the attacker will decide based on the information obtained what makes the victim's network valuable to them. You may now think that, if you were in the victim's situation, simply shutting down the Orion platform would be enough and the danger would no longer exist. However, that is a major misconception, because if the attacker has reached the stage where they fully control the network, they could have installed any additional code on any other computers, and therefore even shutting down the management platform would not eliminate the danger. It is necessary to act proactively and scan the entire network for the presence of dangerous code. Other vendors have already responded to the compromise of the Orion platform, and GFI Software, for example, has added to its **GFI LanGuard** product the ability to detect vulnerabilities caused by this compromise. And not only that: GFI LanGuard has capabilities very similar to SolarWinds Orion, namely patch management and network auditing, while also adding the ability to scan for vulnerabilities on all devices on the network. The vendor's approach of providing a fully functional 30-day trial version is very positive. By default, the trial version is limited to 25 IP addresses, but a simple request to the vendor can expand support to up to 10,000 devices. Such a generous offer will certainly enable all companies affected by the Orion platform vulnerability to clean up their network and remain fully protected throughout the entire period. *The article was published in IT Systems magazine, issue 1-2/2021.* Article author: ZEBR.ai editorial team Read on ## More related articles [All articles](https://zebr.ai/en/blog) ### [ZEBR.AI: N-able introduces shadow AI identification into its UEM and security solutions](https://zebr.ai/en/blog/zebr-ai-n-able-introduces-shadow-ai-identification-into-its-uem-and-security-solutions) New capabilities provide visibility into the use of AI tools across all endpoints and networks by individual identities, without the need for additional agents or infrastructure 28/09/2026 · 3 min read ### [Acronis: Ransomware can halt production even without attacking PLC systems](https://zebr.ai/en/blog/acronis-ransomware-can-halt-production-even-without-attacking-plc-systems) For manufacturing companies, ransomware is not just a matter of IT security, but a matter of production continuity 23/09/2026 · 3 min read ### [GFI Archiver AI simplifies integration with GFI KerioConnect](https://zebr.ai/en/blog/gfi-archiver-ai-simplifies-integration-with-gfi-kerioconnect) Direct integration of both products makes working with corporate emails easier, improves mail server performance, and enables more effective compliance with regulations 21/09/2026 · 2 min read Contact ## Do you need a solution for yourself or for your client? Tell us which service you are looking into, and a specialist in that area will get back to you directly. [(704) 745-4214](tel:+17047454214)\ --- - Source: - Site overview for AI agents: