- This topic has 2 replies, 2 voices, and was last updated 2 years ago by
.
-
The sprawling hacking campaign deemed a grave threat to U.S. national security came to be known as SolarWinds, for the company whose software update was seeded by Russian intelligence agents with malware to penetrate sensitive government and private networks.
Yet it was Microsoft whose code the cyber spies persistently abused in the campaign’s second stage, rifling through emails and other files of such high-value targets as then-acting Homeland Security chief Chad Wolf – and hopping undetected among victim networks.
This has put the world’s third-most valuable company in the hot seat. Because its products are a de facto monoculture เกมยิงปลา วิธีเล่น in government and industry – with more than 85% market share – federal lawmakers are insisting that Microsoft swiftly upgrade security to what they say it should have provided in the first place, and without fleecing taxpayers.
Seeking to assuage concerns, Microsoft this past week offered all federal agencies a year of “advanced” security features at no extra charge. But it also seeks to deflect blame, saying it is customers who do not always make security a priority.
Risks in Microsoft’s foreign dealings also came into relief when the Biden administration imposed sanctions Thursday on a half-dozen Russian IT companies it said support Kremlin hacking. Most prominent was Positive Technologies, which was among more than 80 companies that Microsoft has supplied with early access to data on vulnerabilities detected in its products. Following the sanctions announcement, Microsoft said Positive Tech was no longer in the program and removed its name from a list of participants on its website.
The SolarWinds hackers took full advantage of what George Kurtz, CEO of top cybersecurity firm CrowdStrike, called “systematic weaknesses” in key elements of Microsoft code to mine at least nine US government agencies – the departments of Justice and Treasury, among them – and more. than 100 private companies and think tanks, including software and telecommunications providers.
The SolarWinds hackers ‘abuse of Microsoft’s identity and access architecture – which validates users’ identities and grants them access to email, documents and other data – did the most dramatic harm, the nonpartisan Atlantic Council think tank said in a report. That set the hack apart as “a widespread intelligence coup.” In nearly every case of post-intrusion mischief, the intruders “silently moved through Microsoft products” vacuuming up emails and files from dozens of organizations. “
- You must be logged in to reply to this topic.
