Home » SolarWinds hacking campaign puts Microsoft in hot seat
SolarWinds hacking campaign puts Microsoft in hot seat
Fox Business Flash top headlines for April 16
Check out what’s clicking on FoxBusiness.com.
The sprawling, monthslong hacking campaign deemed a grave threat to U.S. national security came to be known as SolarWinds for the company whose software update Russian intelligence agents stealthily seeded with malware to penetrate sensitive government and private networks.
Yet it was Microsoft whose code the cyber spies persistently abused in the campaign's second stage, rifling through emails and other files of such high-value targets as then-acting Homeland Security chief Chad Wolf — and hopping undetected among victim networks.
This has put the world’s third-most valuable company in the hot seat. Because its products are a de facto monoculture in government and industry — with more than 85% market share — federal lawmakers are insisting that Microsoft swiftly upgrade security to what they say it should have provided in the first place, and without fleecing taxpayers.
Seeking to assuage concerns, Microsoft this past week offered all federal agencies a year of "advanced" security features at no extra charge. But it also seeks to deflect blame, saying it is customers who do not always make security a priority.
THESE TECHNOLOGIES COULD HOLD BACK BUSINESS TRAVEL INDEFINITELY
Risks in Microsoft's foreign dealings also came into relief when the Biden administration imposed sanctions Thursday on a half-dozen Russian IT companies it said support Kremlin hacking. Most prominent was Positive Technologies, which was among more than 80 companies that Microsoft has supplied with early access to data on vulnerabilities detected in its products. Following the sanctions announcement, Microsoft said Positive Tech was no longer in the program and removed its name from a list of participants on its website.
The SolarWinds hackers took full advantage of what George Kurtz, CEO of top cybersecurity firm CrowdStrike, called "systematic weaknesses" in key elements of Microsoft code to mine at least nine U.S. government agencies — the departments of Justice and Treasury, among them — and more than 100 private companies and think tanks, including software and telecommunications providers.
The SolarWinds hackers' abuse of Microsoft’s identity and access architecture — which validates users' identities and grants them access to email, documents and other data — did the most dramatic harm, the nonpartisan Atlantic Council think tank said in a report. That set the hack apart as "a widespread intelligence coup." In nearly every case of post-intrusion mischief, the intruders "silently moved through Microsoft products "vacuuming up emails and files from dozens of organizations."
Thanks in part to the carte blanche that victim networks granted the infected Solarwinds network management software in the form of administrative privileges, the intruders could move laterally across them, even jump among organizations. They used it to sneak into the cybersecurity firm Malwarebytes and to target customers of Mimecast, an email security company.
The campaign’s "hallmark" was the intruders’ ability to impersonate legitimate users and create counterfeit credentials that let them grab data stored remotely by Microsoft Office, the acting director of the Cybersecurity Infrastructure and Security Agency, Brandon Wales, told a mid-March congressional hearing. "It was all because they compromised those systems that manage trust and identity on networks," he said.