Is This The Hack Of The Decade?

Microsoft was hacked as part of the suspected Russian campaign that has hit multiple US government agencies by taking advantage of the widespread use of software from SolarWinds Corp.

As with the networking management software by SolarWinds, Microsoft’s own products were then used to further the attacks on others, in what some are calling the biggest hack in a decade.

It is not yet certain how many Microsoft users were affected by the tainted products and  US Department of Homeland Security (DHS) says that the hackers used multiple methods of entry and is investigating the massive hack against the US government, which included  malicious computer code sent to Microsoft

Microsoft is a customer of SolarWinds, the IT provider the hackers used to send software updates to numerous US government agencies. Microsoft says it neutralised the infection before any major damage was done. “We have been actively looking for indicators of this actor and can confirm that we detected malicious SolarWinds binaries in our environment, which we isolated and removed,” the company said in a statement. Microsoft added: “We have not found evidence of access to production services or customer data. Our investigations, which are ongoing, have found absolutely no indications that our systems were used to attack others.”

The hack, which is being blamed on Russia, infiltrated federal agencies, including homeland security and nuclear programs. Microsoft and other companies are also affected.

Microsoft  is a user of Orion, the widely deployed networking management software from SolarWinds Corp which was used in the suspected Russian attacks on vital U.S. agencies and  the US National Security Agency (NSA) issued a rare "cybersecurity advisory"  detailing how certain Microsoft Azure cloud services may have been compromised by hackers and directing users to lock down their systems.

SolarWinds sells software that lets an organization see what's happening on its computer networks. Hackers inserted malicious code into an updated version of the software, called Orion. Around 18,000 SolarWinds customers in stalled the tainted updates onto their systems, the company said. One of the people familiar with the hacking spree said the hackers made use of Microsoft cloud offerings while avoiding Microsoft's corporate infrastructure.

The DHS said the hackers had used other techniques besides corrupting updates of network management software by SolarWinds which is used by hundreds of thousands of companies and government agencies. According to sources, the DHS does not believe Microsoft was a major source of infection and  the hackers appear to have used multiple methods of entry. 

The US Energy Department said it has evidence hackers gained access to its networks as part of the campaign.and the National Nuclear Security Administration (NNSA), which manages the country's nuclear weapons stockpile, was also targeted. An Energy Department spokeswoman said malware "has been isolated to business networks only" and has not impacted U.S. national security, including the NNSA.

The US Cyber Security and Infrastructure Security Agency (CISA) has urged investigators not to assume their organisations were safe if they did not use recent versions of the SolarWinds software. CISA said it was continuing to analyse the other avenues used by the attackers.

Since the campaign was discovered, software companies have cut off communication from those back doors to the computers maintained by the hackers, but an obvious concern is that the attackers might have installed additional ways of maintaining access

The Department of Justice, the FBI and Defense Department have moved routine communication onto classified networks that are believed not to have been breached on the assumption that the non-classified networks have been compromised. But the attackers are very careful and have deleted logs which would reveal the electronic fingerprints about which files they have accessed. That makes it hard to know what has been taken and some major companies have said they have "no evidence" that they were penetrated, but that may only be because the evidence was removed.

In most networks, the attackers would also have been able to create false data, but so far it appears they were interested only in obtaining real data, it is reported bu those familiar with the investigation.

Meanwhile, members of the US Congress are demanding more information about what may have been taken and who was behind it. The House Homeland Security Committee and Oversight Committee announced an investigation, while senators pressed to learn whether individual tax information was obtained.

In a statement, President-elect Joe Biden said he would "elevate cybersecurity as an imperative across the government" and "disrupt and deter our adversaries" from undertaking such major hacks.

Reuters:    Reuters:       PCMag:      CNet:      Channel News Asia

You Might Also Read: 

Microsoft & Intel Agree To Fight Malware:

 

« Major Cyber Attack On US Government Agencies Blamed On Russia
How to Close the Global Cybersecurity Skills Gap: Two Easy Steps »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

TestFort

TestFort

TestFort QA Lab is a specialized software testing company offering independent quality assurance and software testing services.

CyberSec.sk

CyberSec.sk

CyberSec.sk is the Slovak portal bringing the latest cyber security news, politics, tips and instructions on how to protect the internet.

Indusface

Indusface

Indusface offers best website security, web application firewall and SSL certificate to keep your online business much safer.

ReSec Technologies

ReSec Technologies

ReSec provides total protection against all types of known and unknown malware threats including viruses, Trojans, ransomware and phishing, regardless of their delivery method.

Network Integrated Business Solutions (NIBS)

Network Integrated Business Solutions (NIBS)

NIBS is an IT services provider offering a range of services with the aim of simplifying and securing technology.

Turkish Accreditation Agency (TURKAK)

Turkish Accreditation Agency (TURKAK)

TURKAK is the national accreditation body for Turkey. The directory of members provides details of organisations offering certification services for ISO 27001.

National Cybersecurity Preparedness Consortium (NCPC)

National Cybersecurity Preparedness Consortium (NCPC)

The mission of the NCPC is to provide research-based, cybersecurity-related training, exercises and technical assistance to local jurisdictions, counties, states and the private sector.

MCPc

MCPc

MCPc improves the security and well-being of our clients. We protect data, manage the complexity and sustainability of technology, empower employee performance, and ultimately reduce business risk.

UTMStack

UTMStack

UTMStack is a Unified Security Management system that includes SIEM, Vulnerability Management, Network and Host IDS/IPS, Asset Discovery, Endpoint Protection and Incident Response.

ScorpionShield

ScorpionShield

ScorpionShield CyberSecurity is an EC-Council Accredited Training Center, and an On-Demand Service for Cybersecurity professionals.

Intrepid Solutions and Services

Intrepid Solutions and Services

Intrepid Solutions and Services provides technology solutions and professional services to key components of the intelligence and national security communities.

Cyber Coaching

Cyber Coaching

Cyber Coaching is a community for enhancing technical cyber skills, through unofficial certification training, cyber mentorship, and personalised occupational transition programs.

Guardio

Guardio

Guardio develop tools and products to combat modern web and browser threats.

CSIOS Corp.

CSIOS Corp.

At CSIOS we help our customers achieve and sustain information and cyberspace superiority through a full range of defensive and offensive cyberspace operations and cybersecurity consulting services.

CyberconIQ

CyberconIQ

CyberconIQ provide an integrated Human Defense Platform that reduces the probability and/or the cost of a cybersecurity breach by measurably improving our clients risk posture and compliance culture.

Black Girls In Cyber (BGiC)

Black Girls In Cyber (BGiC)

Black Girls In Cyber's mission is to increase industry awareness and diversity in cybersecurity, privacy, and STEM for women of color.