Categories: Technology

Microsoft was too greedy when it came to cybersecurity – and is now admitting it

Certain cloud security features were previously only available with the premium plan. But in times of professional ransomware gangs and state elite hackers, customers need them more than ever.
Daniel Schurter

Democratic Senator Ron Wyden from the US state of Oregon summed up the questionable business practices of quasi-monopolist Microsoft:

“Offering unsafe products and then making people pay for premium features that are necessary to avoid being hacked is like selling a car and then charging extra for seatbelts and airbags.”

It is about security in cloud services and Chinese hackers who exploited Microsoft vulnerabilities to spy on important US organizations.

The case illustrates the problem that many Microsoft customers, such as human rights groups, were unwilling or financially unable to pay extra for critical security features.

But now the Windows group from Redmond has finally responded and wants to offer the premium features for free – the public pressure was probably simply too much after the most recent serious security incident.

The responsible Microsoft manager Vasu Jakkal was able to announce the good news on Wednesday:

“In the coming months, we will provide our global customers with access to more comprehensive cloud security protocols at no additional cost.”

This confirmed a prediction by the US medium “Cyberscoop”, which specializes in cybersecurity: that under pressure from the US government, Microsoft could change its approach and also make the logging functions available for “lower licenses”.

The competent US authority, the Cybersecurity and Infrastructure Security Agency (CISA) welcomed the overdue move: access to “important log data” is crucial for Microsoft customers to “fastly fend off” dangerous cyber-attacks.

Security researchers had previously criticized the Windows group’s pricing policy: the company had lowered the security level for all customers to sell “standard” as “premium” and left anyone who couldn’t afford it on their own.

“This approach to security is creating a lot of frustration for many in the cybersecurity community with Microsoft, whose products are becoming increasingly ubiquitous.”

What was the occasion?

Over the course of a month — between May 15 and June 16 — Chinese hackers were able to penetrate the email accounts of US Secretary of Commerce Gina Raimondo and US State Department officials. The hacker attacks came just as Foreign Minister Tony Blinken was preparing for a critical trip to China.

And it gets worse: IT security specialists only discovered the attack last week and only thanks to a premium logging service from Microsoft. Business customers are asked to pay extra for this service. Without him, the hack probably would have gone undiscovered.

High-ranking officials and security researchers were angry that Microsoft products were being used again for a coup.

The process is explosive, or rather unfavorable to the White House, for another reason: The Biden administration is currently executing a national cybersecurity strategy presented in March. Their approach: «Secure by Default».

According to the US government, the transition to cloud-based services should bring security benefits – and at the same time lucrative orders for the technology sector. However, the failure of such a service to stop a sophisticated attack shook the foundations of the new strategy.

It therefore seems logical that Microsoft is now adjusting its pricing policy for the fall and increasing security for customers without a premium subscription.

“Any organization using a technology like Microsoft 365 should have immediate access to logging and other security data.”

How can this happen again?

To carry out their operation, the Chinese hackers would have managed to obtain a so-called signature key and use it to create digital access codes (tokens). So they had a duplicate key.

Such security tokens should allow legitimate users to access cloud services (such as Office 365). How the hackers got the key is a great mystery, say American tech journalists. This is a serious security flaw at Microsoft.

In a company blog post published on July 14, the company commented on the incident, saying that the method by which the hackers obtained the key is “under investigation.”

In a report, the American medium Cyberscoop pointed to a fundamental security problem: namely the fact that such a key could even be used to create fraudulent identities. This has left cybersecurity professionals wondering how Microsoft could use such an insecure system.

While many technical details of the Chinese attack remain unclear, researchers are outraged that Microsoft systems have once again been exploited in an attack based on fake authentication tools.

Russian hackers used a similar Microsoft vulnerability in 2021 to penetrate thousands of systems as part of the “SolarWinds” hacking campaign.

The SolarWinds attack
In the 2020 SolarWinds attack, suspected elite Russian hackers infiltrated and spied on thousands of networks around the world. Multinational corporations and key government agencies were affected.

The hackers were able to compromise SolarWinds’ IT management software and inject an attack tool (dubbed “Sunburst”). The malware then landed on victims’ systems as a regular update.

Because the update was digitally signed and from a trusted source, the attackers were able to access many high-profile targets and virtually hide in plain sight. According to experts, such supply chain attacks are very difficult to detect.

Microsoft later confirmed that the attackers were able to infiltrate 40 other organizations that were not even SolarWinds customers. The consequences of the cyber attack were enormous. Vulnerabilities in Microsoft and VMware software also gave attackers access to email and other documents.

Finally, heed the warnings from reputable security experts who say that it will remain extremely difficult in the future to prevent “cyber operations” by experienced and well-equipped elite hackers. When a state is willing to spend time and resources hacking into a computer system, defending it is always a huge challenge.

Sources

  • thehackernews.com: Microsoft Expands Cloud Registration to Counter Rising National Cyber ​​Threats (July 20)
  • cisa.gov: Partnership between CISA and Microsoft broadens access to logging capabilities (July 19)
  • microsoft.com: Expanding Cloud Registration to Give Customers Better Security Insights (July 19)
  • cyberscoop.com: Chinese hacking operation targets Microsoft for security flaws (July 14)

Daniel Schurter

Source: Watson

Share
Published by
Ella

Recent Posts

Terror suspect Chechen ‘hanged himself’ in Russian custody Egyptian President al-Sisi has been sworn in for a third term

On the same day of the terrorist attack on the Krokus City Hall in Moscow,…

1 year ago

Locals demand tourist tax for Tenerife: “Like a cancer consuming the island”

class="sc-cffd1e67-0 iQNQmc">1/4Residents of Tenerife have had enough of noisy and dirty tourists.It's too loud, the…

1 year ago

Agreement reached: this is how much Tuchel will receive for his departure from Bayern

class="sc-cffd1e67-0 iQNQmc">1/7Packing his things in Munich in the summer: Thomas Tuchel.After just over a year,…

1 year ago

Worst earthquake in 25 years in Taiwan +++ Number of deaths increased Is Russia running out of tanks? Now ‘Chinese coffins’ are used

At least seven people have been killed and 57 injured in severe earthquakes in the…

1 year ago

Now the moon should also have its own time (and its own clocks). These 11 photos and videos show just how intense the Taiwan earthquake was

The American space agency NASA would establish a uniform lunar time on behalf of the…

1 year ago

This is how the Swiss experienced the earthquake in Taiwan: “I saw a crack in the wall”

class="sc-cffd1e67-0 iQNQmc">1/8Bode Obwegeser was surprised by the earthquake while he was sleeping. “It was a…

1 year ago