Microsoft: SolarWinds hackers were able to view source code - Business Insider
source link: https://www.businessinsider.com/solarwinds-hackers-were-able-to-access-microsoft-source-code-microsoft-blog-post-2020-12
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Home Chevron iconIt indicates an expandable section or menu, or sometimes previous / next navigation options.Tech
Microsoft says SolarWinds hackers were able to view its source code but didn't have the ability to modify it
Simon Dawson/Reuters- Hackers behind the massive SolarWinds compromise were able to break into Microsoft and view some of its source code, the company said.
- The hackers were not able to modify the source code, which is the blueprint of how software is built, the company said.
- Microsoft's disclosure adds to a growing list of companies and government agencies that were breached in the hack.
- Visit Business Insider's homepage for more stories.
The hacking group behind the SolarWinds compromise was able to break into Microsoft and access some of the company's source code, the firm said on Thursday.
In a blog post, Microsoft said its investigation into the SolarWinds breach had turned up irregularities with a "small number of internal accounts" and that one of the accounts "had been used to view source code in a number of source code repositories." It added that the account had no ability to modify the code.
The disclosure adds to the ever-growing picture of the compromises associated with the SolarWinds hack, which used the Texas-based company's flagship network monitoring software as a springboard to break into sensitive U.S. government networks and other tech companies. Microsoft had already disclosed that like other firms it found malicious versions of SolarWinds' software inside its network, but the source code disclosure is new.
A company's source code - the underlying set of instructions that run a piece of software or an operating system - is typically among its most closely guarded secrets. It is not clear how many or specifically which source code repositories the hackers were able to access or how long the hackers were lurking in Microsoft's systems. A Microsoft spokesman declined to elaborate on the blog post.
Read more:Here's a simple explanation of how the massive SolarWinds hack happened and why it's such a big deal
Modifying source code - which Microsoft said the hijacked account could not do - could have potentially disastrous consequences, but experts said that even just being able to review the code could offer hackers insight that might help them subvert Microsoft products or services.
"The source code is the architectural blueprint of how the software is built," said Andrew Fife of Israel-based Cycode, a source code protection company.
"If you have the blueprint, it's far easier to engineer attacks."
Both he and Ronen Slavin, Cycode's chief technology officer, said a key unanswered question was which source code repositories were accessed. Microsoft has a huge range of products, from its flagship Windows operating system to lesser known software such as social networking app Yammer and the design app Sway.
Slavin said he was also worried by the possibility that the SolarWinds hackers were poring over Microsoft's source code as prelude for something more ambitious.
"To me the biggest question is, 'Was this recon for the next big operation?'" he said.
In its blog post, Microsoft said it had found no evidence of access "to production services or customer data."
"The investigation, which is ongoing, has also found no indications that our systems were used to attack others," it said.
(Reporting by Raphael Satter; Editing by Chris Reese, Diane Craft and Daniel Wallis)
Recommend
-
8
Tuesday, 15 December 2020 07:48 SolarWinds FTP credentials were leaking on GitHub in November 2019 Featured By
-
2
ADVANCED PERSISTENT THREAT — SolarWinds hackers have a clever way to bypass multi-factor authentication Hackers who hit SolarWinds compromised a think tank three separate times....
-
12
Home Chevron iconIt indicates an expandable section or menu, or sometimes previous / next navigation options.Tech
-
12
Home Chevron iconIt indicates an expandable section or menu, or sometimes previous / next navigation options.Retail ...
-
6
Close this contentHackers last year conducted a 'dry run' of SolarWinds breach
-
9
2020 Candidate SlideshowsDecember 16, 202010:08 AMUpdated 7 days agoHackers used SolarWinds' dominance against it in spraw...
-
13
SolarWinds: How Russian hackers dealt the US its worst cyberspace defeat in a decade The cyber attack hit 18,000 businesses and has caused internal chaos for the US government
-
6
SolarWinds hackers accessed Microsoft source code Microsoft says customer data wasn't compromised.
-
7
FRIDAY NIGHT TRASH — SolarWinds hackers breach new victims, including a Microsoft support agent Discovery came as Microsoft was investigating new breaches by the same hacker group....
-
7
TechSolarwinds hackers are targeting the global IT supply chain, Microsoft saysPublished Mon, Oct 25 20217:46 AM EDT
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK