TLTP
\nWASHINGTON
\nMicrosoft has said that the suspected Russian hackers behind a massive US government security breach also viewed some of the company\u2019s source code.
\nThe unauthorised access does not appear to have compromised any Microsoft services or customer data, the company said in a blog post. But an investigation showed that the attackers took advantage of their access to Microsoft\u2019s systems to view company code.
\n\u201cWe detected unusual activity with a small number of internal accounts and upon review, we discovered one account had been used to view source code in a number of source code repositories,\u201d Microsoft said. \u201cThe account did not have permissions to modify any code or engineering systems and our investigation further confirmed no changes were made.
\nThe disclosure highlights the broad reach of the attackers, whom investigators have described as extremely sophisticated and well-resourced. And it suggests that corporate espionage may have been as much a motive as a hunt for government secrets.
\nSource code represents the basic building blocks of computer programs. They are the instructions written by programmers that make up an application or computer programme.
\nMicrosoft had previously acknowledged using the IT management software, SolarWinds Orion, that gave the attackers a potential window into thousands of public and private sector organizations.
\nBut this marks the first time Microsoft has confirmed that the attackers exploited the vulnerability against the technology giant.
\nMike Chapple, a former National Security Agency official and an information technology professor at the University of Notre Dame, said the attackers were likely looking for potential security vulnerabilities in Microsoft products that they could exploit to gain access to users of those products.
\n\u201cCybersecurity professionals now need to be concerned that this information falling into the wrong hands might create the next SolarWinds-level vulnerability in a Microsoft product,\u201d Chapple said.
\nBut Microsoft said its security practices begin by preemptively assuming that hackers already have access to the company\u2019s source code, and protects its services accordingly.
\n\u201cWe do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code,\u201d the company said. \u201cSo viewing source code isn\u2019t tied to elevation of risk.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
TLTP WASHINGTON Microsoft has said that the suspected Russian hackers behind a massive US government security breach also viewed some of the company\u2019s source code. The unauthorised access does not appear to have compromised any Microsoft services or customer data, the company said in a blog post. But an investigation showed that the attackers took […]<\/p>\n","protected":false},"author":2,"featured_media":143942,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-165761","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology"],"yoast_head":"\n