5 ms·

Microsoft has now categorically denied it. "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. Perlroth

by yborg 6y ago

Microsoft has now categorically denied it. "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. Perlroth said the company stood by a statement it issued on Sunday saying it had no indication of a vulnerability in any Microsoft product or cloud service in its investigations of the hacking campaign."

dragonwriter 6y ago
> Microsoft has now categorically denied it. No, they haven't > "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. That's not a categorical denial of being penetrated, it's a denial of having information about being penetrated.
- stelfer 6y ago
  It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement. On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were. [1]https://us-cert.cisa.gov/ncas/alerts/aa20-352a https://us-cert.cisa.gov/ncas/alerts/aa20-352a
  - AnimalMuppet 6y ago
    Are you saying that the attacker's skill with AD indicates that they were able to plant code in AD? Steal the source and learn vulnerabilities from it? Or just that, given that MS uses AD, they were vulnerable too?
  - deleted 6y ago
    [deleted]
- deleted 6y ago
  [deleted]
- deleted 6y ago
  [deleted]
- leereeves 6y ago
  If Microsoft's statement is honest, it certainly raises doubts about this story. What "people familiar with the matter" know more than Microsoft themselves? Even if the information was discovered during a government or private investigation of the hacks that didn't include Microsoft, the investigators likely would have notified Microsoft immediately.
  - Godel_unicode 6y ago
    Given the SEC implications of an officer of the company lying about something that could materially affect share prices, you can certainly believe that Microsoft thinks his statements are true. Literally anyone can tell a journalist that they're "familiar with the matter". Given reuters track record on security coupled with the lack of update about Microsoft's public statement, I'm inclined to be pretty skeptical about the quality of those sources.
    - Red_Leaves_Flyy 6y ago
      >SEC implications Don't apply to matters of national security. Seeing as solar winds supplied every branch of government and just about every company that matters in the U.S., I would imagine that there are a lot of people under gag orders, or prohibited from talking about classified Intel with people that don't have clearance. To be safe, it'd be wise to not have company officers who also hold clearances.
      - Godel_unicode 6y ago
        Do you have a citation for that? I'm not aware of anything about having a clearance which indemnifies you for fraud.
        Red_Leaves_Flyy 6y ago
        I am not a lawyer and merely [poorly] paraphrasing what I've heard in discussion about this legal quandary. The problem as I see it is that in order for a judge to not immediately dismiss a case the aggrieved party needs to have some evidence that these statements were made falsely. Considering the CISA opsec guidelines, there should not be a corporate paper trail detailing officials knowledge, so where and how do you get evidence that can be admitted to court? Witnesses would presumably be under similar NATSEC restrictions, have questionable custody of the evidence, or worse, they can only provide hearsay.
- justapassenger 6y ago
  That’s the strongest truthful statement any company can give you. You can never be 100% sure you aren’t hacked. You can only be sure, that as far as you know, no one hacked you.
  - kccqzy 6y ago
    When Bloomberg implicated Apple in The Big Hack, Apple gave way stronger denials. So did Amazon. > Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
    - justapassenger 6y ago
      Exactly - Apple never said "we weren't hacked, 100% sure". They said, that all the data they have shows no evidence, plus pointed out some BS in the story.
    - Red_Leaves_Flyy 6y ago
      Interesting that they only mention server. What about their employee devices, networking hardware, and every other internet connected thing? Not saying I buy this theory, but that denial leaves a lot of technically correct room to lie through their teeth.
      - caminocorner 6y ago
        Thats because the entirety of Bloomberg's nonsense focused on a supposed server. So there wasn't any need to disown employee devices, mobile phones, iot, etc
  - dragonwriter 6y ago
    > That’s the strongest truthful statement any company can give you. Oh, I agree that no company will ever make a categorical denial of something like this; I just don't think that justifies promoting a lesser denial into a categorical one.
- mhh__ 6y ago
  That's still a non-denial denial, right? "We never said we weren't breached, we just said we had no indication of being breached [...]" (Not that you can really give any more information in a public forum)
  - bostonvaulter2 6y ago
    Or even we have no indication of this specific breach that you are talking about.
- gmueckl 6y ago
  That statement doesn't even say whether they were actually checking. It's easy to have no knowledge when you aren't looking. I don't think the statement was meant that way, but it just shows how defensive the wording is.
- jyrkesh 6y ago
  I believe Brad Smith was chief of legal counsel before he was president. It would make sense for him to be very careful with his words here
tiahura 6y ago
Microsoft has now confirmed it? Microsoft found code related to that cyber-attack “in our environment, which we isolated and removed,” https://www.msn.com/en-us/news/technology/microsoft-says-its-systems-were-exposed-to-solarwinds-hack/ar-BB1c1zIn https://www.msn.com/en-us/news/technology/microsoft-says-its...
- junyoon 6y ago
  might be time to buy Amazon shares
  - AnimalMuppet 6y ago
    That sounds like you're assuming that Amazon didn't get hit. I'm not sure that I think that to be a safe assumption.
nonce42 6y ago
Microsoft's statement confirms that they had malicious software in their environment: “Like other SolarWinds customers, we have been actively looking for indicators of this actor and can confirm that we detected malicious SolarWinds binaries in our environment, which we isolated and removed. We have not found evidence of access to production services or customer data. Our investigations, which are ongoing, have found absolutely no indications that our systems were used to attack others.” https://blogs.microsoft.com/on-the-issues/2020/12/17/cyberattacks-cybersecurity-solarwinds-fireeye/ https://blogs.microsoft.com/on-the-issues/2020/12/17/cyberat...

by yborg 6y ago

dragonwriter 6y ago

> Microsoft has now categorically denied it. No, they haven't > "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. That's not a categorical denial of being penetrated, it's a denial of having information about being penetrated.

stelfer 6y ago
It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement. On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were. [1]https://us-cert.cisa.gov/ncas/alerts/aa20-352a https://us-cert.cisa.gov/ncas/alerts/aa20-352a
- AnimalMuppet 6y ago
  Are you saying that the attacker's skill with AD indicates that they were able to plant code in AD? Steal the source and learn vulnerabilities from it? Or just that, given that MS uses AD, they were vulnerable too?
- deleted 6y ago
  [deleted]
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
leereeves 6y ago
If Microsoft's statement is honest, it certainly raises doubts about this story. What "people familiar with the matter" know more than Microsoft themselves? Even if the information was discovered during a government or private investigation of the hacks that didn't include Microsoft, the investigators likely would have notified Microsoft immediately.
- Godel_unicode 6y ago
  Given the SEC implications of an officer of the company lying about something that could materially affect share prices, you can certainly believe that Microsoft thinks his statements are true. Literally anyone can tell a journalist that they're "familiar with the matter". Given reuters track record on security coupled with the lack of update about Microsoft's public statement, I'm inclined to be pretty skeptical about the quality of those sources.
  - Red_Leaves_Flyy 6y ago
    >SEC implications Don't apply to matters of national security. Seeing as solar winds supplied every branch of government and just about every company that matters in the U.S., I would imagine that there are a lot of people under gag orders, or prohibited from talking about classified Intel with people that don't have clearance. To be safe, it'd be wise to not have company officers who also hold clearances.
    - Godel_unicode 6y ago
      Do you have a citation for that? I'm not aware of anything about having a clearance which indemnifies you for fraud.
      - Red_Leaves_Flyy 6y ago
        I am not a lawyer and merely [poorly] paraphrasing what I've heard in discussion about this legal quandary. The problem as I see it is that in order for a judge to not immediately dismiss a case the aggrieved party needs to have some evidence that these statements were made falsely. Considering the CISA opsec guidelines, there should not be a corporate paper trail detailing officials knowledge, so where and how do you get evidence that can be admitted to court? Witnesses would presumably be under similar NATSEC restrictions, have questionable custody of the evidence, or worse, they can only provide hearsay.
justapassenger 6y ago
That’s the strongest truthful statement any company can give you. You can never be 100% sure you aren’t hacked. You can only be sure, that as far as you know, no one hacked you.
- kccqzy 6y ago
  When Bloomberg implicated Apple in The Big Hack, Apple gave way stronger denials. So did Amazon. > Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
  - justapassenger 6y ago
    Exactly - Apple never said "we weren't hacked, 100% sure". They said, that all the data they have shows no evidence, plus pointed out some BS in the story.
  - Red_Leaves_Flyy 6y ago
    Interesting that they only mention server. What about their employee devices, networking hardware, and every other internet connected thing? Not saying I buy this theory, but that denial leaves a lot of technically correct room to lie through their teeth.
    - caminocorner 6y ago
      Thats because the entirety of Bloomberg's nonsense focused on a supposed server. So there wasn't any need to disown employee devices, mobile phones, iot, etc
- dragonwriter 6y ago
  > That’s the strongest truthful statement any company can give you. Oh, I agree that no company will ever make a categorical denial of something like this; I just don't think that justifies promoting a lesser denial into a categorical one.
mhh__ 6y ago
That's still a non-denial denial, right? "We never said we weren't breached, we just said we had no indication of being breached [...]" (Not that you can really give any more information in a public forum)
- bostonvaulter2 6y ago
  Or even we have no indication of this specific breach that you are talking about.
gmueckl 6y ago
That statement doesn't even say whether they were actually checking. It's easy to have no knowledge when you aren't looking. I don't think the statement was meant that way, but it just shows how defensive the wording is.
jyrkesh 6y ago
I believe Brad Smith was chief of legal counsel before he was president. It would make sense for him to be very careful with his words here

tiahura 6y ago

Microsoft has now confirmed it? Microsoft found code related to that cyber-attack “in our environment, which we isolated and removed,” https://www.msn.com/en-us/news/technology/microsoft-says-its-systems-were-exposed-to-solarwinds-hack/ar-BB1c1zIn https://www.msn.com/en-us/news/technology/microsoft-says-its...

junyoon 6y ago
might be time to buy Amazon shares
- AnimalMuppet 6y ago
  That sounds like you're assuming that Amazon didn't get hit. I'm not sure that I think that to be a safe assumption.

nonce42 6y ago

Microsoft's statement confirms that they had malicious software in their environment: “Like other SolarWinds customers, we have been actively looking for indicators of this actor and can confirm that we detected malicious SolarWinds binaries in our environment, which we isolated and removed. We have not found evidence of access to production services or customer data. Our investigations, which are ongoing, have found absolutely no indications that our systems were used to attack others.” https://blogs.microsoft.com/on-the-issues/2020/12/17/cyberattacks-cybersecurity-solarwinds-fireeye/ https://blogs.microsoft.com/on-the-issues/2020/12/17/cyberat...