Microsoft 'downplayed internal database hack'

But Redmond says bug-tracking database breach did not lead to exploits - report

Microsoft's internal database that it uses to track bugs in its software was reportedly hacked in 2013.

A highly sophisticated hacking group was behind the alleged breach, according to Reuters, which is the second known breach of this kind of corporate database.

Five former employees told the publication about the hack in separate interviews, thoughReuters said Microsoft did not disclose the depth of the attack in 2013.

The database in question contained information on critical and unfixed vulnerabilities found in not only the Windows operating system but also some of the most widely used worldwide software, the publication reported.

Advertisement
Advertisement - Article continues below

Microsoft learned of the breach in early 2013 after a hacking group launched a series of attacks against high profile tech companies including Apple, Twitter and Facebook.

The group exploited a flaw in the Java programming language to access employees' Apple computers, before moving into the company's network, Reuters said.

Microsoft released a short statement following the attack on 22 February 2013 that said: "As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion.

"We found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations. We have no evidence of customer data being affected, and our investigation is ongoing."

In an email responding to questions fromReuters, Microsoft said: "Our security teams actively monitor cyber threats to help us prioritize and take appropriate action to keep customers protected."

A Microsoft spokesperson toldIT Pro:"In February 2013 we commented on the discovery of malware, similar to that found by other companies at the time, on a small number of computers including some in our Mac business unit. Our investigation found no evidence of information being stolen that could be used in subsequent attacks."

This contradictsReuters' report, whosesources said that although the bugs in the database had been exploited in hacking attacks, the attackers could have found the information elsewhere.

Reuters saidMicrosoft didn't disclose the breach because of this, and because many patches had already been released to customers.

"They absolutely discovered that bugs had been taken," one source said. "Whether or not those bugs were in use, I don't think they did a very thorough job of discovering."

Following the breach, Microsoft improved its security by separating the database from the corporate network and including two authentications to access the information, Reuters reported.

Advertisement
Advertisement - Article continues below

Mozilla had a similar attack in 2015 when an attacker accessed a database which included information on 10 unpatched flaws. One of the flaws was then used to attack Firefox users, which Mozilla told the public about at the time, telling customers to take action.

Mozilla CBO and CLO Denelle Dixon said the foundation released the information about what it knew in 2015 "not only [to] inform and help protect our users, but also to help ourselves and other companies learn, and finally because openness and transparency are core to our mission."

Reuters wrote that the hacking group has been called Morpho, Butterfly and Wild Neutron but security researchers say it is a proficient and mysterious group and that they cannot determine if it is backed by a state government.

Equifax revelead that a file containing 700,000 UK records was accessed during a data breach in May,giving attackers access to names and contact details. Of that figure, 700,000 accounts had partial credit information and email addresses stolen.

Featured Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now

Life in the digital workspace

A guide to technology and the changing concept of workspace

Download now
Advertisement

Recommended

Visit/business-strategy/collaboration/354160/microsoft-teams-surpasses-20-million-daily-users
collaboration

Microsoft Teams surpasses 20 million daily users

20 Nov 2019
Visit/laptops/34813/microsoft-surface-pro-7-review-slightly-faded-glory
Laptops

Microsoft Surface Pro 7 review: Slightly faded glory

15 Nov 2019
Visit/business-strategy/34796/view-from-the-airport-microsoft-ignite-2019
Business strategy

View from the airport: Microsoft Ignite 2019

12 Nov 2019
Visit/laptops/34636/microsoft-surface-laptop-3-hands-on-review-powerfully-tempting
Laptops

Microsoft Surface Laptop 3 hands-on review

15 Oct 2019

Most Popular

Visit/business-strategy/mergers-and-acquisitions/354191/xerox-threatens-hostile-takeover-after-hp-rebuffs
mergers and acquisitions

Xerox threatens hostile takeover after HP rebuffs $30bn takeover

22 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019
Visit/business-strategy/it-infrastructure/354188/tsb-payment-delays-suggest-second-it-meltdown
IT infrastructure

TSB payment delays suggest second IT meltdown

22 Nov 2019
Visit/public-cloud/34850/salesforce-takes-aws-relationship-to-the-next-level
News

Salesforce takes AWS relationship to the next level

19 Nov 2019