Investigação atribui responsabilidades à Microsoft no ataque da SolarWinds

[Rui Carlos]

Um longo artigo de investigação que detalha como uma opção por um sistema mais conveniente – em vez de um mais seguro – terá contribuído para amplificar as consequências do ataque da SolarWinds.

Artigo completo: https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackers

Citação

Microsoft Chose Profit Over Security and Left U.S. Government Vulnerable to Russian Hack, Whistleblower Says

[...]

Early on, he focused on a Microsoft application that ensured users had permission to log on to cloud-based programs, the cyber equivalent of an officer checking passports at a border. It was there, after months of research, that he found something seriously wrong.

The product, which was used by millions of people to log on to their work computers, contained a flaw that could allow attackers to masquerade as legitimate employees and rummage through victims’ “crown jewels” — national security secrets, corporate intellectual property, embarrassing personal emails — all without tripping alarms.

To Harris, who had previously spent nearly seven years working for the Defense Department, it was a security nightmare. Anyone using the software was exposed, regardless of whether they used Microsoft or another cloud provider such as Amazon. But Harris was most concerned about the federal government and the implications of his discovery for national security. He flagged the issue to his colleagues.

[...]