Microsoft's suite of products has been under scrutiny since the hack of SolarWinds (SWI.N), the Texas-based software firm that served as a springboard for several intrusions across government and the private sector. In other cases, hackers took advantage of the way customers had set up their Microsoft services to compromise their targets or dive further into affected networks. On its website, the NFC says it “services more than 160 diverse agencies, providing payroll services to more than 600,000 Federal employees.Hackers who went after SolarWinds also breached Microsoft itself, accessing and downloading source code - including elements of Exchange, the company's email and calendaring product. Records held by the NFC include federal employee social security numbers, phone numbers and personal email addresses as well as banking information. The NFC is responsible for handling the payroll of multiple government agencies, including several involved in national security, such as the FBI, State Department, Homeland Security Department and Treasury Department, the former officials said. But the potential impact could be “massive,” former U.S. Reuters could not determine what information the attackers were able to steal from the National Finance Center (NFC) or how deep they burrowed into its systems. The connection between the second set of attacks on SolarWinds customers and suspected Chinese hackers was only discovered in recent weeks, according to security analysts investigating alongside the U.S. While the alleged Russian hackers penetrated deep into SolarWinds network and hid a “back door” in Orion software updates which were then sent to customers, the suspected Chinese group exploited a separate bug in Orion’s code to help spread across networks they had already compromised, the sources said. government, they were separate and distinctly different operations, according to four people who have investigated the attacks and outside experts who reviewed the code used by both sets of hackers. SolarWinds did not say how the hackers first got in, except to say it was “in a way that was unrelated to SolarWinds.”Īlthough the two espionage efforts overlap and both targeted the U.S. In the case of the sole client it knew about, SolarWinds said the hackers only abused its software once inside the client’s network. banner hangs at the New York Stock Exchange (NYSE) on the IPO day of the company in New York, U.S., October 19, 2018. The sources, who spoke on condition of anonymity to discuss ongoing investigations, said the attackers used computer infrastructure and hacking tools previously deployed by state-backed Chinese cyberspies.įILE PHOTO: SolarWinds Corp. Reuters was not able to establish how many organizations were compromised by the suspected Chinese operation. government breach have not been previously reported. ![]() Security researchers have previously said a second group of hackers was abusing SolarWinds’ software at the same time as the alleged Russian hack, but the suspected connection to China and ensuing U.S. The software flaw exploited by the suspected Chinese group is separate from the one the United States has accused Russian government operatives of using to compromise up to 18,000 SolarWinds customers, including sensitive federal agencies, by hijacking the company’s Orion network monitoring software. Department of Agriculture, was among the affected organizations, raising fears that data on thousands of government employees may have been compromised. Two people briefed on the case said FBI investigators recently found that the National Finance Center, a federal payroll agency inside the U.S.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |