Logo

American Security Council Foundation

Back to main site

Alan W. Dowd is a Senior Fellow with the American Security Council Foundation, where he writes on the full range of topics relating to national defense, foreign policy and international security. Dowd’s commentaries and essays have appeared in Policy Review, Parameters, Military Officer, The American Legion Magazine, The Journal of Diplomacy and International Relations, The Claremont Review of Books, World Politics Review, The Wall Street Journal Europe, The Jerusalem Post, The Financial Times Deutschland, The Washington Times, The Baltimore Sun, The Washington Examiner, The Detroit News, The Sacramento Bee, The Vancouver Sun, The National Post, The Landing Zone, Current, The World & I, The American Enterprise, Fraser Forum, American Outlook, The American and the online editions of Weekly Standard, National Review and American Interest. Beyond his work in opinion journalism, Dowd has served as an adjunct professor and university lecturer; congressional aide; and administrator, researcher and writer at leading think tanks, including the Hudson Institute, Sagamore Institute and Fraser Institute. An award-winning writer, Dowd has been interviewed by Fox News Channel, Cox News Service, The Washington Times, The National Post, the Australian Broadcasting Corporation and numerous radio programs across North America. In addition, his work has been quoted by and/or reprinted in The Guardian, CBS News, BBC News and the Council on Foreign Relations. Dowd holds degrees from Butler University and Indiana University. Follow him at twitter.com/alanwdowd.

ASCF News

Scott Tilley is a Senior Fellow at the American Security Council Foundation, where he writes the “Technical Power” column, focusing on the societal and national security implications of advanced technology in cybersecurity, space, and foreign relations.

He is an emeritus professor at the Florida Institute of Technology. Previously, he was with the University of California, Riverside, Carnegie Mellon University’s Software Engineering Institute, and IBM. His research and teaching were in the areas of computer science, software & systems engineering, educational technology, the design of communication, and business information systems.

He is president and founder of the Center for Technology & Society, president and co-founder of Big Data Florida, past president of INCOSE Space Coast, and a Space Coast Writers’ Guild Fellow.

He has authored over 150 academic papers and has published 28 books (technical and non-technical), most recently Systems Analysis & Design (Cengage, 2020), SPACE (Anthology Alliance, 2019), and Technical Justice (CTS Press, 2019). He wrote the “Technology Today” column for FLORIDA TODAY from 2010 to 2018.

He is a popular public speaker, having delivered numerous keynote presentations and “Tech Talks” for a general audience. Recent examples include the role of big data in the space program, a four-part series on machine learning, and a four-part series on fake news.

He holds a Ph.D. in computer science from the University of Victoria (1995).

Contact him at stilley@cts.today.

Microsoft Discloses New Customer Hack Linked to SolarWinds Cyberattackers

Monday, June 28, 2021

Categories: ASCF News Cyber Security

Comments: 0

Source: https://www.wsj.com/articles/microsoft-discloses-new-customer-hack-linked-to-solarwinds-cyberattackers-11624680860

Microsoft said Friday it was aware of three customers that were affected by the recent hack. PHOTO: TOBY SCOTT/ZUMA PRESS

Microsoft Corp. said hackers, linked by U.S. authorities to Russia’s Foreign Intelligence Service, installed malicious information-stealing software on one of its systems and used information gleaned there to attack its customers.

The hackers compromised a computer used by a Microsoft customer support employee that could have provided access to different types of information, including ”metadata” of accounts and billing contact information for the organization, a Microsoft spokesman said.

Microsoft is aware of three customers that were affected by the recent activity, the company said in a blog post.

“The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign,” Microsoft said. “We responded quickly, removed the access and secured the device.”

The incident was part of a broader campaign—which involved other hacking techniques beyond leveraging the information taken from its support system—that primarily targeted technology companies and government agencies in 36 countries.

Most of the attacks were unsuccessful, but three of Microsoft’s customers were compromised during the campaign, the company said. “We have confirmed that two of the compromises were unrelated to the support agent issue, and are continuing to investigate the third instance,” a Microsoft spokesman said.

Microsoft identified the hackers behind the break-in as Nobelium, the same group associated with the sophisticated hack at Austin, Texas-based software maker SolarWinds Corp. SWI -1.79% U.S. authorities have said this group is part of Russia’s Foreign Intelligence Service, known as the SVR. Russia has denied involvement in the SolarWinds hack. A Russian embassy representative didn’t immediately return a message seeking comment on Microsoft’s blog post.

“This should concern all of us,” said Sherri Davidoff, chief executive of the security consulting firm LMG Security LLC. “Hackers made it past the defenses of one of the world’s most sophisticated technology suppliers, whose software underlies our entire economy.”

The incident marks the second time in recent months that Russia-linked hackers have breached Microsoft’s networks. In December, Microsoft said Nobelium hackers had broken into the company’s networks to view internal source code, used to build software products.

The U.S. Cybersecurity and Infrastructure Security Agency is “aware of this activity and is working with Microsoft and our interagency partners to evaluate the impact,” said a spokesman for the Department of Homeland Security, which oversees the agency. “We stand ready to assist any affected entities.” He declined to say whether any government agencies had been hit by the hack.

The breaches at Microsoft and SolarWinds have raised concerns among government and industry security professionals that Russian hackers are engaged in a longstanding and concerted effort to break into U.S. technology companies and use them as a back door into government and commercial targets, a tactic known as a “supply-chain attack.”

“This shows that the SVR continues to execute supply chain attacks. In this particular case, going after a support person at Microsoft who clearly has information and connections to Microsoft customers.” said Dmitri Alperovitch, a former cybersecurity investigator who is executive chairman at the Silverado Policy Accelerator think tank.

About 100 companies and at least nine government agencies are known to have been compromised during the SolarWinds attack, which went undetected for months before it was discovered this past fall.

“The latest cyberattack reported by Microsoft does not involve our company or our customers in any way,” a SolarWinds spokesman said.

In April, the Biden administration unveiled a series of sanctions against Russia citing, among other things, the SolarWinds cyberattack. Russia has denounced the sanctions.

Since then, the Russian-linked hackers have made it clear that they intend to continue their activity. In May, Microsoft said it discovered that the hackers were involved in a phishing campaign that targeted 3,000 email accounts belonging to workers at more than 150 organizations.

Earlier this month, President Biden said he warned his Russian counterpart, Vladimir Putin, that there would be consequences for cyberattacks on the U.S. at the two leaders’ first in-person meeting in Switzerland.

“The supply-chain attacks are here to stay with us,” Mr. Alperovitch said “It didn’t end with SolarWinds.”

Comments RSS feed for comments on this page

There are no comments yet. Be the first to add a comment by using the form below.