US blames China for Microsoft exploit, lists Washington university as separate hack target

[ad_1]

Microsoft CEO Satya Nadella discusses the importance of security at a previous Microsoft Build developer conference. (Photo from GeekWire file)

The United States and its allies took the extraordinary step of attributing cyber attacks that exploited vulnerabilities in the Microsoft Exchange server to hackers affiliated with China’s Ministry of State Security.

In a separate action announced as part of the same statement, the US Department of Justice unveiled criminal charges against four people it identified as MSS hackers, accusing them of engaging in a multi-year campaign. targeting foreign governments and entities in key sectors including maritime, aeronautics, defense, education and health in at least a dozen countries.

This indictment lists a Washington university with an applied physics laboratory involved in maritime research and development among the targets of the hacking attempts. GeekWire has contacted the University of Washington, which appears to fit only that description, for further comment.

Both actions are part of a larger attempt by the United States and its NATO allies to identify and curb what they describe as irresponsible behavior by the Chinese state.

The attribution of the Exchange Server hacks is based on Microsoft’s identification of the hackers in March as the Chinese group Hafnium, which the company described at the time as a highly skilled and sophisticated player.

The assignments made by the US government and its allies on Monday morning are an important and positive step that will contribute to our collective security, said Tom Burt, Microsoft vice president, customer security and trust.

Attributions like these will help the international community to ensure that those who instigate indiscriminate attacks are held accountable, Burt said. Transparency is essential if we are to fight the growing cyber attacks that we see across the planet against individuals, organizations and nations.

The White House said in its statement: Before Microsoft released its security updates, cyber operators affiliated with MSS were exploiting these vulnerabilities to compromise tens of thousands of computers and networks around the world in a massive operation. which entailed significant remediation costs for its victims, mainly from the private sector.

He added: We have voiced our concerns about both this incident and the PRC’s broader malicious cyber activity to senior PRC government officials, making it clear that the PRC’s actions threaten. security, trust and stability in cyberspace.

The recently unsealed indictment by the grand jury against four alleged MSS affiliates was originally filed on May 28 in U.S. District Court for the Southern District of California.

The indictment alleges that the object of the conspiracy was to install malware and hacking tools on protected computers and to exploit such malware and tools to commit unauthorized computer intrusions, all in the purpose of stealing valuable information from foreign governments, universities and companies on behalf of the PRC and its institutions, including state-owned companies in the rail and naval sectors, and biopharmaceutical companies and other sponsored companies by the state and the private sector.

It refers to the targets of the hacks by pseudonyms, using the name University G for the University of Washington with the maritime-oriented Applied Physics Lab.

As part of a multi-year effort to infiltrate computer systems, the indictment states that hackers in 2016 and 2017 sent targeted malicious emails, known as spear phishing attacks, to researchers and labs at institutions like G University, using email accounts that hackers had previously compromised.

A review of spear phishing emails sent in December 2017 to University G and a University of Pennsylvania (University D) found that hackers had a particular interest in the nanopore data used in research on viruses that l University G had exclusively licensed to a private company, according to the indictment. .

The University of Washington announced in October 2013 that researchers led by UW physicist Jens Gundlach had developed nanopore sequencing technology capable of reading the sequence of a single DNA molecule, and had licensed the technology. at Illumina Inc, based in San Diego.

It is not clear from the indictment whether the spear phishing attacks against University G were successful.

[ad_2]