Microsoft confirmed last week that attackers were able to view some of its source code, which it found during an ongoing investigation of the SolarWinds breach. While its threat-modeling approach mitigates the risk of viewing code, many questions remain that could determine the severity of this attack.
In a blog post published on Dec. 31, 2020, officials said Microsoft has not found evidence of access to production services or customer data, nor has it discovered that its systems were used to attack other companies. The company has not found indications of common tactics, techniques, and procedures (TTPs) linked to abuse of forged SAML tokens against its corporate domains.
It did find an internal account had been used to view source code in "a number of code repositories," according to the blog post, from the Microsoft Security Response Center (MSRC). This activity was unearthed when investigators noticed unusual activity with a small number of internal accounts, the post explains, and the affected account didn't have permissions to change any code or engineering systems. The accounts were investigated and remediated, officials noted.
The news began to generate attention in the security community, and with good reason: Microsoft's software is among the most widely deployed in the world, and organizations of all sizes rely on the company's products and services. It's an appealing target, in particular among advanced attackers like those behind the SolarWinds incident.
"It's something they can't access themselves, and there's a lot of assumption that there's sup ..
Support the originator by clicking the read the rest link below.
