Feeds

MS blocks staff dial-in access after ‘minor’ hack

If you're safe now, why cut off 39,000 employees for the weekend?

  • alert
  • submit to reddit

Remote control for virtualized desktops

According to Microsoft it knew about the hacker's intrusion almost immediately, it tracked the hacker's movements through its network, and it shut down all of the accounts used by the hacker last week. So how come it blocked access to its corporate network for all of its employees, globally, over the weekend?

Since Friday the company has been mounting a determined effort to convince the world that its systems, its software and its source code are secure, and if you take the story according to Microsoft at face value, the threat from the hacker was minor, was finite, and has now passed. A "Microsoft official" quoted in today's Wall Street Journal even went as far as suggesting that the company has detailed information that will help pinch the perpetrator.

So if it's all over bar the arresting, the only reasons for shutting down access must surely be that Microsoft has belatedly concluded that there are - as we suggested yesterday - serious problems with the way it runs its network security. In this context Microsoft's explanation of why it originally said the hacker could have been loose for six weeks, rather than the 12 days it now claims, is significant.

The six week period takes us back to when the corporate email system was taken down because of a virus outbreak, and Microsoft's security team initially feared - so it said - that the two might have been connected. But the real connection is their awareness of the fact that the methods of propagation for both were the same. If Microsoft staff and Microsoft systems are vulnerable to viral email attachments, then they must also be vulnerable to QAZ Trojans intended to break into the network. And besides, under current circumstances there's a high probability of copycat attacks.

Microsoft is clearly beginning a long, hard look at its network security, and Register sources suggest this is not before time. Said one: "MS source control is not very locked down. Pretty much every MS employee can commit to the tree. Which means if you're hacked in and you know this, you can commit your own backdoor code into Windows that might stand a chance of going gold."

This doesn't sound entirely plausible, although the large teams Microsoft has working on code would tend to make it more difficult to police security, and possible easier for rogue code to get through. A tale from Microsoft Germany, however, sounds all too convincing:

"Where I work, I have a colleague who has worked at MS Germany. He once mentioned that he had set up himself a dial-up server with callback in one of the labs there. This server remained active more than a year after he left. To quote: 'Need a new Office - no problem just keep leeching a weekend or so - it's callback, so it's for free.' Of course it was against security-policy (' ...and of course I had turned-off all logging').

"The server was only removed presumably during a full restructuring of the lab, where it was probably found to be superfluous and shut down..."

All companies are of course like this, but as Microsoft is probably the biggest, fattest, most tempting target for hackers, it really can't afford to be like this for much longer. ®

Related Stories:
MS hacked! Russian mafia swipes WinME source?
Redmond strives to cram Great MS Hack back in box

Secure remote control for conventional and virtual desktops

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Microsoft to bake Skype into IE, without plugins
Redmond thinks the Object Real-Time Communications API for WebRTC is ready to roll
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
Mozilla: Spidermonkey ATE Apple's JavaScriptCore, THRASHED Google V8
Moz man claims the win on rivals' own benchmarks
Yes, Virginia, there IS a W3C HTML5 standard – as of now, that is
You asked for it! You begged for it! Then you gave up! And now it's HERE!
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?